The short version
We collect only what we need to teach you safely and run the business lawfully. We never sell your data. We don’t use advertising or tracking cookies. You can ask to see, correct or delete your data at any time, and we’ll act on it within one month.
1. Who we are
1.1 The data controller is Verulo Group Ltd, company number 16871996, registered office F20A Moulton Park Business Centre, Northampton, NN3 6AQ, trading as Instructor Daryl.
1.2 We are registered with the Information Commissioner’s Office, reference ZC089098. You can verify this on the ICO public register.
1.3 For any data question, contact daryl@instructordaryl.co.uk. We are not required to appoint a Data Protection Officer; data protection is handled by the Managing Director.
2. What we collect
| Category | Examples |
|---|---|
| Identity | Name, date of birth, driving licence number |
| Contact | Address, email, phone number, emergency contact |
| Booking | Session dates, times, locations, availability preferences |
| Tuition records | Progress notes, lesson plans, assessments, written summaries |
| Health & accessibility | Only what you tell us that affects safe driving or learning — see section 4 |
| Payment | Amount, date, reference, and confirmation of payment. We never see or hold your card number. |
| Consent records | The acknowledgment and confirmation you give at checkout, with date and time |
| Correspondence | Emails, messages and call notes |
| Incident records | Details of any collision, near miss or safety incident during a session |
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Delivering the tuition you booked | Contract |
| Arranging and confirming sessions | Contract |
| Checking licence and eligibility | Legal obligation / Contract |
| Keeping you and others safe during tuition | Legitimate interests — road safety |
| Taking and reconciling payment | Contract |
| Accounting, tax and company records | Legal obligation |
| Defending a payment dispute or legal claim | Legitimate interests — protecting the business |
| Insurance and incident reporting | Legal obligation / Legitimate interests |
| Improving how we teach | Legitimate interests — quality of instruction |
| Sending optional updates or newsletters | Consent |
3.1 Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and concluded it is not. You may object at any time — see section 13.
4. Health & special category data
4.1 We ask about medical conditions, medication, disabilities and additional needs only where they may affect your ability to drive safely or the way we should teach you.
4.2 Where this is special category data, we rely on your explicit consent (UK GDPR Article 9(2)(a)), or on Article 9(2)(c) where processing is necessary to protect someone’s vital interests.
4.3 You may withdraw consent at any time. Where the information is essential to teaching you safely, we may not be able to continue providing tuition — we will tell you plainly if that is the case.
4.4 This information is recorded briefly, kept apart from routine notes, and shared with nobody except where an emergency requires it.
5. In-car cameras
5.1 Tuition vehicles may be fitted with a forward-facing and/or in-cabin camera. Its purpose is safety, incident evidence and insurance.
5.2 You will be told before any session is recorded. Signage is displayed in the vehicle.
5.3 Footage is retained for 14 days and then overwritten automatically, unless it captures an incident, in which case it is retained until the matter is resolved.
5.4 Footage is not published, posted on social media, or used for marketing without your separate written consent.
5.5 You may request a copy of footage of yourself under section 13. Where footage shows other people, we may need to redact it.
5.6 Our lawful basis is legitimate interests — road safety, and protecting both parties in the event of a collision or dispute.
6. How long we keep it
| Record | Retention | Why |
|---|---|---|
| Enquiries that do not become bookings | 12 months | Follow-up |
| Tuition and progress records | 3 years after last session | Continuity, complaints |
| Health / accessibility notes | 3 years after last session | Safety, continuity |
| Booking, payment and consent records | 6 years plus current year | HMRC and Companies Act requirements |
| Camera footage — routine | 14 days | Overwritten automatically |
| Camera footage — incident | Until resolved, then 6 years | Insurance and legal claims |
| Incident and accident records | 6 years, or to age 21 if the learner was under 18 | Limitation periods |
| Marketing consent | Until withdrawn, reviewed every 2 years | Consent must stay current |
6.1 At the end of a retention period, records are securely deleted or destroyed.
7. Who we share it with
7.1 We share personal data only where necessary, and only with:
- Stripe Payments UK Ltd — payment processing;
- our email and scheduling providers, acting on our instructions;
- our accountant, for statutory accounts and tax;
- our insurer, where an incident or claim requires it;
- the DVSA, where required in connection with instructor registration or a test;
- the police, emergency services or a safeguarding authority, where the law requires it or someone is at risk;
- a parent or guardian, where the learner is under 18.
