Privacy notice

DriveBest is operated by LPR NEXUS LTD, company number 16356758, Unit A, 82 James Carter Road, Mildenhall, IP28 7DE. Our ICO registration is held under LPR NEXUS LTD, reference ZB966657. We are controller for customer, security, support, website and billing administration. For records entered by a school, the school is normally controller and we act as its processor.

Depending on role and use, DriveBest processes account identity, school membership and permissions; contact details; enquiries and allocation; pupil lessons, progress, messages, tests, terms acceptance and balances; instructor assignments; prices and branding; vehicle compliance; cases, documents, notification preferences, support, security, audit and billing records.

We process necessary account and subscription information to perform the contract where the individual is our contracting customer. For staff and business contacts, our legitimate interests are administering business accounts, answering support, preventing abuse and protecting the service. Required accounting records are processed to meet legal obligations. Optional analytics require consent. Necessary account details are required for authenticated access; without them we cannot provide the workspace. A school chooses and explains its lawful bases for pupil and enquiry processing, including any condition for necessary special-category data.

Website trial analytics start off. You can turn them on with the cookie banner and withdraw consent using Cookie settings on this Privacy notice. When enabled and configured, we send only named trial steps and a random anonymous visit identifier to PostHog; we do not send pupil details, names, email addresses, page URLs or school IDs in event properties. Withdrawal stops new events and aborts pending requests. Local consent and anonymous milestone markers prevent repeated steps on refresh; failed requests may be undercounted. Development and Preview events are labelled separately from production. The analytics provider necessarily receives a network request from your browser.

DriveBest uses Clerk, Inc. for staff identity and organisation membership; Convex, Inc. for application records, private files and scheduled work; Vercel Inc. for web hosting; Plus Five Five, Inc. (Resend) for service email; Functional Software, Inc. d/b/a Sentry for redacted errors; PostHog, Inc. for optional trial analytics; and, when enabled with consent, Google Ireland Limited and applicable Google affiliates for Google Analytics 4. Stripe handles annual licences and connected-school tuition payments through the applicable Stripe Payments Europe, Limited / Stripe Payments UK Ltd services and international affiliates; its controller/processor role depends on purpose and contract. We do not store card numbers, sell pupil information or use school records for advertising or model training. Native push services are outside this web release. Ask support for the current provider, location and transfer-safeguard schedule.

Providers and their authorised subprocessors process information internationally, including in the US. Sentry organisation storage and PostHog ingestion are in the EU. The Resend sender uses Ireland, while Resend identifies primary processing in the US. Convex infrastructure location follows the deployment region and Vercel uses global delivery; remote support and onward processing can occur elsewhere. Applicable provider contracts provide UK Addendum/Standard Contractual Clause arrangements and, where valid and applicable, Data Privacy Framework mechanisms. Restricted transfers require an appropriate UK transfer mechanism and assessment where required. European hosting alone does not establish that all onward processing stays in Europe. Contact support@drivebest.app to request the current location and applicable safeguard schedule.

Schools configure review periods for completed or inactive pupils and lost enquiries and confirm authorised disposal; a review date does not silently erase a record. Recorded legal holds block disposal. An authorised owner has a 30-day return/export window from final trial or paid access end. Verified deletion of school operational records is scheduled within the following 30 days unless instructed earlier or subject to a justified hold; this is an operator process. Private files are downloaded separately from the structured export. Restricted backup copies expire under the applicable backup schedule and deletion instructions must be reapplied before a restored copy is used. Separate tax/accounting records are normally retained for six years from the relevant company financial year end, longer where law requires; this does not justify retaining every pupil record.

Unnecessary support-request content is erased or redacted within 90 days after resolution, except scoped evidence needed for a legal obligation or dispute. Security and operational records are kept only as long as needed for service protection, incidents and legal obligations, with recorded review of exceptional holds. Optional analytics retention is limited to its measurement purpose. Schools must not include unnecessary pupil information in support requests.

Controls include authenticated tenant and role checks, encrypted network connections, private-file capabilities, separated secrets, idempotent payment and lesson operations, conflict detection and audit histories. Owners and authorised managers access their school's records; instructors access assigned records. Schools remain responsible for named users, devices, content and downloaded exports. Staff accounts are for adults; schools must provide suitable pupil privacy information, including for under-18s. Progress scores support human teaching decisions and do not certify test readiness.

Depending on the processing and lawful basis, UK data protection law gives rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. Withdrawal does not affect prior lawful processing. Contact the school for school-controlled records or support@drivebest.app for DriveBest-controlled information or help routing a request. We verify identity proportionately and respond within the applicable statutory deadline. You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/.

We will update this notice when processing changes materially and show the revision date. Questions, rights requests and suspected privacy incidents can be sent to support@drivebest.app.