Privacy Policy

1. Introduction

DeskLink Ltd, a company registered in the United Kingdom, trading as InstructorGo, hereinafter referred to as "we", "us", "our", or "InstructorGo", is committed to protecting the privacy and security of your personal data. This Privacy Policy explains in detail how we collect, use, store, share, and protect the personal information of individuals who access and use the InstructorGo platform, website, and web application, collectively referred to as the "Platform".

We process all personal data in strict accordance with the United Kingdom General Data Protection Regulation, commonly referred to as the UK GDPR, and the Data Protection Act 2018, together with all other applicable data protection laws and regulations in force in the United Kingdom. For the purposes of applicable data protection legislation, DeskLink Ltd is the data controller responsible for your personal data.

This Privacy Policy should be read in conjunction with our Terms of Service and our Cookie Policy, which provide further information about the terms governing your use of the Platform and the cookies and similar technologies we employ.

2. Information We Collect

When you create an account on the Platform, we collect personal information that is necessary to set up and maintain your account and to provide you with our services. This includes your full name, email address, telephone number, date of birth, and postcode or location information. If you register as a Learner, we also collect information about your driving experience level and, where you choose to upload it, a copy of your provisional driving licence for verification purposes. If you register as an Instructor, we additionally collect your DVSA Approved Driving Instructor licence number and expiry date, your years of professional driving instruction experience, your hourly rate and service radius preferences, details about your vehicle including its make, model, year of manufacture, colour, registration number, and transmission type, as well as documentary proof of your motor insurance cover.

When you use the Platform to book or deliver driving lessons, we collect information about the bookings you make or accept, including the pickup location specified by the Learner, the type and duration of the lesson, the date and time of the booking, and the outcome of the lesson such as whether it was completed, cancelled, or resulted in a no-show. During active driving lessons, the Platform may collect real-time location data using the GPS functionality of the Instructor's device in order to provide features such as en-route tracking, estimated time of arrival, and arrival confirmation at the pickup location.

We collect payment-related information in connection with transactions processed through the Platform. All payment card details are processed securely by Stripe, our third-party payment processor, and InstructorGo does not store, access, or have visibility of your full card number, expiry date, or CVV security code at any time. We do store a Stripe customer identifier associated with your account, as well as records of transaction amounts, dates, fees, and payment statuses for the purpose of maintaining accurate financial records and providing you with transaction history.

When you communicate with other users through the Platform's in-app messaging system, we collect and store the content of those messages, the date and time each message was sent, and whether the message has been read by the recipient. These messages are retained in order to facilitate ongoing communication between Learners and Instructors, to provide evidence in the event of a dispute, and to enforce our community guidelines and Terms of Service.

If you leave a review or rating for an Instructor after completing a lesson, we collect the content of your review, the numerical rating you assign, and any subsequent edits, replies, or disputes associated with the review. Reviews and ratings are displayed publicly on the relevant Instructor's profile to help other Learners make informed booking decisions.

We automatically collect certain technical and usage information when you access and use the Platform, including your IP address, browser type and version, operating system, device type and screen resolution, the pages and features you visit and interact with, the dates and times of your visits, referring and exit URLs, and other diagnostic and analytical data. This information is collected through cookies, server logs, and similar technologies as described in our Cookie Policy.

3. How We Use Your Information

We use the personal information we collect for a range of purposes that are necessary for the operation, maintenance, and improvement of the Platform and the services we provide. The primary purpose for which we process your data is the performance of the contract between you and DeskLink Ltd, as set out in our Terms of Service, which includes creating and managing your user account, facilitating the booking of driving lessons between Learners and Instructors, processing payments and managing financial transactions including deposits, balance payments, wallet credits, and withdrawal requests, operating the matching engine that connects Learners with available Instructors based on location, availability, and other relevant criteria, and enabling in-app communication between Learners and Instructors in connection with their bookings.

