Privacy policy

Who we are

Passdesk is a software platform used by independent driving schools (each, a "school") to manage their learners, instructors, lessons, purchases, and progress records. Each school is the "data controller" for data it collects; Passdesk Ltd is the "data processor" operating the service on their behalf. Passdesk Ltd is a controller in its own right for what it does for its own purposes, such as solo learner accounts, security and audit records, and making anonymised statistics.

Passdesk Ltd is registered in England & Wales, company number 17193377, with registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. It is registered with the UK Information Commissioner's Office under registration number ZC142229. For data-protection questions email privacy@passdesk.co.uk.

This policy describes what personal data we hold, why we hold it, the lawful basis under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and the rights you have over it. Where a school or a learner is established in the EU or the EEA, the EU GDPR (Regulation (EU) 2016/679) applies to the same processing, and the rights and duties described here read across to it.

Data we collect

Account data — your name, email, phone number, address, password hash, role and the school you belong to. Supplied by you on signup or by a school administrator when they invite you.

Learner profile — date of birth, provisional licence number, theory and practical test dates, medical self-declarations, and emergency contact or guardian details where you are under 18. Used to schedule lessons, comply with DVSA rules, and run safeguarding procedures. The optional medical information is “special category” health data: we store it only with your explicit consent, encrypt it at rest, and share it only with your instructor(s) so they can keep you safe during lessons.

Instructor compliance — ADI / PDI badge number, badge expiry, DBS check date and certificate number, insurance policy number and expiry. Stored to prove DVSA compliance during inspections.

Lessons, progress and purchases — when lessons were booked and completed, ratings and notes on competencies, products you bought, amounts paid, and the status of each purchase.

Instructors' voice memos — an instructor can record a short voice memo about a lesson. It's saved with the lesson, and the learner can play it from their Progress page. If the school switches on transcription, Google Cloud turns the memo into text in its EU region and keeps no copy of the recording. The text is saved with the memo, is visible only to people who can already play it, and is deleted when the memo is. It's used to suggest skill marks for the instructor to check, and, where the school has lesson summaries on, Anthropic's AI model reads it to write the learner's summary and a short note for the instructor who teaches the next lesson.

Parents and supervising drivers — a learner or their school can link a parent, guardian or supervising driver to the learner's account. Once the link is active, that person can sign in and see the learner's lessons, progress and practice, and record the practice drives they supervise. We hold their name, contact details and the drives they log. They see only the learners they're linked to, and the learner or the school can remove the link at any time.

Practice routes — if you use the optional practice-routes feature, recording captures a GPS trail of the drive on your own device; nothing reaches our servers until you choose to save the route. Recording only runs when you start it, a visible banner shows while it's active, and you can stop it at any time. Saved routes are stored encrypted, are visible only to you unless you choose to share them with your school, and you can delete them whenever you like.

Where moments in a lesson happened — during a lesson, an instructor can tap a thumbs up or down to note a good moment or something to work on. If the instructor has allowed location on their phone or in their browser, each tap also saves where the car was at that moment, rounded to about 10 metres, so they can see the moments on a map when they write up the lesson. Location is only read when a thumb is tapped: nothing is recorded in between, and never in the background. This is separate from practice routes: it's a single point at each tap, sent when the thumb is tapped, not a recording of the drive. No place is saved for an under-18 learner until a parent or guardian has given consent, or for a learner whose date of birth we don't have. The places are part of the lesson record: staff at the school can see them, they don't show in the learner's own account, and they're included if the learner or the instructor asks for a copy of their data. They're removed once the learner passes their test, leaves the school or the school closes its account, and six months after the lesson at the latest, or sooner if the learner's or the instructor's account is erased. The thumbs themselves stay with the lesson.

Invited instructors who aren’t yet users — when a learner invites their driving instructor to join them on Passdesk, and that instructor doesn’t already have an account, we keep their email address so we can tell them about Passdesk. We say so in the invitation email, and you can reply to it to be removed. We hold nothing else about you, we never buy or sell these addresses, and the record is deleted when the invitation is withdrawn or lapses — and in any case within 90 days — unless you go on to open an account.

