I. Definitions and Interpretation

• Client: any individual, firm or corporate body to which we provide our services.
• Cookie: a small text file placed on your computer or device by the Site.
• Consumer: the term used under US state privacy laws for an individual whose personal data we process.
• Data Protection Laws: the UK GDPR, the Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and applicable US state consumer privacy laws (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and equivalent laws in other US states).
• Data Subject: the UK/EU GDPR term for an individual whose personal data we process.
• Personal Data: any information relating to an identified or identifiable individual.
• Sale / Share: under US state law, disclosing personal data to a third party for money or other valuable consideration, or for cross-context behavioural advertising. We explain in Section VII whether we do this.
• We / Us / Our: New Driver Programme Ltd, trading as RouteBuddy.

II. Who This Notice Covers and Which Law Applies

This notice applies to anyone who becomes a Client, enquires about our services, or visits the Site, regardless of location. The specific rights available to you depend on where you are based:

• United Kingdom: UK GDPR and the Data Protection Act 2018.
• European Union / EEA (including Ireland): the EU GDPR.
• United States: applicable state consumer privacy laws, for example the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, and similar laws where enacted.

If you are unsure which section applies to you, contact us using the details in Section XV and we will confirm.

III. Your Rights Under UK GDPR and EU GDPR

If you are located in the UK or the EU/EEA, you have the following rights as a data subject:

• The right to be informed about our collection and use of your personal data.
• The right of access to the personal data we hold about you.
• The right to rectification if any personal data we hold about you is inaccurate or incomplete.
• The right to erasure (the “right to be forgotten”) in certain circumstances.
• The right to restrict processing of your data in certain circumstances.
• The right to data portability.
• The right to object to us processing your data, including for direct marketing.
• Rights relating to automated decision-making and profiling.
• The right to withdraw consent at any time, where processing is based on consent.
• The right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in Ireland it is the Data Protection Commission (dataprotection.ie); other EU/EEA residents should contact their own member state authority.

IV. Your Rights if You Are a US Resident

If you are a resident of a US state with a consumer privacy law in force (currently including California, Virginia, Colorado, Connecticut, Utah and a growing number of other states), you have rights that may include:

• The right to know what personal data we have collected about you and why.
• The right to access the specific pieces of personal data we hold about you.
• The right to request deletion of your personal data, subject to legal exceptions.
• The right to correct inaccurate personal data.
• The right to opt out of the sale or sharing of your personal data, and out of targeted advertising.
• The right to limit the use of sensitive personal data.
• The right not to be discriminated against for exercising any of these rights.

We currently do not sell personal data for money. Where we work with advertising or analytics partners in a way that may count as “sharing” under the CCPA/CPRA, we describe this in Section VII, and you can opt out using the details in Section XV.

California residents may designate an authorised agent to exercise these rights on their behalf, subject to us verifying the request.

V. What Data Do We Collect, and How Do We Use It?

We may collect, use, store and transfer the following categories of personal data:

• Identity Data: name, username, date of birth.
• Contact Data: address, email address, telephone number.
• Financial Data: bank account and payment card details, processed via our payment providers.
• Transaction Data: details of purchases and payments made through the Site.
• Technical Data: IP address, browser type and version, time zone, device identifiers, operating system.
• Profile Data: your interests, preferences and driving lesson or test history.
• Usage Data: how you use the Site and our services.
• Marketing and Communications Data: your preferences in receiving marketing from us and third parties, and your communication preferences.

We use this data for purposes including providing our services, processing payments, managing your account, complying with legal obligations, improving the Site, and (where you have consented, or as otherwise permitted by law) marketing.

Lawful basis for processing (UK GDPR / EU GDPR)

Where UK GDPR or EU GDPR applies, we only process personal data where we have a lawful basis, which will typically be one of the following:

• Performance of a contract with you, for example to deliver a driving lesson package you have purchased.
• Compliance with a legal obligation, for example tax and accounting records.
• Legitimate interests, for example fraud prevention and improving our services, provided this does not override your rights.
• Consent, for example for marketing emails, which you may withdraw at any time.

VI. How and Where Do We Store Your Data?

We only retain personal data for as long as necessary for the purposes it was collected, or as required by law. Our primary servers and infrastructure are located in the United Kingdom. As we expand to serve US customers, some data may also be processed or stored by service providers in the United States.

VII. Do We Share or Sell Your Data?

We may share personal data with third parties who provide services on our behalf, such as payment processors, IT and hosting providers, analytics providers, and, where relevant, marketing platforms. Any third party we share data with is required to keep it secure and to use it only for the purposes we specify.

We do not sell personal data to third parties for money. We may use analytics or advertising tools that some US state laws classify as “sharing” for cross-context behavioural advertising. If so, US residents can opt out via the mechanism described in Section XV.

We may also disclose personal data where required by law, to protect our legal rights, or in connection with a business transfer as described in Section VIII.

VIII. International Data Transfers

Because we operate across the UK, the EU and the US, personal data may be transferred between these regions. Where personal data originating in the UK or EU/EEA is transferred to the United States or another country without an adequacy decision, we put in place appropriate safeguards, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, and, where applicable, reliance on the EU-U.S. Data Privacy Framework and the UK extension to it for transfers to certified US organisations.

IX. What Happens If Our Business Changes Hands?

If we sell, merge, or otherwise transfer all or part of our business, personal data held about you may be transferred to the new owner, who will be required to use it only for the purposes set out in this notice, or to notify you of any change.

X. Children's Privacy

Our services are intended for individuals aged 17 and over who are learning to drive, or their parents or guardians acting on their behalf. We do not knowingly collect personal data from children under 13 in the United States or under 13 in the UK/EU without appropriate parental consent, in line with the Children's Online Privacy Protection Act (COPPA) and UK/EU requirements. If you believe a child has provided us with personal data without appropriate consent, contact us and we will delete it.

XI. Cookies

We use cookies and similar technologies to operate the Site, remember your preferences, and, where you consent, for analytics and advertising. You can control cookies through your browser settings and, where required by law, through a cookie consent tool on the Site. US residents can use cookie controls to opt out of targeted advertising as described in Section IV.

XII. How Can You Control Your Data?

You can ask us to stop sending marketing communications at any time, by using the unsubscribe link in emails or contacting us directly. Restricting some data may limit our ability to provide certain services to you.

XIII. Your Right to Withhold Information

You can access certain areas of the Site without providing personal data. However, some services, such as booking lessons or making payments, require certain personal data to be provided.

XIV. How Can You Access Your Data?

You have the right to request a copy of the personal data we hold about you. We will normally respond within one month for UK/EU requests, and within the timeframe required by applicable law for US requests (generally 45 days, extendable once by a further 45 days).

XV. Exercising Your Rights and Contacting Us

To exercise any of the rights described in this notice, or if you have any questions, contact us at:

• Post: New Driver Programme Ltd, 3 Weekley Wood Close, Kettering, Northamptonshire, NN14 1UQ, United Kingdom.
• Email: [insert privacy contact email]

We will need to verify your identity before responding to a request. If you are not satisfied with our response, UK residents may contact the Information Commissioner's Office, and EU/EEA residents may contact their local supervisory authority, such as the Irish Data Protection Commission.

XVI. Changes to This Notice

We may update this notice from time to time, for example to reflect changes in the law or in our services as we expand into new markets. We will post the updated notice on the Site with a revised “Last updated” date.