GDPR and data protection
Security and data protection
Built for the rules you already have to follow
Driving schools hold identity documents, dates of birth and guardian contacts, often for minors. DrivePlan gives you the tools to handle that properly, and tells you plainly where our responsibility ends and yours begins.
Who is responsible for what
You are the controller. We are your processor.
Under the GDPR, the school that decides what to record about its learners is the controller. That is you. DrivePlan processes that data on your instructions, under a data processing agreement, which means we cannot decide to use your learners’ data for our own purposes, and we do not.
This matters when someone asks to see or delete their data: the request is yours to answer, within one month. Every tool below exists so that you can.
- Your call
- What you collect and why, how long you keep it beyond the legal minimum, who on your team sees it, and answering your learners’ requests.
- Ours
- Keeping the data secure, enforcing the access rules and retention periods, giving you working export and erasure, and telling you within 24 hours if anything goes wrong.
Learner rights
One-click data export
Art. 15 · 20
A learner asks for their file. One button produces a machine-readable export: their record, lessons, invoices, payments, exams, support messages and every document you uploaded.
Erasure built in
Art. 17
Replaces the learner's name on their lessons, invoices, payments, orders and exams, deletes their uploaded documents and closes their sign-in account. Invoices survive, because accounting law requires them, but no longer carry the learner's name.
Retention on a timer
Art. 5(1)(e)
Financial records kept for ten years by default, learner files erased automatically after three years of inactivity, audit trail after one. A school can lengthen any period its local rules require. Enforced by scheduled jobs, not by remembering.
Security
Nobody sees more than they should
Art. 32
An administrator sees their own school. An instructor sees the learners assigned to them. A learner sees only their own record. Enforced by the database itself, not just hidden in the interface.
Append-only audit trail
Art. 5(2)
Every change to a learner record is logged against the person who made it, and cannot be edited or deleted afterwards, including by us.
AI and tracking
AI that is off until you turn it on
Connect an AI assistant only if you want one. Even then, identity documents, dates of birth, home addresses, guardian contacts and uploaded files are never sent to it.
No advertising, no tracking pixels
We do not sell data, run ads or embed third-party trackers. Our own website loads analytics only after you agree, and nothing at all if you decline.
Read it for yourself
Everything is public: what we hold and why, every third party that touches it, and where each one processes data. A data processing agreement is available on request while we finalise the published version.
Straight answer: no software can make a driving school GDPR compliant, and anyone claiming otherwise is selling you something. Compliance depends on how you actually run your school. What we can do is make the technical part correct and give you the tools to handle the rest.