Questions you ask the help assistant — if you use the Help button in the app, we keep the questions you type and the answers you were shown for 90 days, so we can see which questions our guides don't answer yet. Each question goes to Anthropic's AI model to find the answer in our guides, with any card number removed first. Your name, email address and phone number aren't sent with it.

Questions your school asks Passdesk — if your driving school switches on Ask Passdesk, its owners and staff can ask about the school's records or set up a booking, move or cancellation for them to confirm. To answer, the records a question needs go to Anthropic's AI model: that can include learners' names, lesson dates and times, amounts paid and owed, and notes the school's team or learners wrote. Phone numbers, email and home addresses, dates of birth, licence numbers, guardian details and health notes are never sent. Staff only get answers from records they can already see in Passdesk, and the chats are kept for 30 days. If someone uses the microphone, their own browser or phone turns the speech into text (Google in Chrome and Edge, Apple in Safari and on iPhone); Passdesk never receives the recording.

Files your school imports — when a school brings its records in from a spreadsheet, Passdesk can ask Anthropic's AI model which of its columns holds what. It sends the column names of the file, never its rows: the few sample values that go with them have every letter and digit swapped out first, so no name, email address, phone number or date can be read from them. For lesson statuses, test results, skill levels and ratings it also sends each short label the file uses there, such as “DNA” or “P”, once and on its own, so it can say what the label means. For products, skills and progress areas it sends the names the file uses that don't match the school's own, such as “10hr block”, with the school's list of product or skill names to match them to.

Technical data — the JWT session cookie / token issued when you sign in, the IP address your request comes from, and the user-agent of your browser. We do not keep our own application-level access log of your IP address; it appears only in our hosting provider's infrastructure request logs, covered under “How long we keep it” below. Where you give a specific consent — for example a parent or guardian confirming an under-18 account, or agreeing to store health information — we separately record the IP address at that moment as evidence of the consent and keep it with your account. No analytics or advertising cookies are used; the usage counts described under How we improve Passdesk work without them.

Why we use it

To operate the service you or your school asked us to provide — book and run driving lessons, record progress, process purchases, and keep the inspectors' paperwork up to date. The lawful basis is contract for anything necessary to deliver the service, legal obligation for records we must keep (tax, DVSA, DBS), and legitimate interests for security logging, fraud prevention, counting how Passdesk is used so we can improve it, and turning records into anonymised statistics. For the optional health information in your learner profile — a “special category” of data — our additional condition for processing is your explicit consent (UK GDPR Article 9(2)(a)), which you give when you save it and can withdraw at any time by removing it.

We never sell your data or share it with advertisers.

Who we share it with

Within Passdesk, data is only visible to staff at your school, to a parent or supervising driver linked to a learner (for that learner only), and to Passdesk Ltd support acting on the school's instructions. To run the service we use a small set of vetted sub-processors — for database and application hosting, our CDN and file storage, card payments, Direct Debits where a school collects them through its own GoCardless account, transactional email, SMS, push notifications to our mobile app, error monitoring, usage counts, maps, calendar sync, address lookup, business verification, the AI model behind product import and import column matching, the in-app help assistant, Ask Passdesk where a school switches it on, optional lesson summaries and the note your next instructor sees, turning instructors' voice memos into text where a school switches it on, and a rate-limit cache — each bound by a data-processing agreement and receiving only the data its function needs. The current list is published on our security page. We also disclose data to regulators or law enforcement where we are legally required to do so.

How we keep your data safe

Encrypted on the move. Everything sent between your browser or our app and Passdesk goes over HTTPS (TLS 1.2 or later), and our sites tell browsers never to connect any other way. Our servers use encrypted connections to reach our database and the services we rely on, Google included.

