Public URL: https://coredrive.co.uk/driving-school/privacy/
Effective date: 20 October 2026
Who is responsible
We are Hussan Lal, a self-employed driving instructor trading as CoreDrive Driving School. We are responsible for the personal information described here. Our service base is Wolverhampton, England. Contact us at hussanlal@msn.com or 07534 475429.
In this notice, “we”, “us” and “our” refer to the instructor or driving-school business identified above.
This notice covers this school website, learner enquiries, appointment communications and the approved pass photographs and reviews shown here. We are responsible for your driving lessons and the way we use your information. COREDRIVE PRIVATE LTD provides the website technology and technical delivery on our instructions; it does not provide or arrange these lessons. School enquiries go to Hussan Lal’s school inbox, not the corporate instructor waiting list. The separate Instructor Websites waiting-list form is operated by COREDRIVE PRIVATE LTD under its own privacy notice.
Information we use
We use the name, contact details and other necessary information you provide to answer enquiries and arrange lessons. The website currently requests your full name, phone number, email address and UK postcode, plus the booked test centre, date and time if you say that you have already booked a test; without these we cannot receive an online enquiry, but you may contact us directly. Optional fields are driving experience, preferred test centre, a request to discuss lesson support, preferred language, offer interests, availability and an additional message. An enquiry does not book a lesson, take a payment or sign you up for advertising.
The CoreDrive progress apps described on the main website are in development; this school website does not create an app account or upload lesson progress to those apps. The school uses the necessary contact and appointment information for arranging lessons and service reminders. Before a new progress-record service is used for real learner information, its actual records, providers, retention and privacy information must be explained.
Before arranging tuition, we need sufficient contact, collection-point, booking and lawful driving-entitlement information to provide the agreed service safely. We explain any further required tuition information before collecting it; an online enquiry does not require a medical history or full driving-licence copy.
Driving entitlement must be established before tuition. The public enquiry form does not ask for your licence number, a document image or criminal-offence history. Any more detailed eligibility check needs its own appropriate explanation and lawful authority; an ordinary contract clause is not, by itself, permission to collect criminal-offence data.
Information normally comes directly from you. A person arranging or paying for lessons may provide necessary contact or booking information. The Ross review shown on the website is attributed to its public Google source; other displayed feedback was supplied to the school. We do not treat another person’s payment as authority to disclose your private learning information to them.
When we receive information about you from someone else, we provide the relevant privacy information within one month, or earlier at our first communication with you or first disclosure to someone else where required, unless a lawful exception applies. Paying for lessons or being a parent does not automatically give someone access to your private records.
Why we use information
| Purpose | Information and source | Lawful basis and specific purpose |
|---|---|---|
| Answer a requested lesson enquiry | Your supplied contact details, postcode and preferences | Steps you request before a tuition contract with you; legitimate interests in answering other questions or an authorised third-party enquiry |
| Arrange lessons and service reminders | Agreed booking and contact details | Contract where you are the contracting learner; legitimate interests in providing the arranged tuition where another person contracts for it |
| Keep necessary financial records | Payments, refunds and the relevant transaction details | Legal obligations for the school’s tax and accounting records |
| Publish optional pass photographs and names | The approved photo, caption and permission record | Consent; permission can be withdrawn without losing lessons |
| Show genuine learner feedback | Feedback supplied for publication or the clearly attributed public review | Legitimate interests in showing fair, accurate customer feedback, subject to applicable permission and your right to object |
| Protect the website and prevent duplicate email | Request metadata including IP address in transit, keyed identifiers and delivery outcomes | Legitimate interests in security, abuse prevention and avoiding repeat delivery |
| Handle a complaint or privacy request | Your communication and proportionate case information | Applicable legal duties; legitimate interests in investigating and resolving service concerns |
Where we rely on a contract as our lawful basis, the information must be necessary for a contract with you or for steps you ask us to take before entering that contract. The table explains the basis for other processing, including where another person contracts for lessons. Where legitimate interests are used, the specific interests and purposes are identified in the table above. We balance these against your rights. We keep financial records for the period required by accounting and tax law. This does not extend how long we keep your other lesson records.
We tell you about a new purpose before using your information for it.
The website does not ask for a diagnosis or medical history. The optional support choice asks whether you would like to discuss extra lesson support; we do not infer a medical condition from it. If health or disability information becomes necessary, we explain its specific purpose, lawful basis, applicable special-category condition and retention before collecting it privately. A private conversation is still subject to data-protection law.
Please do not send medical histories, identity-document copies or other sensitive details through the public enquiry form. If you need a lesson adjustment, please ask us and we will arrange to discuss it privately.
