CO Driver Training Privacy Notice

How CO Driver Training uses personal information

Your privacy at a glance
I use only the personal information I reasonably need to deal with enquiries, bookings, payments, driving lessons, practical-test arrangements, safety and legal duties. Optional recording, lesson observation and marketing require a separate choice. This notice explains what I collect, why I use it, who may see it, how long I keep it and what rights you have.

1 Who this notice covers

This notice applies to learners, people asking about lessons, people who book or pay for lessons, parents or guardians where relevant, and anyone who contacts CO Driver Training. It covers information given by phone, text, messaging apps, email, social media, booking systems, on paper or during lessons. This includes website enquiry forms. I make this notice available when collecting your information. Receiving this notice or accepting the tuition Terms does not itself give consent for optional uses.

Csaba Ortutay trading as CO Driver Training is the data controller. In simple terms, that means I decide why and how your personal information is used. You can contact me using the details at the front of this notice.

2 Personal information I may collect

Identity and contact details. Your name, address or postcode, telephone number, email address and, where needed, date of birth, emergency contact details and the details of a person paying for lessons or acting as a guardian.

Driving information. Driving licence and entitlement details, restrictions, eyesight information and anything else reasonably needed to check that a lesson or practical test can legally go ahead.

Bookings and payments. Lesson dates and times, agreed meeting points, duration and hours delivered, attendance, cancellations, prices, payments, refunds and receipts. For a practical test, I may also keep the test date, time and centre, whether I am available, any later change or cancellation, the agreed test-day fee and information needed for a receipt or DVSA expense claim. I may also record student-discount eligibility, the date evidence was checked, previous promotional claims, prepaid balances and any separate request to start lessons during a statutory cancellation period. I normally record the outcome of a student-status check rather than keep a copy of your student ID.

Tuition and progress. Learning goals, lesson plans, progress notes, driving strengths and risks, the level of support agreed, test details and results, feedback, incidents and relevant messages.

Health and accessibility information. Only information about health, disability, medication, injury, fatigue or adjustments that I reasonably need to provide safe and lawful tuition.

Images, audio and video. Pass photographs, testimonials and, where separately explained and agreed, selected in-car, road-facing or audio recordings.

Lesson observation and instructor training. Where a learner agrees to an observer, I may keep the observer's name and role, the reason for the observation, the date, the learner's choice and limited confidential notes where needed.

Messages and complaints. Messages, emails, call notes, enquiries, complaints, privacy requests and records showing what optional permissions were given or withdrawn.

3 Why I use information and the lawful bases

Enquiries, bookings and tuition. I use your information to answer enquiries, arrange and provide lessons, record practical-test details, confirm whether I am available for a test, communicate about any changes and carry out the service you have booked. The main legal basis is the contract with you, or steps you ask me to take before a contract is made. You book and manage your own car driving test; recording your test details does not authorise me to access or operate your DVSA booking account.

Progress and safety records. I keep reasonable notes so I can plan tuition, track progress, manage risk and decide whether my vehicle can safely be used for a practical test. I rely on the contract and my legitimate interest in providing safe, effective and accountable tuition.

Payments and business records. The contract basis covers taking payment, receipts, prepaid balances and refunds. Legal obligation covers financial information needed for tax and accounting duties. My legitimate interest in applying offers fairly and preventing repeated claims covers proportionate student-eligibility and promotional-claim records.

Health and disability information. I use only the information needed to assess fitness for tuition, manage driving risks and arrange reasonable adjustments. The usual general lawful basis is performance of the tuition contract, together with your separate explicit consent as the additional condition for health data. I explain what information is needed and why, and record that consent. You can withdraw consent using the contact details above. I will discuss whether tuition can safely continue without that information or with less information; refusal does not automatically end tuition. If I need health data for a legal claim, I may instead rely on legitimate interests and the legal-claims condition. In a life-threatening emergency where you cannot consent, vital interests may apply. These exceptions do not replace consent for routine tuition.

Optional lesson recordings. I rely on consent for agreed recordings used for your feedback, my professional review or review by a named trainer. I explain the purpose, who can see the recording and how long it will be kept, and record your separate choice. Saying no will not affect ordinary tuition.

Live lesson observation. I rely on your consent for an optional PDI, ADI, trainer or assessor to observe your lesson and for any agreed identifiable training notes. I explain who will attend and the purpose before asking for your agreement. Saying no will not affect ordinary tuition. Any compulsory regulatory inspection is explained separately and is not presented as an optional observer arrangement.