We also process your personal data where it is necessary for the purposes of our legitimate interests as a business, provided that those interests are not overridden by your rights and freedoms as a data subject. These legitimate interests include monitoring and improving the safety, security, and integrity of the Platform, detecting and preventing fraud, abuse, and other harmful or unauthorised activity, analysing usage patterns and trends in order to understand how the Platform is used and to identify areas for improvement, providing customer support and responding to your enquiries, complaints, and feedback, administering the review and rating system to ensure transparency and trust within the marketplace, enforcing our Terms of Service including the management of strikes, suspensions, and account terminations, and sending you important service-related communications such as booking confirmations, payment receipts, security alerts, and policy updates.

Where you have given us your consent, we may also use your personal data to send you marketing communications, including newsletters, promotional offers, feature announcements, and other information about InstructorGo that we believe may be of interest to you. You may withdraw your consent to receive marketing communications at any time by clicking the unsubscribe link included in every marketing email we send, by adjusting your notification preferences within your account settings, or by contacting us at the email address provided in Section 14 of this policy. Withdrawing your consent to marketing communications will not affect the lawfulness of any processing carried out prior to your withdrawal, and it will not affect the processing of your personal data for other purposes for which consent is not required.

We may also process your personal data where it is necessary to comply with a legal obligation to which DeskLink Ltd is subject, such as maintaining financial records for tax and accounting purposes in accordance with HMRC requirements, responding to lawful requests from law enforcement or regulatory authorities, or fulfilling our obligations under applicable data protection legislation.

4. Who We Share Your Information With

In order to facilitate the core functionality of the Platform, we share limited personal information between Learners and Instructors who are involved in a booking together. When a Learner books a lesson with an Instructor, the Instructor will receive the Learner's first name, pickup location, lesson type, and any lesson notes the Learner has provided. The Learner will receive the Instructor's name, profile photo, vehicle details, rating, and estimated time of arrival. We do not share email addresses, phone numbers, or other direct contact details between users, as all communication is conducted through the Platform's in-app messaging system.

We share personal data with a number of third-party service providers who assist us in operating and delivering the Platform and its services. These third-party processors include Supabase, which provides our database hosting, authentication, file storage, and serverless computing infrastructure; Stripe, which processes all payment transactions, manages Instructor payout accounts through Stripe Connect, and provides fraud detection and prevention services; Sentry, which provides error monitoring, performance tracking, and session replay functionality to help us identify and resolve technical issues; Google, which provides analytics services through Google Analytics to help us understand how the Platform is used, as well as mapping services through Google Maps to power location-based features; Progressier, which manages our Progressive Web App push notification delivery; and Resend, which provides our transactional and marketing email delivery service.

Each of these third-party service providers is contractually bound to process your personal data only in accordance with our instructions and solely for the purposes for which the data is shared. They are not permitted to use your personal data for their own independent purposes, and they are required to maintain appropriate technical and organisational security measures to protect your data.

We may also disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other governmental bodies where we are legally required or permitted to do so, such as in response to a court order, subpoena, or other legal process, or where we reasonably believe that disclosure is necessary to protect the rights, property, or safety of DeskLink Ltd, our users, or the public.

In the event that DeskLink Ltd undergoes a merger, acquisition, restructuring, sale of assets, or similar corporate transaction, your personal data may be transferred to the acquiring entity or successor organisation as part of that transaction. In such circumstances, we will take reasonable steps to ensure that your personal data continues to be protected in accordance with this Privacy Policy and applicable data protection legislation, and we will notify you of any such transfer before your personal data becomes subject to a different privacy policy.

5. International Data Transfers

Some of the third-party service providers we work with are based in or operate servers in countries outside the United Kingdom, including the United States of America and other jurisdictions that may not provide the same level of data protection as the United Kingdom. When your personal data is transferred outside the United Kingdom, we take appropriate steps to ensure that it receives an adequate level of protection in accordance with UK GDPR requirements.

