Privacy Policy

We collect only the information we need to respond to you and to provide driving lessons. Depending on how you contact us, this may include:

• Contact details — your name, telephone number and email address when you enquire.
• Booking details — your postcode, preferred lesson times, lesson type (automatic or manual), theory and practical test status, and anything else you choose to tell us.
• Correspondence — records of messages you send us by email, WhatsApp or our website forms.
• Technical information — standard information your browser sends when you visit a website, such as your device and browser type. We do not currently run analytics or advertising trackers.
• Administrator accounts — Supabase processes administrator email addresses, authentication information and session data. Account identifiers and assigned roles are used to restrict access to the Admin Hub; public visitors do not need an account.

We do not collect payment card details through this website.

Please do not include unnecessary health information in an enquiry. If information about a disability or medical condition is needed to arrange safe tuition or an adjustment, the academy must identify an appropriate lawful basis and an additional condition for special-category data before collecting or using it.

To confirm before publication: Confirm whether health or other special-category information is collected, why it is needed, the applicable legal conditions, who may access it and its retention arrangements.

We use your personal information to:

• Respond to your enquiries and provide quotes or information you ask for.
• Arrange, confirm and manage your driving lessons.
• Keep basic business records, including for tax and accounting purposes.
• Improve our website and services.
• Meet our legal and regulatory obligations.
• Authenticate administrators and check their access to the Admin Hub.

We will not use your information for anything incompatible with these purposes without telling you first.

UK data protection law requires a lawful basis for each use of personal information. We rely on:

• Contract — to take steps you ask for before booking, and to provide your lessons.
• Legitimate interests — to run and improve our business and respond to enquiries, where this does not override your rights.
• Legal obligation — for records we must keep, such as accounts.
• Legitimate interests — to authenticate authorised administrators and restrict access to administration tools, subject to their rights.
• Consent — for optional marketing communications. You can withdraw consent at any time.

When you send us a booking or contact enquiry, we use the details you provide solely to respond to you and, if you go ahead, to arrange your lessons. We do not add you to a marketing list because you made an enquiry.

The Contact Us form securely stores your name, email address, optional phone number, selected contact reason, message and optional marketing preference in the academy's Supabase database. Brevo processes your email address and enquiry reference to send an acknowledgement, and your enquiry details to notify the academy. Authorised administrators can review and manage enquiries in the Admin Hub. The separate booking enquiry form is not yet live and does not send or store submissions.

We will only send you marketing communications (such as news or offers) if you have specifically opted in. Marketing consent is never pre-ticked and is never a condition of booking lessons.

You can withdraw your consent at any time by emailing us, and we will stop promptly.

To confirm before publication: No marketing emails are currently sent. An email marketing service (Brevo) is planned for a later phase; this section will name the provider and how consent is recorded before any marketing begins.

We never sell your personal information. We may share it with:

Supabase processes administrator authentication, role records and contact enquiries. Brevo sends contact acknowledgement and academy notification emails. Sending uses a secured Lovable connector. No marketing emails are currently sent and the separate booking form remains unconnected.

• Service providers who help us run the business, such as website hosting and email providers, who may only use it on our instructions.
• Professional advisers such as accountants, where necessary.
• Authorities or regulators where the law requires it.

To confirm before publication: The actual hosting provider and email service used for this website need to be confirmed and listed here as data processors.

Service providers may process personal information outside the United Kingdom. The applicable location and transfer arrangements depend on the provider and the service configuration. This policy does not claim that all data stays in the UK or that a particular transfer safeguard has been verified.

To confirm before publication: Confirm Supabase's configured data region, other provider locations, processing agreements and any applicable UK transfer safeguards before treating this policy as final.

Retention depends on the purpose of the information and any applicable legal requirements. You can ask about deletion using the contact details below; some information may need to be retained to meet legal obligations. No fixed retention period for enquiry, lesson or administrator records has yet been confirmed.

To confirm before publication: A precise retention schedule (how long each type of record is kept) should be confirmed and added here.

The retention criteria should account for whether an enquiry is still active, whether lessons or a complaint are ongoing, and whether records are necessary for a legal obligation or legal claim. Information should then be deleted or anonymised when it is no longer needed.

The Admin Hub checks administrator sign-in and assigned roles before allowing access. This describes the website's access checks, not a certification or guarantee of security. No method of transmission or storage is completely secure. Business-wide measures, including device protection and incident handling, require confirmation.

Under UK data protection law you have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — ask us to correct information that is wrong or incomplete.
• Erasure — ask us to delete your information in certain circumstances.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Portability — ask us to transfer information you gave us to another organisation, or to you, in certain circumstances.
• Object — object to our use of your information in certain circumstances.
• Withdraw consent — where we rely on consent, withdraw it at any time.

These rights depend on the circumstances and any legal exceptions. Requests are normally free and must generally be answered within one month; the law allows an extension in certain cases. To make a request, email us using the address below.

You may request access, correction or deletion without using a special form. Please describe what you need and how we can contact you. We may ask for proportionate information to verify your identity or clarify the request; do not send identity documents unless asked. If a right does not apply or an exception prevents full action, we should explain the reason and your options.

Further information about your rights is available from the UK regulator. ICO information for the public

The website source implements browser storage for cookie preferences and administrator sign-in, and an Admin Hub sidebar display-preference cookie. No analytics or marketing trackers are implemented in that source. The Cookie Policy explains the storage and the need to assess any applicable consent exception; consent-required technology must remain off until consent is given. Read our Cookie Policy for full details.

For any question about this policy or your personal information, or to exercise your rights, contact us:

Email us at hello@galaxydriving.co.uk and we will get back to you as soon as we can.

Telephone: +44 7748 005552. Call Galaxy Driving Academy

To confirm before publication: A postal contact address for privacy enquiries should be confirmed and added, as data protection guidance expects more than one way to reach the controller.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would welcome the chance to resolve your concern first, so please consider contacting us before approaching the ICO.

You can contact the ICO whether or not you first raise the issue with us. Make a data protection complaint to the ICO

We may update this policy from time to time, for example when our services or the law change. The version on this page is the current one, and the date at the top shows when it was last updated. If we make a significant change, we will make that clear on this page.