Road-safety or incident footage. If I use a road-facing dashcam for safety, security or incident evidence, the usual basis is my legitimate interest in protecting people and property and establishing what happened. Legal obligation applies where disclosure is legally required. I assess whether recording is necessary and proportionate, restrict access and provide camera information before use. Any health or offence information requires an additional applicable legal condition.

Photos, testimonials and marketing. I rely on separate, voluntary, explicit written consent before publishing or otherwise using identifiable pass photos, testimonials, lesson clips or pupil information for marketing. This includes a clear email, message or electronic consent record stating the content, purpose and intended channels. Consent to take a photo or make a private recording does not itself permit publication. I obtain separate consent for promotional emails or messages and provide a simple way to opt out. Ordinary booking and lesson messages are service communications. You can withdraw consent at any time using the contact details above.

Complaints, safeguarding and regulatory matters. I keep necessary complaint and outcome records and may share relevant information with insurers, legal advisers, police, courts, DVSA, DVLA, emergency services or safeguarding authorities. A specific legal duty is the basis where disclosure is compulsory. Otherwise, the basis may be my legitimate interest in resolving complaints, defending claims, cooperating with lawful investigations or protecting pupils; vital interests may apply in an emergency. I check the basis for each disclosure and share only what is needed. Health data and criminal-offence information require an additional applicable legal condition and safeguards. I do not treat a regulator request or the DVSA Code alone as automatic authority to share everything. I explain a disclosure where lawful and appropriate, unless doing so could put someone at risk or prejudice an investigation.

I do not use your personal information to make fully automated decisions that have a legal or similarly serious effect on you.

4 Information needed to provide the service and optional choices

Information I need to provide the service. I may need basic contact details, driving-entitlement information, booking and payment details, practical-test details and enough safety or accessibility information to decide whether a lesson or test-day booking can legally and safely go ahead. If important information is not provided, I may be unable to accept or continue the booking. I will not ask for more than I reasonably need.

Optional choices. Marketing permission, pass photos, testimonials, optional lesson recording and agreement to a live observer are not conditions of ordinary tuition. You can refuse or later withdraw these choices without losing ordinary driving lessons. Withdrawing permission does not make earlier lawful use unlawful. To withdraw a choice, tell me verbally or use the phone, email or messaging channel you used to give it. I will record your request and stop future use based on that consent. I may retain a minimal permission or withdrawal record where needed to show what happened, under legitimate interests.

5 In-car video and audio recording

Optional instructional recording. Lessons are not automatically recorded for teaching purposes. Before recording an agreed lesson, I will explain why it is being recorded and obtain the relevant choices using the In-Car Recording Consent Form or an equivalent clear electronic confirmation. A named trainer may see a recording only within the agreed permission; recording consent is separate from publication consent.

Audio. Audio is off by default. It will be used only for a specifically agreed purpose where it is necessary and proportionate, and a separate audio choice will be required.

Being clear when recording happens. A visible notice will be displayed in the vehicle where appropriate, and I will remind the learner before any optional instructional recording starts. The camera will not be used for private journeys.

Road-facing dashcam use. Safety or incident recording is separate from optional instructional recording. Before business use, I explain the camera coverage, purpose, access arrangements and retention. I will not repurpose it for learner review, instructor training or marketing without the separate consent required for that use. I will not circulate or publish identifiable footage without the required consent, except for necessary lawful disclosure to an insurer, legal adviser, regulator, safeguarding body or law-enforcement authority.

Other road users. A road-facing camera may incidentally capture people, vehicles or number plates. Access and sharing will be limited, and I will crop, blur or otherwise protect third parties where reasonably necessary before footage is shared.

Live observers. I identify an optional observer and obtain your agreement before the lesson. The observer must keep learner information confidential. Only limited notes explained and agreed beforehand may identify you; otherwise training notes should be anonymised. Observers must not make their own audio or video recordings or copy, publish or reuse your information outside the agreed purpose.

Practical driving tests. Any camera operating during a practical test will be for insurance purposes, film only outside the vehicle and record no audio from inside. It must not obstruct anyone’s view. Interior and audio recording will be switched off before the test. Lesson-recording consent does not override these rules. I will not publish test footage without the pupil’s and DVSA’s permission where required, and will not upload material that identifies an examiner by image, voice or full name. DVSA does not accept recordings as a way to challenge a test result.

6 Where information comes from and who may receive it

Most information comes directly from you. I may also receive relevant information from a person paying for lessons, a parent or guardian, someone who referred you, DVLA entitlement-check services, DVSA, an insurer, the police or another person involved in an incident.

