Privacy Policy

Data protection law distinguishes between a controller (the organisation that decides why and how personal data is used) and a processor (an organisation that handles data on a controller's instructions).

• If you're a pupil, the driving school or instructor you book lessons with is the data controller for your personal information. We are their data processor: we run the booking platform on their behalf, and only use your data to provide that service.
• If you're a business owner or instructor using Holdfast Driving to run your school, we are the data controller for your own account, billing, and platform usage data.

Business customers acting as controller for their pupils' data can request our Data Processing Agreement, which sets out our obligations as processor in full, by emailing support@holdfastdriving.co.uk.

Business owners and instructors: name, email address, password (stored as a salted hash, never in plain text), business name, lesson pricing and availability, Stripe Connect account details for receiving payouts, and subscription billing information.

Pupils: name, email address, phone number if provided, pick-up and drop-off addresses for booked lessons, lesson and payment history, prepaid lesson balance, gift card activity, DVSA progress notes your instructor records, and any support requests you submit.

Payment information: card payments are handled directly by Stripe, our payment processor. We never see or store full card numbers. We keep a reference token from Stripe so a saved card can be charged for future lessons, plus records of charges, refunds, and payouts for accounting purposes.

Location data: pick-up and drop-off addresses you provide are sent to Google Maps to estimate drive time between consecutive lessons, so the booking system can avoid scheduling lessons too close together for an instructor to physically make it between them.

• To operate the booking, scheduling, and availability system.
• To process lesson payments, no-show and late-cancellation charges, and instructor payouts via Stripe Connect.
• To send transactional emails: booking confirmations, lesson reminders, receipts, and replies to support requests.
• To estimate drive time between lessons via Google Maps.
• To prevent fraud and abuse, and to keep the accounting records we're legally required to retain.
• To respond to support requests and enforce reasonable rate limits against spam.

We do not sell personal data, and we do not use it for advertising.

We share personal data with the following processors, only as needed to run the service:

• Stripe — payment processing, saved payment methods, and Stripe Connect payouts to instructors.
• Resend — sending transactional emails (confirmations, reminders, receipts, support replies).
• Google Maps — estimating drive time between pick-up and drop-off addresses.
• Vercel Blob — storing instructor profile photos.
• Our hosting and database providers — running the application and storing data securely.

Some of these providers may process data outside the UK/EEA. Where they do, they provide appropriate safeguards such as Standard Contractual Clauses. We don't share personal data with anyone else, other than where required by law. If we add or change a subprocessor in a way that materially affects how a business customer's pupil data is handled, we'll let that business customer know in advance.

We keep pupil and lesson data for as long as your account with a business customer is active, plus a reasonable period afterwards in case it's needed for a dispute or refund. We keep financial records (payments, invoices, payouts) for at least 6 years, as required for UK tax purposes. If a business customer closes their account, we delete or anonymise pupil data within a reasonable period, except where we're required to keep financial records for longer.

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you and get a copy of it.
• Ask us to correct inaccurate data.
• Ask us to delete your data, subject to our legal obligation to keep some financial records.
• Object to or restrict certain uses of your data.
• Ask for your data in a portable format.

If you're a pupil, please contact your driving school or instructor directly first, since they're the data controller for your information. If you're a business customer or instructor, or if your school is no longer able to help, contact us at support@holdfastdriving.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) if you're unhappy with how your data has been handled.

We use a single session cookie to keep you signed in. We don't use tracking, advertising, or analytics cookies.

Passwords are stored as salted hashes, never in plain text. Data is encrypted in transit. Access to production data is limited to what's needed to operate and support the service.

Driving lessons are typically booked by pupils aged 17 and over, in line with the minimum age for a UK provisional driving licence. We don't knowingly collect personal data from children younger than that other than what a parent or guardian provides on their behalf when booking.

We may update this policy from time to time. If we make significant changes, we'll let business customers know so they can pass that on to their pupils.

Questions about this policy or how your data is handled: support@holdfastdriving.co.uk.