Encrypted when stored. Our database, uploaded files and backups are encrypted at rest by the providers that hold them. On top of that, Passdesk encrypts the most sensitive details itself, with AES-256-GCM, before they're saved: health notes, licence numbers and guardian details on learner records, instructors' DBS and insurance numbers, two-step sign-in secrets, saved practice routes, test booking references, and the access tokens and event titles from a connected Google or Outlook calendar. The key that unlocks them is kept in Google Cloud Secret Manager, apart from the database, so a copy of the database on its own can't be read. Passwords are never stored, only bcrypt hashes of them.

Only the right people can see it. Every school's records are kept apart: each request is checked against the school the person is signed in to, so one school can never see another's. Within a school, what someone sees depends on their role and the permissions the owner gives them. Passdesk support can only look at a school's records with a permission for it, to help that school, and each time support signs in as someone at a school it's recorded in our audit log. Access to our production systems is limited to Passdesk Ltd and the hosting providers listed on our security page.

Safe sign-in. Sign-in attempts are limited and screened for bots, and you can add a second step with an authenticator app, or sign in with a passkey.

Backups. Database backups are encrypted and expire after 30 days at most, so anything we delete has left every backup within 30 days.

Calendar sync and Google user data

A school can choose to connect a Google Calendar or a Microsoft Outlook calendar, so lessons booked in Passdesk appear there automatically. Only the school's owner, or Passdesk support helping the school, can connect or disconnect a calendar. This section sets out what Passdesk does with the information it receives from Google, which Google calls Google user data. An Outlook calendar is stored and protected in the same way.

What we ask Google for

• Calendar events (calendar.events): to add an event for each lesson, change it when the lesson changes, and remove it when the lesson is cancelled. Each event shows the lesson's time, the learner's and instructor's names, the lesson type and the pickup place, where there is one. If the school also turns on Block double-bookings against external busy slots, we read the events in the next 14 days so Passdesk won't book a lesson over something already in the calendar.
• Email address (userinfo.email): read once, when the calendar is connected, so the settings page can show which Google account is linked.

What we keep

We store the connected account's email address, the access tokens Google issues, and the ID Google gives each lesson event we create, so we can update or remove it later. With busy-slot blocking on, we also keep the start time, end time and title of each event in the next 14 days. Nothing else about an event, such as who's invited, its description or attachments, is ever saved.

How we use it

Only to keep the lessons in the calendar up to date and to stop lessons being double-booked. We never use Google user data for advertising, never sell it, and never use it to build a profile of anyone.

We don't use Google user data to develop, improve or train AI or machine-learning models, ours or anyone else's, and calendar entries are never sent to an AI model. If your school uses Ask Passdesk to set up a booking, it's only told that the calendar is busy at that time, never what the entry is.

Passdesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't share Google user data with anyone else, apart from the providers that run our servers and database for us under contract, or where the law requires it.

How we protect it

• It only travels over encrypted connections (HTTPS, TLS 1.2 or later): between your browser and Passdesk, and between Passdesk and Google.
• The access tokens and event titles are encrypted with AES-256-GCM before they're saved, using a key kept in Google Cloud Secret Manager, apart from the database. The database they sit in is in a London region and is encrypted at rest as well.
• The tokens are never shown to anyone, the school included, are left out of every data export, and are masked in our audit log.
• The connected account's email address and the titles of busy times are visible only to the school's owner and Passdesk support. Other staff see an entry's title only when it's the reason a lesson can't go in, and learners and parents never see them.
• Nobody at Passdesk reads your calendar data unless you ask us to, for example to sort out a support request, or it's needed for security, or the law requires it.

How long we keep it, and deleting it

• We only hold busy times for the next 14 days, and each one is deleted once it has passed. They're all deleted straight away if the school turns busy-slot blocking off.
• Disconnecting the calendar in Passdesk removes the lesson events Passdesk added to it, deletes the tokens, event IDs and busy times we hold, and cancels Passdesk's access with Google. Microsoft doesn't let an app cancel its own access, so after disconnecting Outlook you can also remove Passdesk from your Microsoft account's app permissions.
• You can remove Passdesk's access from your Google Account at any time, at myaccount.google.com/permissions. Syncing stops, the busy times we hold are deleted, and the tokens stop working; we delete them when the school disconnects the calendar in Passdesk or its account is deleted.
• If the school's account is deleted, the connection and everything we hold from it goes with it.
• Deleted data has left our encrypted backups within 30 days. Our audit log keeps a record that a calendar was connected or disconnected, with the account's email address, for 2 years, for security.