The safeguards we rely upon for international data transfers include transferring data to countries that have been deemed by the United Kingdom to provide an adequate level of data protection, implementing standard contractual clauses approved by the UK Information Commissioner's Office with our third-party processors, and relying on other appropriate transfer mechanisms recognised under applicable data protection legislation. You may request further information about the specific safeguards applied to international transfers of your personal data by contacting us at the email address provided in Section 14 of this policy.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy, or for as long as is required or permitted by applicable law. The specific retention period applicable to your data depends on the nature of the data and the purpose for which it is processed.

While your account remains active on the Platform, we will retain all personal data associated with your account in order to provide you with our services and to maintain the functionality of your account. If you choose to delete your account, or if your account is terminated by InstructorGo, your personal data, including your name, email address, telephone number, date of birth, profile photo, location data, and all other personally identifiable information associated with your account, will be permanently and irreversibly deleted from our active systems immediately upon the processing of the account deletion or termination.

However, financial transaction records, payment history, invoice data, wallet transaction logs, and related accounting information will be retained by DeskLink Ltd for a minimum period of six (6) years following the date of account deletion or the date of the most recent transaction, whichever is later, in order to comply with United Kingdom tax, accounting, and financial reporting legislation, including the requirements of Her Majesty's Revenue and Customs and the Companies Act 2006.

Anonymised and aggregated data that has been processed in such a way that it can no longer be used to identify any individual, either directly or indirectly, may be retained indefinitely for the purposes of statistical analysis, business planning, platform performance monitoring, and service improvement. Such anonymised data is no longer considered personal data under applicable data protection legislation and is therefore not subject to the same retention limitations.

7. Data Security

We take the security of your personal data very seriously, and we have implemented a range of appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, destruction, loss, and other forms of unlawful or accidental processing. These measures include the use of encryption for data in transit using HTTPS and TLS protocols, secure authentication mechanisms with session tokens and token refresh, role-based access controls that restrict access to personal data to only those personnel and systems that require it for legitimate purposes, and row-level security policies within our database that ensure each user can only access their own data.

While we take all reasonable precautions to protect your personal data, no method of electronic storage or transmission over the internet is completely secure, and we cannot guarantee the absolute security of your information. In the event that a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under the UK GDPR and will take all necessary steps to mitigate the effects of the breach.

8. Your Rights Under Data Protection Law

Under the UK GDPR and the Data Protection Act 2018, you have a number of important rights in relation to your personal data, and we are committed to facilitating the exercise of those rights in a timely and transparent manner.

You have the right of access, which means you have the right to request a copy of the personal data we hold about you, together with information about how and why we process it, the categories of data concerned, the recipients or categories of recipients to whom it has been disclosed, the retention period applicable to the data, and the source of the data if it was not collected directly from you. This is commonly known as a Subject Access Request.

You have the right to rectification, which means you have the right to request that we correct any personal data we hold about you that is inaccurate, incomplete, or out of date. You can update most of your personal information directly through your account settings on the Platform, or you may contact us to request corrections.

You have the right to erasure, also known as the right to be forgotten, which means you have the right to request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw your consent and there is no other legal basis for processing, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed. Please note that this right is subject to certain exceptions, including where retention is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.

You have the right to restriction of processing, which means you have the right to request that we temporarily restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data, where the processing is unlawful but you oppose erasure, where we no longer need the data but you require it for the establishment, exercise, or defence of legal claims, or where you have objected to processing pending verification of whether our legitimate grounds override yours.

You have the right to data portability, which means you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where the processing is based on your consent or on the performance of a contract and is carried out by automated means.

You have the right to object to the processing of your personal data where the processing is based on our legitimate interests, and we will cease processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes, and we will comply with any such objection promptly and without charge.