Other organisations and international processing
| Recipient or service | Purpose and information | Locations and arrangements |
|---|---|---|
| Hussan Lal / school | Receives and handles the school enquiry and lesson arrangements | UK school operation; contact us for information about a specific disclosure |
| COREDRIVE PRIVATE LTD and Cloudflare | Website delivery, transient validation/email processing, EU-restricted keyed abuse and duplicate-control records; no enquiry text or raw contact details in that database | Cloudflare request processing can be global, including the US. EU database jurisdiction is not a UK-only processing promise. Applicable data-processing terms and UK transfer addendum apply where required |
| IONOS outgoing email service | Transmits the school enquiry through the configured SMTP service | IONOS terms provide for UK/EEA processing and protected transfers where needed |
| Microsoft Outlook.com/MSN | Holds the school’s private inbox, replies and recovery copies | May process information in the UK, US and other countries under the applicable consumer service terms, privacy statement and international-transfer arrangements |
| Mobile network providers | Deliver requested SMS lesson communications and necessary transmission metadata | Providers’ service and privacy arrangements apply to transmission; ask us about the route used |
| Lesson communications when this channel is used | WhatsApp’s applicable terms and privacy notice govern its service and international processing, including US processing. Ask us for the provider information or use phone/SMS/email instead | |
| Your and our banks | Process a requested bank transfer or refund and necessary transaction records | Their applicable service/privacy and legal retention rules; the website does not collect your bank-login details |
The table lists the providers we use, the information they receive, their purposes and the relevant processing locations and safeguards. Contact us for information about any international-transfer safeguard and how to obtain a copy. We disclose necessary information to authorities, professional advisers or insurers only where there is a lawful reason.
How long we keep information
| Record or copy | Retention and starting event | Limits and deletion |
|---|---|---|
| School enquiry correspondence, replies and retained mailbox copies | While handling the matter, then no more than 180 days after genuine final closure | Delete unnecessary material sooner; a specific legal duty or dispute may justify only the necessary limited evidence |
| Keyed spam/duplicate-control state | Active protection records expire within one hour from their fixed creation/admission events | Automatic cleanup removes expired records; reads do not restart the retention period |
| Cloudflare technical recovery state | Previous database state can remain recoverable for up to 30 days | This is separate from the one-hour active limit; no raw enquiry text is held in this database |
| Microsoft mailbox recovery copies | Outlook.com Deleted Items are automatically cleared after 30 days; removed items may remain recoverable for a further 30 days | Delete unnecessary retained copies and quoted replies; provider recovery is not instant erasure |
| IONOS email recovery, where a mailbox copy exists | IONOS publishes a seven-day recovery window | The SMTP transport is distinct from a second school enquiry inbox; no extra business inbox copy is promised |
| Necessary school accounting records | At least five years after the 31 January Self Assessment submission deadline for the relevant tax year, subject to any applicable longer legal requirement | This applies to necessary financial records, not automatically to entire enquiries or learning histories |
| Approved public photo/review content and permission evidence | While the approved publication remains necessary and lawful; review at least annually and on withdrawal/objection | Remove withdrawn publicity promptly. Delete superseded permission evidence once removal and any actual query or dispute have been resolved, unless a specific legal obligation requires the minimum record for longer |
The table distinguishes records held by our website provider from copies in our business inbox and our own tuition records. The retention period may differ for each copy. We remove information sooner where appropriate. If a legal duty or dispute requires it, we keep only the minimum record needed, for only as long as needed. Backup copies held by our providers expire as stated in the table. If a backup is restored, we apply the relevant deletions again before returning information to ordinary use.
Your choices and rights
Lesson reminders by SMS or WhatsApp are service communications about your lessons, not permission for advertising. The school enquiry form does not subscribe you to promotional email, SMS or WhatsApp messages. Any future optional marketing needs its separate lawful choice and a clear way to stop it. Corporate product waiting-list choices do not subscribe you to school marketing.
We use approved pass photographs, first names and captions for optional school publicity with permission. We show genuine learner feedback, with source attribution where applicable, to explain the school’s service. We do not require publicity as a condition of lessons. You can contact us about removal, withdrawing consent or objecting to a review’s use. We keep only necessary permission evidence and obscure certificate details in the published image itself.
You may ask for access, correction, deletion or restriction, and portability where applicable. Where we rely on consent, you may withdraw it at any time using our contact details above or the withdrawal route provided for that use. This does not affect earlier lawful use. These rights have legal conditions, and we explain any lawful limitation. We normally respond within one month, subject to any lawful extension or applicable timing rule. We ask only for proportionate identification where needed. You do not need an account or a prescribed form to contact us.
Your right to object
You can object to processing based on legitimate interests for reasons relating to your circumstances. You can object to direct marketing at any time, and we will stop using your information for that purpose. We may keep the minimum information needed to respect that choice.
We do not make a solely automated decision about whether you can take lessons or are test-ready. Automated form checks prevent malformed, duplicate or excessive submissions; you can contact the instructor directly if the form is unavailable. The website does not send learner enquiries or private records to a content-writing AI service.
Children can exercise their own rights. We consider a young person’s understanding, wishes, confidentiality and any representative’s actual authority. We provide age-appropriate explanations and do not make optional publicity a condition of lessons.
Questions and complaints
Please contact us first at hussanlal@msn.com or using the alternative contact above so we can investigate and try to resolve your concern. We acknowledge data-protection complaints within 30 days of receiving them, investigate appropriately, keep you informed and communicate the outcome without undue delay. This complaint process is separate from the timetable for a data-rights request.
If you remain dissatisfied or believe we have not handled your complaint appropriately, you can complain to the ICO, the UK’s data protection regulator, at ico.org.uk/make-a-complaint. The ICO recommends giving us a chance to resolve your complaint first. This does not restrict your right to contact the ICO at any time.
See also our Website Storage and Cookies notice.