International transfers

Your data is stored and primarily processed in the UK. Some of our sub-processors are based in the United States — for example our payment, email, SMS, push-notification, error-monitoring, maps and CDN providers. Where they process personal data outside the UK, those transfers are protected by appropriate UK GDPR safeguards: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. We transfer only the minimum data each provider needs, and never to a provider without such safeguards in place. Voice memos a school has transcribed are turned into text in Google's EU region, which UK adequacy regulations cover.

If you are in the EU or the EEA, sending your data to us is a transfer to the UK, which is a third country under the EU GDPR. It is covered by the European Commission's adequacy decision for the UK (Implementing Decision (EU) 2021/1772), which the Commission renewed on 19 December 2025 and which runs to 27 December 2031. If that decision ever lapses, we fall back on the Standard Contractual Clauses in Commission Decision (EU) 2021/914 — module two where we act as your processor, module three where a sub-processor is involved.

If you're in the EU or EEA

Passdesk is available to schools and learners across the EU and EEA. Your data is held in the same place as everyone else's — the UK, in a London region, under the transfer basis set out above. Nothing about where you are changes what we collect or how long we keep it.

You have the same rights under the EU GDPR that this policy describes: access, rectification, erasure, restriction, portability, and objection. Email privacy@passdesk.co.uk to exercise any of them.

You can also complain to the data-protection authority for the country you live or work in. In Ireland that is the Data Protection Commission; the European Data Protection Board lists every national authority. Where a school is your data controller, its own supervisory authority is named on that school's privacy page.

EU representative. Where Article 27 of the EU GDPR requires a representative in the Union, that appointment is being confirmed — email privacy@passdesk.co.uk in the meantime and we will handle your request directly.

Anonymised industry insights

Passdesk uses lesson and test records to make anonymised, aggregated statistics about learning to drive, such as how many lessons learners take before their test, and pass rates by region, test centre, car or gearbox. We publish some of them on our research pages, and may use them in blog posts and reports or share them with research partners and public bodies. We only ever share the anonymised figures, never records about people.

Who is responsible. Turning records into statistics is Passdesk's own purpose, so for that step Passdesk Ltd is the controller, including for records a school holds as controller. Schools allow this in our terms of service. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): producing useful figures for schools, learners and the driving industry that never identify anyone. We have weighed this against your interests in a written assessment, and the safeguards and opt-outs below are what make it fair. Once the figures are properly anonymised they are no longer personal data.

How we keep it anonymous. We follow the ICO's guidance on anonymisation and pseudonymisation, published in March 2025. The process that makes the statistics reads only what it counts: test results and dates, the car's make, model and gearbox, and the first part of a test centre's or school's postcode. It never reads names, contact details, licence numbers, dates of birth or health information. We only publish a figure that comes from at least 20 different learners at 3 or more schools, with no one school making up more than half of it, and we leave out a regional figure if comparing it with the national one would show a smaller group. We never try to work out who is behind a figure, and anyone we share figures with must not try either.

Leaving yourself out. Turn off Anonymised research on My account and your records stop going into the statistics within a week, as they're rebuilt. A school can leave all its records out by turning off the research setting on School info, or by emailing privacy@passdesk.co.uk. Figures already published in a report stay as they are, because they can't be traced back to you.

How we improve Passdesk

To see which parts of Passdesk get used and which don't, the web app and the phone app count the pages and screens people open and a few actions, such as opening Help or asking Ask Passdesk a question. We send these counts to PostHog, which stores them in the EU. Each one carries the page's address with record numbers and link codes taken out, whether you're on a phone or a computer, and your role (owner, staff, instructor, learner or parent).

