1. Introduction

Welcome to Driving Lessons Kent (“we”, “our”, or “us”). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website (drivinglessonskent.co.uk) and our platform services, whether you are a learner driver seeking tuition (“Customer”) or an Approved/Potential Driving Instructor utilising our platform to receive leads (“Provider”).

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Driving Lessons Kent acts as the Data Controller for core platform data, and in specific lead routing instances, acts as a joint data controller alongside our registered Providers.

2. The Data We Collect

We collect different types of information depending on how you interact with our platform.

A. For Customers (Learners)

• Identity & Contact Data: Name, email address, telephone number, and residential/pickup postcode.
• Tuition Preferences: Transmission preference (manual/automatic) and specific localised training requirements.
• Verification & Review Data: Secure, time-bound cryptographic interaction tokens generated to facilitate customer reviews.

B. For Providers (Driving Instructors)

• Identity & Business Data: Full name, business/trading name, contact email, telephone number, and assigned localised operating territories.
• Professional Credentials: ADI/PDI qualification registration numbers and licensing status.
• Contractual & Financial Data: Subscription tier selections, active contract type (Pay Per Lead [PPL] or Exclusive Regional Partner Contract [RPP]), lead quota tracking, and transaction history. Payment details are securely processed directly via Stripe and are never stored on our local servers.

3. How We Use Your Personal Data and Our Legal Basis

We will only use your personal data when the law allows us to. Most commonly, we rely on the following legal bases:

4. How We Secure and Track Consent

We prioritise digital safety and data integrity across our entire infrastructure.

• Granular Marketing Choice: Marketing consent is completely unbundled from our operational terms. Providers can explicitly opt-in during setup, and can alter, update, or entirely withdraw their consent at any time instantly via their My Profile dashboard subpage.
• Data Timestamps: All marketing consent status changes are automatically timestamped and logged securely in our database to ensure continuous compliance audits.
• Review Link Security: Customer review invitations utilise non-sequential, encrypted cryptographic strings (UUID tokens) rather than guessable database IDs. These links are strictly time-bound and automatically expire exactly three (3) days after issuance to prevent bot manipulation, spam infiltration, or data spoofing.
• Anti-Spam Controls: Publicly accessible forms are actively secured utilising silent background honeypot containers and Google reCAPTCHA v3 risk-scoring mechanisms to detect and block automated scrapers without disrupting the user experience.

5. Data Sharing and Third-Party Processors

We do not sell your personal data. To provide our services, we share necessary data streams with trusted, fully compliant third-party infrastructure providers:

• Between Customers & Providers: When a Customer submits a lead generation inquiry, their contact details and tuition requirements are routed directly to the designated local Provider to fulfil the service booking.
• Financial Processing: All subscription and lead package payments are securely passed to and processed by Stripe.
• Email Systems: Platform notifications, system confirmations, and review invitations are delivered reliably via Brevo (SMTP). Marketing communications are processed exclusively via MailerLite for users who have provided explicit consent.

6. International Data Transfers

Where third-party tools process data outside the UK or the European Economic Area (EEA), we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses or UK International Data Transfer Agreements) to guarantee your data receives an equivalent level of protection.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Unused or expired lead generation data is routinely cleaned.
• Active Provider profiles are kept for the duration of their active registry on the network.
• Time-bound review tokens automatically invalidate after 3 days.

8. Your Legal Rights

Under UK data protection laws, you have comprehensive rights regarding your personal data:

• The Right of Access: You can request a copy of the personal data we hold about you.
• The Right to Rectification: You can request that we correct any inaccurate or incomplete information.
• The Right to Erasure (“Right to be Forgotten”): You can request that we delete your personal data from our systems (where we do not have an overriding legal contract or necessity to keep it).
• The Right to Object/Withdraw Consent: You can turn off marketing preferences instantly inside your dashboard or click unsubscribe in any email.

To exercise any of these rights, please contact our admin team at: customer.service@drivinglessonskent.co.uk