To exercise any of the rights described above, please contact us at the email address provided in Section 14 of this policy. We will respond to your request within one (1) calendar month of receiving it, as required by the UK GDPR. In certain circumstances, where your request is particularly complex or where you have made multiple requests, we may extend this period by a further two (2) months, in which case we will inform you of the extension and the reasons for it within the initial one-month period. There is no fee for exercising your data protection rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to comply with the request.

9. Children's Privacy

The Platform is available to users aged sixteen (16) and over, as set out in our Terms of Service. Users aged sixteen or seventeen must hold or have applied for a valid United Kingdom provisional driving licence and must have obtained the consent of a parent or legal guardian before creating an account. We do not knowingly collect personal data from children under the age of sixteen. If we become aware that we have inadvertently collected personal data from a child under sixteen without appropriate parental or guardian consent, we will take prompt steps to delete that data from our systems. If you are a parent or guardian and believe that your child under the age of sixteen has provided personal data to InstructorGo without your consent, please contact us immediately at the email address provided in Section 14 of this policy so that we can take appropriate action.

10. Marketing Communications

Where you have given us your consent, we may send you marketing communications by email about our services, new features, promotions, events, and other information that we believe may be of interest to you. We will always clearly identify marketing emails as such, and every marketing email we send will include a clear and easy-to-use unsubscribe link that allows you to opt out of receiving further marketing communications with a single click.

You may also manage your marketing and communication preferences at any time through your account settings on the Platform, or by contacting us directly. Please note that even if you opt out of marketing communications, we will continue to send you essential service-related communications that are necessary for the operation of your account, such as booking confirmations, payment receipts, security notifications, and important updates to our Terms of Service or Privacy Policy, as these communications are not considered marketing and do not require your separate consent.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Platform, to keep you logged in securely, to analyse how the Platform is used, and to monitor for technical errors and performance issues. For comprehensive and detailed information about the specific cookies and tracking technologies we use, the purposes for which they are used, and how you can manage or disable them, please refer to our Cookie Policy, which forms an integral part of this Privacy Policy.

12. Third-Party Links and Services

The Platform may contain links to third-party websites, applications, or services that are not owned, operated, or controlled by InstructorGo or DeskLink Ltd. This Privacy Policy applies solely to personal data collected and processed by InstructorGo through the Platform, and we are not responsible for the privacy practices, data collection methods, or content of any third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services that you visit or interact with through links on the Platform, as their practices may differ significantly from ours. The inclusion of a link to a third-party website or service on the Platform does not constitute an endorsement, recommendation, or approval of that website or service by InstructorGo.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in the services we provide, changes in applicable legislation, or other developments that affect how we collect, use, and protect your personal data. When we make material changes to this Privacy Policy, we will update the "Last updated" date displayed at the top of this page and will notify you of the changes via email to the address associated with your account and/or through an in-app notification displayed within the Platform, providing you with at least fourteen (14) days' notice before the updated policy takes effect. Your continued use of the Platform after the updated Privacy Policy takes effect constitutes your acceptance of the changes. We encourage you to review this Privacy Policy periodically to remain informed about how we protect your information.

14. Contact Us and Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy, or if you wish to exercise any of your rights as a data subject under applicable data protection legislation, please contact us using the details provided below. We will endeavour to respond to all privacy-related enquiries and requests in a timely, transparent, and helpful manner.

Company: DeskLink Ltd
Trading as: InstructorGo
Email: support@instructorgo.co.uk
Website: https://instructorgo.co.uk

If you are not satisfied with our response to a privacy-related concern or complaint, or if you believe that we have processed your personal data in a manner that is not compliant with applicable data protection legislation, you have the right to lodge a complaint with the Information Commissioner's Office, which is the United Kingdom's independent supervisory authority for data protection. The Information Commissioner's Office can be contacted at ico.org.uk or by telephone on 0303 123 1113. While we would always appreciate the opportunity to address your concerns directly before you contact the ICO, you are of course free to lodge a complaint at any time without first raising the matter with us.