For school owners and staff, the counts also carry an account number and the school's plan, so we can see how a school's team uses Passdesk over time. Learners, parents and solo learners are never given a number that lasts beyond the page they're on, so we can see what learners use without following any one person. We never send anything you type, your name, your email address or your location, we've told PostHog not to keep your IP address, and no cookies are set. Our lawful basis is legitimate interests: making Passdesk better for the schools and learners who use it.

You can switch this off under Privacy & data on your account page, and in the phone app with Share usage counts under Privacy on the More tab. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted at all. Passdesk support staff are never counted, including while they help with an account.

Our mobile app

The Passdesk app for iPhone and Android signs in to the same account as the website and works with the same data described above. It also sends us a few things of its own.

Push notifications — if you allow notifications, your phone gives the app a push token, and we save it with your phone's model and operating system so your notifications reach it. We send each notification through Expo, which passes it to Apple or Google to deliver. Expo sees the token and the notification's text, which can include a lesson time, a name or the start of a message, and doesn't keep the text. You can choose which notifications you get in the app, or turn them off in your phone's settings.

Receipt photos — instructors can attach a photo of a receipt to an expense. The app asks to use the camera only when you tap Take photo, and if you pick an existing photo instead, your phone's own photo picker hands over just that one.

Crash reports — if the app crashes or hits an error, it sends a report to Sentry, in its EU region, so we can fix it. The report says what kind of phone it was and what the app was doing, with personal details taken out first.

Usage counts — the app counts which screens get opened and when someone asks Ask Passdesk a question, in the same way and with the same limits as the web app (see How we improve Passdesk), plus whether it's an iPhone or Android phone and the app's version. Switch it off with Share usage counts, under Privacy on the app's More tab.

The app uses your location for one thing: if you're an instructor and you allow it, it saves where you tapped a thumbs up or down in a lesson, as described under “Where moments in a lesson happened”. It asks when you start a lesson and only uses location while the app is open; the map is drawn by Apple Maps on iPhone and Google Maps on Android. It has no advertising and no tracking: no ads, no advertising ID, and nothing passed to other companies for their own use.

Under-18 learners

Passdesk Solo accepts self-serve signups from learners aged 17 and over (the age at which a UK provisional driving licence becomes available). If a learner is under 18 at signup, we require a parent or guardian email and send a one-time confirmation link to that address before the trial starts. No card is asked for at signup, and confirming never charges anything. The under-18 account stays inactive until a parent or guardian visits the link and confirms. We record the confirmation timestamp, the IP address it was received from, and the policy version in force at the time as evidence of consent (UK GDPR Article 7).

Where a school invites an under-18 learner to a paid Passdesk school account, the school itself collects guardian contact details on the learner record and the school is the data controller for that consent. Either way, parents / guardians can ask us to delete their child's data at any time via the contact details below.

We do not knowingly accept self-serve signups from anyone under 17. If you believe a child under 17 has registered, contact us at the email below and we will delete the account.

Marketing emails

If you ask us to send you a guide or checklist from this site, we store your email address, the exact wording of the opt-in you agreed to, the date you agreed, and the page you came from. The lawful basis is your consent (UK GDPR Article 6(1)(a)), and the Privacy and Electronic Communications Regulations apply to the emails themselves. The tick box is never pre-ticked.

We use double opt-in: we email you a confirmation link first, and nothing else is sent unless you click it. If you never confirm, we delete the address within 30 days. Once confirmed you get the thing you asked for plus a short series of emails about running a driving school — a few a month at most.

Every one of those emails has an unsubscribe link, and your mail app's own unsubscribe button works too. One click stops all marketing email from us; we keep a record of the address on a suppression list purely so we can honour that. Marketing consent is separate from the essential emails a Passdesk account gets (password resets, lesson reminders, billing notices) — unsubscribing here never stops those.

We do not sell or share this list, and we do not use it for advertising or profiling.

