Last updated: 1 October 2026. This policy is a customised operational draft. Before publication, DriveToPass must insert its legal entity, address, privacy email, applicable representative or data-protection officer details, and verify every statement against its production systems and service providers.
1. Who we are and the scope of this policy
“DriveToPass,” “we,” “us,” and “our” refer to the legal entity operating the DriveToPass website, mobile application, and related services (the “Service”). That entity is the controller or equivalent responsible organisation for personal information described in this policy, except where another organisation explains that it acts as an independent controller.
This policy applies to visitors, account holders, learner drivers, supervising drivers, instructors, subscribers, route owners, route recipients, and people who communicate with us. It applies internationally. Local privacy notices or legally required disclosures may supplement this policy in particular countries or regions.
2. Information we collect
2.1 Account and profile information
We may collect your name, email address, profile information, country or region, authentication details, account identifiers, preferences, and information needed to create and secure an account. Passwords should be stored only in protected, hashed form.
2.2 Social sign-in information
If you choose social sign-in, the provider may give us an identifier and permitted profile details such as your name, email address, or profile image. We do not receive your social-provider password. The provider’s privacy policy also applies.
2.3 Test-centre and route activity
We may process selected test centres, route views, free or subscribed route access, routes started or completed, route results, distance, duration, timestamps, progress, and related interaction history.
2.4 Custom Route information
When you record or create a Custom Route, we may process its name, map coordinates, route geometry, notes, distance, duration, speed-related metadata, start and completion times, and technical information needed to display and navigate it.
2.5 Shared-route information
If you share a Custom Route, we process the route owner, intended recipient, sharing status, access settings, and records of granting, changing, revoking, or restoring access. The recipient can see the information contained in the route you choose to share.
2.6 Device, usage, and diagnostic information
We may collect device type, operating system, application version, language, IP address, approximate location derived from IP, browser information, identifiers, log data, crash details, performance information, pages or screens viewed, and timestamps.
2.7 Subscription and transaction information
We may receive purchase identifiers, plan, subscription status, renewal or expiry date, transaction status, country, currency, and information needed to verify access. Payment-card details are generally handled by the application store or payment provider rather than DriveToPass.
2.8 Notifications and communications
If you enable push notifications, we may process a device or notification token and notification preferences. If you contact us, we process your contact details, message, attachments, support history, and information reasonably needed to resolve the request.
2.9 Information from other people
Another user may provide your account identifier or contact information to share a route with you. Service providers may provide authentication, subscription, fraud-prevention, mapping, or delivery information. We may also receive information where permitted by law from public sources or business partners.
3. Precise location and route data
Location functionality is central to features such as finding nearby test centres, showing your position, sat-nav guidance, recording a Custom Route, calculating distance, and generating route results.
| Feature | Location use | Your control |
|---|---|---|
| Nearby test centres | Uses your current coordinates to order centres by distance. | You can search by town, city, or postcode instead. |
| Sat-nav | Uses live position to show progress and navigation instructions. | Location permission can be managed in device settings. |
| Custom Route recording | Collects a sequence of coordinates to create your route geometry. | Start recording only when wanted and delete saved routes through available controls. |
| Route sharing | Makes the saved route and its locations available to chosen recipients. | Review the route before sharing and manage or revoke access. |
Location data can be sensitive. A recorded route may reveal a home, workplace, school, regular journey, or another person’s location. Avoid recording unnecessary private locations and review a route carefully before sharing it.
Device permission settings control whether the Service can access location. Disabling permission may prevent nearby search, live guidance, or recording from working. Depending on your device and the feature, location may be processed while the application is visible or during an active route session. The production application must accurately disclose any background-location use through the operating-system permission screen and application-store listing.
4. How and why we use information
We use personal information as reasonably necessary to:
- create, authenticate, maintain, and secure accounts;
- find test centres and provide maps, routes, sat-nav, lane guidance, and route results;
- record, save, edit, display, and delete Custom Routes;
- enable route sharing and enforce owner-selected access;
- verify subscriptions and provide paid or free route access;
- send requested service messages, security alerts, and enabled notifications;
- respond to support, privacy, safety, and legal requests;
- detect fraud, abuse, unauthorised access, and technical failures;
- measure performance and improve accessibility, reliability, and features;
- comply with law, enforce our terms, and establish or defend legal claims; and
- send marketing only where permitted and with any consent required by law.
Our legal basis or equivalent justification depends on your location and the activity. It may include performing our contract with you, your consent, our legitimate interests in operating and securing the Service, compliance with legal obligations, protection of vital interests, or another basis recognised by applicable law. You may withdraw consent at any time, but withdrawal does not affect prior lawful processing.