I share personal information only where reasonably necessary. This may include banks or payment services; booking, communication, IT or cloud services I use to run the business; accountants, insurers or legal advisers; DVSA, DVLA, police, courts or regulators; and a specifically agreed PDI, ADI, trainer, assessor or lesson observer. I do not sell personal information. Paying for lessons or being named as an emergency contact does not automatically give someone access to your progress, health information or recordings. I obtain your permission unless another lawful basis justifies the disclosure. Public marketing channels can be viewed and reshared by other people; I explain this before seeking publication consent.

7 Third-party services and data location

I use service providers for website enquiries, booking administration, email and messaging, payments, storage and business records. Providers processing information for me must have appropriate contractual and security protections. Some services may involve processing outside the UK. Where I arrange a restricted international transfer, I must establish a lawful transfer mechanism, such as applicable UK adequacy arrangements or approved contractual safeguards with any required risk assessment. Provider-specific information about relevant destinations, the mechanism used and how to obtain a copy of safeguards will be supplied with the privacy information for the service concerned. You can also request it using the contact details above. A provider’s own privacy notice explains uses for which it acts as a separate controller.

8 How long I keep information

Enquiries that do not become bookings. Normally kept for 12 months after the last meaningful contact.

Booking, lesson and progress records. Normally kept for five years after the last lesson or the end of the tuition relationship, unless there is a good reason to keep them for a shorter or longer period, such as an active complaint or legal claim. I review records and retain only the information still needed; this period does not mean all health details or recordings are kept for five years.

Financial and tax records. Kept for as long as tax and accounting rules require.

Health and adjustment information. Reviewed when tuition ends and normally deleted or anonymised within 12 months unless it is still needed for an ongoing service, complaint, incident or legal claim.

Unselected camera footage. Normally deleted within 14 days if there has been no incident and there is no agreed reason to keep it.

Selected private lesson-review clips. Normally deleted within 90 days unless a different period is clearly agreed for a specific training or assessment purpose.

Observer or instructor-training notes that identify the learner. Normally deleted or anonymised within 90 days unless they are needed for a defined assessment, complaint or legal claim.

Incident or legal-claim footage. Kept only for as long as reasonably needed to investigate and resolve the matter and meet any relevant legal or insurance time limit.

Published marketing content. I review consent and continued use at least every 24 months. If consent is withdrawn, I stop new use and remove content from channels I control without undue delay where required. I take reasonable steps concerning recipients or copies where the law requires it, but cannot guarantee removal of every independent third-party copy.

Complaints and privacy requests. Normally kept for five years after the matter is closed where this is reasonably needed to show how it was handled. Student-eligibility and promotional-claim records follow the five-year booking-record period, with only the minimum information retained. Consent and withdrawal records are kept while needed to demonstrate the relevant use or honour an opt-out, then deleted or reduced to the minimum necessary. Records subject to an active dispute or investigation are reviewed and securely deleted or anonymised once the reason for keeping them ends.

9 Security

I use reasonable security measures such as controlled access, strong passwords, secure devices and storage, software updates, backups where appropriate and limited sharing. Recordings will not be left openly accessible. If a personal-data breach must legally be reported, I will notify the ICO and affected people as required.

10 Your data-protection rights

Depending on the circumstances, you may have the right to ask for a copy of your information, correct it, have it deleted, restrict how it is used, or receive information you supplied in a portable form. If I rely on your consent, you can withdraw that consent at any time. Some rights have legal limits and do not apply in every situation.

Your right to object. If I use your information because of a legitimate interest, you can object. I must then consider whether there is a strong lawful reason to continue. If your information is used for direct marketing, you can object at any time and I will stop using it for that purpose.

I may ask for reasonable proof of identity before releasing personal information. I will respond to valid privacy requests without undue delay and within the legal time limit that applies, normally one month.

11 Questions and complaints

Questions or complaints to me. Contact me by phone, email, message or post using the details above. No special wording or form is required. I aim to acknowledge a complaint within five working days and will acknowledge a data-protection complaint no later than 30 days after receipt. I will make appropriate enquiries, investigate without undue delay, keep you informed and explain the outcome and any action taken. I aim to provide a substantive response within 14 working days; if more time is needed, I will explain why and give an updated timescale.

Complaint to the regulator. You can also complain to the UK data-protection regulator, the ICO, at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

12 Changes to this notice

I review this notice when the way I collect, use, store or share personal information changes. I will explain material changes to affected people and provide any new purpose or service-specific privacy information before the new use begins. Where a new use needs consent, I will ask separately. The effective date appears at the front.