How long we keep it

Active account data is retained while your account is active. If you stop using the service, we flag your records for review after 3 years of inactivity; records with no legal retention requirement are then deleted. If you ask us to delete your account, or your driving school removes you, we erase your personal data after a 30-day grace period: your contact details, progress, messages, reviews, photos and future bookings. What you bought and the lessons you've already had stay in the school's records without your name, because the school needs them for its accounts, and announcements you sent as a member of a school's staff stay in its records without your name too. Payments you made to Passdesk directly are kept without your name for as long as HMRC rules require (up to 7 years), then deleted. Audit logs are retained for 2 years. Records of refunds, fee changes, discounts and free months, and of which version of our terms each person agreed to and when, are kept for 6 years, in case of a claim or a tax question. After 2 years we keep them without names, contact details, notes or IP addresses, and when an account is deleted we keep only which version of the terms it agreed to and when. Questions asked through the in-app help assistant are deleted after 90 days. Ask Passdesk chats are deleted after 30 days. Usage counts are deleted after 12 months. Where moments in a lesson happened is deleted six months after the lesson at the latest (see above). We keep the IP address you connect from with each sign-in, password reset and other security event in our audit log (2 years), with each signed-in session while it lasts and for up to 30 days after it ends, with a device you ask us to remember (up to 30 days), with a sign-up you haven't finished (up to 30 days), and with each consent you give, such as agreeing to our terms (for as long as your account exists). We use it to keep your account safe and to show what was agreed. It also appears in our hosting provider's request logs, kept for up to 30 days.

Your rights

Under UK GDPR you have the right to: access the data we hold about you; correct inaccurate data; request erasure of data we no longer need; restrict processing; object to processing based on legitimate interests; and receive a portable copy of the data you provided to us.

You can export a copy of your data at any time from the My account page. For correction or any other subject-access request, email privacy@passdesk.co.uk.

You can delete your account yourself: sign in on the website, open My account, and under Privacy & data choose Delete my account. Or email privacy@passdesk.co.uk and we'll do it for you. Either way, we erase your personal data after 30 days, as set out in How long we keep it, and you can change your mind until then.

Cookies

We use one essential cookie for sign-in (the session JWT), and one preference cookie that remembers the appearance you pick (light, dark or match my device) so the choice carries between passdesk.co.uk and the app. No analytics, advertising or tracking cookies are set, and the usage counts in How we improve Passdesk store nothing on your device beyond remembering if you switch them off. Under the UK Privacy and Electronic Communications Regulations (PECR), cookies that are essential or that store a setting you asked for do not require opt-in consent; we still show a one-off banner the first time you visit so you know we set them.

Test centre finder

The test centre finder on our public test centres page turns the postcode you type into a location so we can sort centres by distance. That lookup happens in your browser against postcodes.io, a free service run by Ideal Postcodes using Ordnance Survey open data — so your postcode is sent to them, not to us. We do not store it, and you do not need an account to use the finder. If you choose "Use my location" instead, your browser asks your permission first and the coordinates never leave your device.

Complaints

If you think we have mishandled your data, please email privacy@passdesk.co.uk first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or, if you are in the EU or EEA, to the data-protection authority where you live or work — see If you're in the EU or EEA above.

Contact

For anything relating to the Passdesk platform itself, contact privacy@passdesk.co.uk.

About references to the DVSA

Passdesk is an independent product and is not affiliated with, endorsed by, or sponsored by the Driver and Vehicle Standards Agency (DVSA). Where the site describes features as "DVSA-aligned" or references the DVSA driving-test syllabus, theory categories, or test centres, those references describe the public information published by the agency that Passdesk's tools are built to mirror — not any endorsement or partnership.

Open data we use

To allow for driving time between pickups, Passdesk uses postcode locations from Ordnance Survey's Code-Point Open, under the Open Government Licence v3.0.

Contains OS data © Crown copyright and database right 2026.
Contains Royal Mail data © Royal Mail copyright and database right 2026.
Contains National Statistics data © Crown copyright and database right 2026.