5. Cookies and similar technologies
The website may use cookies, local storage, pixels, software development kits, or similar technologies for essential sessions, security, preferences, analytics, performance, and—only where allowed—marketing.
Essential technologies may be required for login, security, or requested functionality. Where applicable law requires it, non-essential technologies will not be used until you make a choice. You can manage browser cookies through browser settings and mobile permissions through device settings. Blocking technologies may affect Service functionality.
We do not permit third-party advertising cookies merely because a visitor opens an external link. A third-party site you visit may apply its own technologies under its own policy.
6. When we disclose information
We may disclose only the information reasonably necessary to the following categories:
- Route recipients: people with whom you choose to share a Custom Route;
- Mapping and location providers: to display maps, match route geometry, and provide navigation;
- Cloud and technical providers: for hosting, storage, databases, security, monitoring, and support;
- Authentication providers: when you use social sign-in;
- Application stores and payment providers: to process and verify subscriptions and transactions;
- Communication providers: to deliver email, support responses, and push notifications;
- Professional advisers and authorities: when reasonably necessary for legal, audit, insurance, safety, fraud-prevention, or compliance purposes;
- Business transaction recipients: in a proposed or completed merger, financing, reorganisation, sale, or transfer, subject to appropriate safeguards; and
- Other parties: when you direct us, consent, or disclosure is otherwise permitted or required by law.
We do not sell personal information for money. If a privacy law defines “sale,” “sharing,” or targeted advertising more broadly, we will provide any legally required notice and opt-out mechanism before engaging in that activity.
7. International data transfers
DriveToPass is intended for users in multiple countries. We and our providers may process information in countries other than the one where you live. Those countries may have different privacy laws.
Where required, we use recognised safeguards for international transfers, such as adequacy decisions, approved contractual clauses, data-transfer agreements, certifications, or legally permitted exceptions. The final production policy must identify the actual primary hosting regions and applicable transfer mechanisms.
8. How long we retain information
We retain information only for as long as reasonably necessary for the purposes described, including providing the Service, maintaining security, complying with tax or accounting duties, resolving disputes, and enforcing agreements.
Retention periods vary by data type. Account and Custom Route information is generally retained while the account or route remains active. Subscription records may be retained for legally required financial periods. Security logs and backups may remain for limited operational cycles. We may retain information longer where required by law, a legal hold, safety, fraud prevention, or a dispute.
When information is no longer required, we delete, anonymise, or securely isolate it. Deletion from active systems may not immediately remove copies from backups. Information shared with another person or exported outside the Service may remain with that recipient.
9. Information security
We use reasonable administrative, technical, and organisational measures designed to protect personal information, such as access restrictions, authentication controls, encryption where appropriate, logging, backups, and service-provider review.
No online service, wireless transmission, device, or storage system is completely secure. We cannot guarantee absolute security. You should use a strong unique password, protect your device, install updates, and tell us promptly about suspected unauthorised access.
10. Your privacy rights and choices
Depending on your country or region, you may have rights to:
- know whether and how we process personal information;
- access or receive a copy of your information;
- correct inaccurate or incomplete information;
- delete information or your account;
- restrict or object to certain processing;
- withdraw consent;
- receive portable information in an appropriate format;
- opt out of marketing, targeted advertising, sale, or sharing where applicable;
- appeal a privacy-request decision; and
- complain to a privacy or data-protection authority.
These rights may be subject to lawful exceptions. We may ask for information needed to verify your identity and authority. We will not unlawfully discriminate against you for exercising a privacy right. We do not charge for ordinary requests, but applicable law may allow a reasonable charge or refusal for manifestly unfounded, excessive, or repetitive requests.
You can manage location and notification permissions through device settings, unsubscribe from marketing using the provided link, and manage Custom Routes and sharing through available account controls.
11. Children and learner drivers
Driving ages and digital-consent ages vary internationally. The Service is not directed to children who are below the minimum age to use an online service independently in their location. Where required, a parent or guardian must approve the account and supervise use.
If we learn that personal information was collected from a child without required permission, we will take reasonable steps to delete it. A parent or guardian may contact us about a child’s information.
12. Third-party links and services
The Service may link to third-party websites or open external services. Their privacy practices are controlled by them, not DriveToPass. Review their policies before providing personal information.
13. Changes to this policy
We may update this policy when our Service, providers, legal requirements, or processing practices change. We will publish the updated version and revise the date above. Where required, we will provide additional notice or request consent for material changes.
14. Contact and complaints
Submit privacy questions or requests through our Contact page. Before launch, this section must include the DriveToPass legal entity name, postal address, dedicated privacy email, and—where applicable—the details of its data-protection officer, local representative, and relevant supervisory authority.
If you are not satisfied with our response, you may have the right to contact the privacy or data-protection authority in your country or region.