Privacy Notice

1. Who we are

Onyx Driving is a driving instruction service operated by Fahim Nazir, principal instructor, based in Bradford, UK. This notice explains what data we collect from you and how we use it.

Contact for data questions: hello@onyxdrivingschool.co.uk or WhatsApp +44 7954 726531.

2. What data we collect

When you submit a booking enquiry via our website, we collect:

• Your first name (so we can address you properly)
• Your phone number (so we can reach you if WhatsApp doesn't open)
• Your postcode (so we can route you to the right instructor)
• Your preferred language (English, Urdu, Punjabi, Mirpuri, or others)
• Your instructor preference (male / female / no preference)
• Your driving experience level
• Your preferred lesson times (if you give them)
• Any notes you choose to share
• Which page of this site you were on when you clicked through to the form, and — if another site sent you here — that site's name only (for example "google.com"), never the page you were reading on it

We do not store payment details ourselves. When you buy a package (Block of 10 or Intensive), payment is processed by Stripe — Stripe collects and stores your card details, name, email, phone and postcode securely, and gives us only the non-sensitive details we need to schedule your first lesson. We never see or store your card number. Stripe is PCI-DSS certified and is the same payment processor used by Amazon, Shopify, Uber and most major UK businesses.

We do not ask for: full address, date of birth, ethnicity, or any special-category data such as health or disability information.

The forms do include free-text boxes ("Anything else?" on the booking form, "Why Onyx" on the instructor application). Whatever you type there is stored as written. Some people choose to mention a health condition, a disability or an anxiety that affects their learning — that is genuinely useful for us to know, and it is fine to tell us. Please only share what you want on record, and if you would rather discuss something sensitive in person or on WhatsApp instead of typing it into the form, do that. You can ask us to delete anything you have written at any time (section 6).

Pay-as-you-go lessons are paid in cash or bank transfer to Fahim directly at the end of each lesson — no card data involved on either side.

When you send the enquiry on to us via WhatsApp, your number is also visible to us through WhatsApp's standard functionality.

If you apply to join Onyx as an instructor instead, the application form collects your name, phone number and email, your ADI grade or trainee status, years instructing, hours available, the languages you teach in, whether you teach manual or automatic, whether you are a female instructor (asked because there is high learner demand for one and it is optional to answer), the areas you can cover, whether you are currently in another franchise, why you want to join, and how you heard about us. All of it is used only to consider and respond to your application.

3. How we use it

Only to respond to your booking enquiry — match you to an instructor, agree a time and location, and arrange your lesson. We use the same data later to send lesson reminders, follow up on test results, and ask for a review if your test goes well.

Our lawful basis (UK GDPR Article 6): we handle your enquiry and booking details to take steps at your request before entering a contract, and to carry out that contract once your lessons begin (Article 6(1)(b)). Where we later contact you for an optional review or follow-up beyond your lessons, we rely on our legitimate interests (Article 6(1)(f)), and you can opt out at any time.

We also record which page of this site you were on when you clicked through to the form, and which site referred you, so we can tell which parts of this site are actually useful and write more of what helps. Our lawful basis for this is our legitimate interests (Article 6(1)(f)) in understanding which of our own pages answer people's questions. It is stored next to your enquiry, used for nothing else, and never combined with data from anywhere else. Tell us and we will strip it from your record — it makes no difference to your booking. We do this by passing the page name in the link you click; nothing is stored on your device — no cookie, no tracking pixel, and no consent banner, because there is nothing to consent to.

We do not sell, share, or rent your data to third parties. We do not run advertising trackers on this website, we set no advertising cookies, and nothing you do here is shared with an ad network. We do not use your data to build profiles for marketing.

4. Where it goes (and who processes it)

The booking and instructor-application forms do two things when you press submit. They open WhatsApp with your details pre-filled so you can send them straight to your instructor — that data travels through Meta's WhatsApp infrastructure, and WhatsApp's own privacy notice applies in addition to ours. At the same time, the same details are sent to our own website function and stored in Airtable, so an enquiry isn't lost if WhatsApp fails to open or you close the tab.

To run this site and process bookings we use a small number of trusted providers ("data processors"). Some of them are based in, or process data in, the United States:

• Vercel — website hosting and the booking / AI functions (US company; may process data in the US).
• Stripe — card payments for packages (processes data in the US and elsewhere; PCI-DSS certified).
• Anthropic — powers the optional AI theory tutor (US; receives only the public question text, never your personal data).
• Namecheap — our domain registrar; their email forwarding handles mail sent to our hello@ address (US company).
• Airtable — stores your booking or application details. This happens every time you submit the form, not only if something goes wrong (US company; may process data in the US).

Where your data is transferred outside the UK, it is protected by the UK's recognised safeguards for international transfers (such as the UK extension to the EU–US Data Privacy Framework and/or the standard contractual clauses these providers operate). Beyond these processors, we do not sell, send, or store your personal data outside the UK ourselves.

5. How long we keep it

WhatsApp message history is retained on the instructor's phone for as long as needed to provide the service — usually until your lessons are complete. After that, you may ask us to delete the message history at any time and we will do so within 7 days.

For active learners, we keep your details for the duration of your lessons + 6 months (so we can respond to any follow-up questions or test re-bookings). After that, your contact details are deleted.

Form submissions stored in Airtable are kept to these limits:

• Enquiries that don't become lessons — deleted after 12 months.
• Learners who do book — as above: duration of lessons + 6 months.
• Instructor applications — deleted after 12 months if we don't take it forward. If you join Onyx, your application is kept for the length of the agreement + 12 months.

These are deletions we carry out by hand rather than automatically, so if you want yours removed sooner, just ask — see section 6. We would rather you asked than assumed.

One honest caveat: records we are legally required to keep — for example, payment and tax records held by Stripe — are retained for as long as the law requires, even after a deletion request. Everything within our own control, we will delete on request.

6. Your rights (UK GDPR)

You have the right to:

• Access the data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Request your data in a portable format
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these, email or WhatsApp us at the contact details above. We respond within 30 days as required by UK GDPR — usually much sooner.

7. The AI theory tutor

Our optional AI tutor sends the specific theory question text you're viewing to Anthropic's Claude API, which generates an explanation. No personally identifying information is transmitted — only the public theory question and the standard explanation. Anthropic's privacy policy applies to that interaction.

8. Card payments via Stripe

If you buy a Block of 10 lessons or an Intensive 20-hour course via the website, your card payment is handled by Stripe. Stripe is the data controller for card data — they encrypt and store it; we never see your card number.

After successful payment, Stripe sends us a notification containing your name, email, phone number and postcode (which you enter at their checkout). We use those to contact you and schedule your first lesson — same as if you'd booked via WhatsApp. Stripe also emails you a receipt automatically.

For refunds: refunds on unused block-of-10 hours follow our Terms (7 days written notice) and are issued back to the original card via Stripe within 14 days. You can also ask Stripe to delete your stored payment method at any time via their own account.

9. Changes to this notice

If we make material changes, we'll update the "last updated" date at the top of this page. Significant changes (e.g., adding payment processing or analytics) will be notified by a banner on the site for at least 30 days.