Privacy policy

Care2Drive is a not-for-profit initiative that funds driving lessons for people who give their own time to look after somebody else. We are not a registered charity.

The organisation responsible for your personal data, the data controller in law, is [LEGAL ENTITY NAME], company number [COMPANY NUMBER], registered at [REGISTERED ADDRESS]. Our registration with the Information Commissioner's Office is [ICO REGISTRATION NUMBER].

For anything in this policy, email [PRIVACY EMAIL].

We only hold what you give us. It arrives in one of four ways.

The nomination form

• The nominee's name.
• The first part of their postcode, not the full address.
• Their age range.
• Their driving licence stage, for example provisional or none yet.
• Contact details: email address, and phone number if given.
• What the person nominating wrote about them: who they help, and what a licence would let them do more of.
• If somebody nominates another person, the nominator's own name and contact details too.

The instructor form

• Name and ADI number.
• Town, or the first half of the postcode.
• Email address and phone number.
• Roughly how many hours a week you could offer, and anything you chose to tell us.

Shop purchases

• Name, email address and delivery address.
• Order contents and payment confirmation. Card details are entered on our payment provider's own systems and we never see or store a card number.

The website itself

We do not run analytics, advertising pixels or visitor tracking on this site. Our hosting provider keeps short-lived server logs, including IP addresses, to deliver pages and block abuse. See the cookie policy for what is stored in your browser.

UK GDPR requires a specific lawful basis for each purpose. Ours are set out one by one below.

Most nominations are made on somebody else's behalf, which means we end up holding details about a person who did not fill in our form. We treat that seriously.

• We ask the person nominating to confirm they have the nominee's permission before they send the form. That confirmation is required, not optional.
• We contact the nominee directly, tell them who put their name forward, and point them to this policy. Nothing progresses until they have heard from us.
• If a nominee asks us to delete their details, we delete them. We do not ask for a reason, we do not try to talk them out of it, and it does not affect anyone else.
• If a nominee tells us they never gave permission, we delete the nomination and we do not contact them again.

To have a nomination removed, email [PRIVACY EMAIL] with the name on it. One line is enough.

We do not sell personal data. We do not share it with advertisers, data brokers or list builders, and we do not swap supporter lists with anyone. The only organisations that touch it are the suppliers we need to operate:

• [CRM PROVIDER], our email and customer relationship system, which holds form submissions and newsletter subscriptions.
• [PAYMENT PROVIDER], which processes card payments and holds the payment record.
• Our website and database hosting provider, which stores the site and its data.
• The driving instructor teaching a funded learner: they get the learner's name and contact details, and nothing more, so lessons can be arranged.
• Our accountant, and HMRC where the law requires it.

Each supplier acts on our instructions under a written contract and cannot use your data for their own purposes. We would also disclose data if a court or the police required it by law.

Our records are held on secure servers, in the UK or the European Economic Area wherever the supplier offers it. Some of our suppliers are based outside the UK, or use support teams that are, so some data is transferred abroad.

Where that happens, the transfer is covered either by UK adequacy regulations for that country, or by the standard contractual clauses with the UK International Data Transfer Addendum, together with checks on how the supplier protects the data. You can ask us which applies to a particular supplier.

We do not keep things indefinitely. By category:

• Nominations we cannot take forward: deleted after [X MONTHS].
• Nominations we fund: kept for the length of the funded course, then [X MONTHS OR YEARS AFTER THE COURSE ENDS], so we can answer questions about it and report totals accurately.
• Instructor registrations: kept while you are working with us or open to it. If you tell us you are no longer available, or we have had no contact for [X MONTHS], we delete the record.
• Orders, invoices and payment records: six years after the end of the relevant financial year, which is what UK tax law requires.
• Newsletter subscriptions: until you unsubscribe. We then keep a minimal note of the unsubscribe so we do not email you again by mistake.
• Server and security logs: a short rolling window, typically weeks rather than months.

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you (access).
• Have inaccurate details corrected (rectification).
• Ask us to delete your data (erasure).
• Ask us to pause using it while a question is sorted out (restriction).
• Object to us using it under legitimate interests.
• Receive it in a portable, machine-readable form (portability).
• Withdraw consent at any time, which stops that use from then on and does not affect anything already done lawfully.

To use any of these, email [PRIVACY EMAIL] saying what you want, and we will reply within one month; it is free, and you do not need to give a reason to withdraw consent or to ask for deletion.

If you are unhappy with how we have handled your data, please tell us first at [PRIVACY EMAIL]. We would rather fix it, and the regulator asks that you give us the chance.

You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk. Complaining to us does not remove your right to go to them.

Our forms are written for adults. The minimum age to submit a form yourself, or to be nominated for funded lessons, is 18.

We do not accept nominations or applications from anyone under 18. If we learn we are holding personal data about someone under 18, we delete it and do not contact them again.

This is a safeguarding decision. We are not set up to supervise or vet the adults who would be alone in a car with a young person, so we keep the boundary at 18.

This site sets no analytics, advertising or tracking cookies, so there is no consent banner. The full detail, including the small number of strictly necessary items, is on the cookie policy.

When we change this policy we update the Last updated date at the top and keep the previous version on file. Small wording fixes are made quietly.

If a change materially affects how we use data you have already given us, for example a new purpose or a new type of sharing, we will email the people affected and, where the change relies on consent, ask again rather than assume.