7.2 We do not sell personal data, and we do not share it with advertisers or data brokers.
7.3 Every processor acting on our behalf is bound by a written agreement requiring appropriate security.
8. International transfers
8.1 We keep data in the UK or European Economic Area wherever possible.
8.2 Some providers, including Stripe, may process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or by the International Data Transfer Agreement or Addendum.
8.3 You may ask us for detail of the safeguards applied to any specific transfer.
9. Cookies & the website
9.1 This website does not set advertising, analytics or tracking cookies. There is no third-party tracking on these pages.
9.2 Our hosting provider records standard server logs, including IP address and page requested, for security and reliability. These are retained briefly and not used to profile visitors.
9.3 When you click through to pay, you enter a page hosted by Stripe. Stripe sets its own cookies and applies its own privacy notice, which we do not control.
9.4 Some pages embed content from third parties such as video platforms or social networks. Those providers may set cookies when the embedded content loads. We use privacy-enhanced embeds where the provider offers them.
9.5 If we introduce analytics in future, we will publish a cookie notice and ask for consent first.
10. Marketing
10.1 We send marketing only where you have opted in, or where you are an existing customer and the message concerns a similar service.
10.2 Every marketing message includes a one-click unsubscribe. Withdrawing consent is as easy as giving it.
10.3 Unsubscribing from marketing does not stop essential messages about a session you have booked.
11. Under-18s
11.1 Many of our learners are 17. Bookings for anyone under 18 are made by a parent or guardian, who provides and consents to the data we hold.
11.2 We hold a parent or guardian contact for every learner under 18 and will share reasonable session information with them.
11.3 We do not send marketing to anyone under 18.
11.4 Where a safeguarding concern arises, we will share information with the appropriate authority. Safeguarding takes precedence over confidentiality.
12. Keeping data secure
12.1 Devices holding personal data are encrypted, password-protected, and kept up to date.
12.2 Accounts holding personal data use multi-factor authentication where available.
12.3 Paper records are kept securely and destroyed confidentially.
12.4 Access is limited to those who need it to do their job.
12.5 In the event of a personal data breach likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you directly where the risk is high.
13. Your rights
Under UK GDPR you have the right to:
- be informed about how your data is used — this policy;
- access a copy of your data;
- rectify data that is inaccurate or incomplete;
- erase data, where we have no overriding reason to keep it;
- restrict how we use it while a concern is resolved;
- data portability — receive your data in a reusable format;
- object to processing based on legitimate interests, and to marketing at any time;
- withdraw consent where consent is our basis.
13.1 To exercise any right, email daryl@instructordaryl.co.uk. We may ask you to confirm your identity.
13.2 We respond within one month, free of charge. Complex requests may take up to two further months; we will tell you within the first month if that applies.
13.3 Some records — payment and accounting data in particular — must be retained for legal reasons even after an erasure request. We will explain what we have kept and why.
14. Complaints & the ICO
14.1 Please raise any concern with us first at daryl@instructordaryl.co.uk. We take it seriously and would rather put it right.
14.2 You may also complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
14.3 Complaining to us first is not a precondition of going to the ICO.
15. Changes to this policy
15.1 We review this policy at least annually and whenever our processing changes materially.
15.2 The version in force is shown at the top of this page. Where a change materially affects how we use your data, we will tell you directly.
Version 1.0 — published 31 July 2026. Next scheduled review: July 2027.