Drivora is in pre-launch and is not yet open for sign-ups or payments. Our registered company details and contact addresses will be published on this page before the service opens.
Data Processing Agreement
For instructors and driving schools
Last updated: 9 October 2026
Parties: you, the instructor or driving school (the "Controller"), and Drivora ("Drivora", the "Processor").
1. Scope
1.1 This agreement applies to personal data that you, your staff or your learners put into Drivora as part of your pupil records: pupil and enquiry contact details, pickup addresses, lesson history, attendance, progress, skills, test dates, lesson notes, waiting-list entries, and parent links you create (the "Pupil Data").
1.2 It doesn't cover data Drivora controls itself: users' Drivora accounts and sign-in, booking-fee and payment records, security logs and support. These are covered by the Drivora Privacy Policy. It doesn't cover data Stripe controls.
2. Details of the processing (Article 28(3))
| Item | Detail |
|---|---|
| Subject matter | Providing the Drivora booking, payments and pupil-management service |
| Duration | While you have a Drivora account, plus the return and deletion period in clause 9 |
| Nature and purpose | Hosting, storing, displaying, sending notifications, scheduling, backups, support |
| Types of data | Identity and contact details, addresses, lesson and progress records, free-text notes, enquiry details |
| Special category data | Not intended. You're responsible for any you choose to record. |
| Data subjects | Your pupils (including under-18s), their parents or guardians, enquirers, your staff |
3. Drivora's obligations
Drivora will:
- process Pupil Data only on your documented instructions, which are these terms and your use of the Service's settings, unless UK law requires otherwise. In that case we'll tell you first unless the law prohibits it.
- tell you straight away if we think an instruction breaks data protection law.
- make sure everyone who can access Pupil Data is bound by confidentiality.
- keep appropriate technical and organisational security measures (Annex A).
- use sub-processors only as set out in clause 4.
- help you, through the Service's export, edit and delete tools and otherwise as reasonable, to answer data subject requests, and pass on any request we receive within 5 working days.
- help you with security, breach notification, DPIAs and ICO consultation, taking into account the information available to us.
- notify you without undue delay, and within 48 hours of becoming aware of a personal data breach affecting Pupil Data, with the information you need for your own 72-hour report.
- at the end of the Service, delete or return Pupil Data as set out in clause 9.
- make available the information needed to show we comply with this agreement, and allow reasonable audits (normally by questionnaire, once a year, at your cost).
4. Sub-processors
4.1 You give general authorisation for the sub-processors listed at https://drivora.app/sub-processors.
4.2 We'll give you at least 14 days' notice of any new or replacement sub-processor. If you object on reasonable data protection grounds and we can't resolve it, you may end your subscription and get a refund of any prepaid unused period.
4.3 We impose equivalent data protection terms on each sub-processor and remain responsible for them.
5. International transfers
Pupil Data is mainly stored in the EU (Ireland). Where a sub-processor processes it outside the UK, we make sure there is a valid transfer mechanism under UK GDPR Chapter V: adequacy regulations, including the UK-US data bridge, or the IDTA or UK Addendum.
6. Your obligations
You confirm that:
- you have a lawful basis for the Pupil Data.
- you have given your pupils (and their parents, where relevant) privacy information that explains you use Drivora.
- you have paid the ICO data protection fee if you need to.
- you won't record special category data unless it's necessary and lawful.
7. Children
Many pupils are under 18. You agree to keep notes professional and limited to what's needed for tuition, and to use parent links only for a pupil's genuine parent or guardian.
8. Liability
The liability terms in the Instructor and School Terms apply to this agreement.
9. End of the Service
You can export Pupil Data at any time. Within 30 days after your account closes we'll delete Pupil Data, and backups roll off within a further 35 days, except where UK law requires us to keep it. Payment records that Drivora controls are kept under our Privacy Policy.
10. Precedence
If this agreement conflicts with the Instructor and School Terms on data protection, this agreement wins.
Annex A: Security measures
- Encryption in transit (TLS) and at rest.
- Role-based access in the app. Database access is restricted to the Drivora API service role, with row-level security enabled.
- Production access limited to named personnel, with multi-factor authentication.
- Audit logging of sensitive actions.
- Automated backups and the ability to restore.
- Dependency and vulnerability updates, and security headers on the website.
- A documented breach response plan.