Legal
Privacy policy
What we collect, why, and what you can do about it. Last updated 28 August 2026.
Who we are
Learn and Drive UK is the data controller for the personal data described here. You can reach us at info@learnanddrive.uk, on 07966 587877, or by post at 26 Blue Moon Way, Manchester M14 7SH.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, phone, postcode | To create your account, match you with a local instructor and contact you about lessons | Contract |
| Password (hashed) | To secure your account | Contract |
| Lesson bookings and payment records | To deliver and account for lessons | Contract, and legal obligation for tax records |
| Theory and hazard perception results | To show your progress and let your instructor target lessons | Contract |
| Instructor lesson notes | To track your development against the syllabus | Contract |
| Test centre alert preferences | To email you when a slot matching your criteria is spotted | Consent |
| Marketing preferences | To send tips and offers if you have opted in | Consent |
| Analytics data | To understand how the site is used | Consent (via the cookie banner) |
What we never do
- · We do not sell your data, or share it with advertisers.
- · We do not ask for or store your GOV.UK credentials. We cannot book your driving test, and we never try.
- · We do not store card details. Payments are handled by Stripe; card numbers never reach our servers.
Who we share it with
- · Your instructor — name, contact details, lesson history and test progress, so they can teach you properly.
- · Stripe — to take payments. Stripe is the controller for card data.
- · Resend — to send transactional email such as booking confirmations and alerts.
- · Our hosting and database providers — who store the data on our behalf.
How long we keep it
- · Account and progress data — while your account is active, then deleted when you close it.
- · Booking and payment records — seven years, because HMRC requires it. These are anonymised when you delete your account: the financial record stays, the link to you does not.
- · Marketing consent — until you withdraw it.
Your rights
Under UK GDPR you can access, correct, delete, restrict or object to our use of your data, and request it in a portable format.
Two of these are built in rather than requiring an email: from your profile you can download everything we hold about you as a file, and delete your account permanently. For anything else, email us and we will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office.
Security
Passwords are hashed with argon2id and never stored in readable form. Sessions use random tokens stored hashed, so a database leak cannot be replayed as a login. All traffic is encrypted in transit. Changing your password signs out every other device.
Marketing and the newsletter
We only send driving tips and offers if you asked for them, by ticking the box yourself. A pre-ticked box is not consent and we do not use one.
Every newsletter carries an unsubscribe link. It needs no password and no account — open it, press the button, and you are off the list straight away. Unsubscribing has no effect on your lessons, and we will still send you the things you need — booking confirmations, reminders, receipts and safety notices — because those are part of the service rather than marketing.
Learners under 18
You can start driving lessons at 17, so some of our learners are under 18. We collect no more from them than from anyone else, and we do not send marketing to anyone under 18. If you are a parent or guardian and want to know what we hold about your child, contact us.
Where your data is stored
Our database and backups are held on servers in the UK and the European Economic Area. Two of our suppliers — Stripe for payments and our email provider — may process data outside the UK. Where they do, the transfer relies on the UK government's adequacy decisions or on the International Data Transfer Agreement, which is the safeguard UK GDPR requires.
Automated decisions and profiling
We do not make decisions about you by automated means, and we do not profile you for advertising. Matching you to a nearby instructor uses your postcode and nothing else, and a person confirms every booking.
Cookies
We use a small number of cookies. See our cookie policy for the detail.
Changes
If we change this policy we will update the date at the top, and tell you directly if the change is significant.