Privacy Notice

1. Who we are

Onyx Driving is a driving instruction service operated by Fahim Nazir, principal instructor, based in Bradford, UK. This notice explains what data we collect from you and how we use it.

Contact for data questions: hello@onyxdrivingschool.co.uk or WhatsApp +44 7954 726531.

2. What data we collect

When you submit a booking enquiry via our website, we collect:

• Your first name (so we can address you properly)
• Your postcode (so we can route you to the right instructor)
• Your preferred language (English, Urdu, Punjabi, Mirpuri, or others)
• Your instructor preference (male / female / no preference)
• Your driving experience level
• Your preferred lesson times (if you give them)
• Any notes you choose to share

We do not store payment details ourselves. When you buy a package (Block of 10 or Intensive), payment is processed by Stripe — Stripe collects and stores your card details, name, email, phone and postcode securely, and gives us only the non-sensitive details we need to schedule your first lesson. We never see or store your card number. Stripe is PCI-DSS certified and is the same payment processor used by Amazon, Shopify, Uber and most major UK businesses.

We do not collect: full address, date of birth, ethnicity, or any sensitive personal data ourselves.

Pay-as-you-go lessons are paid in cash or bank transfer to Fahim directly at the end of each lesson — no card data involved on either side.

When booking via WhatsApp, your phone number naturally becomes visible to us through WhatsApp's standard functionality — we don't collect or store it separately on our website.

3. How we use it

Only to respond to your booking enquiry — match you to an instructor, agree a time and location, and arrange your lesson. We use the same data later to send lesson reminders, follow up on test results, and ask for a review if your test goes well.

Our lawful basis (UK GDPR Article 6): we handle your enquiry and booking details to take steps at your request before entering a contract, and to carry out that contract once your lessons begin (Article 6(1)(b)). Where we later contact you for an optional review or follow-up beyond your lessons, we rely on our legitimate interests (Article 6(1)(f)), and you can opt out at any time.

We do not sell, share, or rent your data to third parties. We do not run advertising trackers on this website. We do not use your data to build profiles for marketing.

4. Where it goes (and who processes it)

The booking form submits your message via WhatsApp directly to your chosen instructor, so your data travels through Meta's WhatsApp infrastructure — WhatsApp's own privacy notice applies in addition to ours.

To run this site and process bookings we use a small number of trusted providers ("data processors"). Some of them are based in, or process data in, the United States:

• Vercel — website hosting and the booking / AI functions (US company; may process data in the US).
• Stripe — card payments for packages (processes data in the US and elsewhere; PCI-DSS certified).
• Anthropic — powers the optional AI theory tutor (US; receives only the public question text, never your personal data).
• Cloudflare — routes email sent to our hello@ address (US company).

Where your data is transferred outside the UK, it is protected by the UK's recognised safeguards for international transfers (such as the UK extension to the EU–US Data Privacy Framework and/or the standard contractual clauses these providers operate). Beyond these processors, we do not sell, send, or store your personal data outside the UK ourselves.

5. How long we keep it

WhatsApp message history is retained on the instructor's phone for as long as needed to provide the service — usually until your lessons are complete. After that, you may ask us to delete the message history at any time and we will do so within 7 days.

For active learners, we keep your details for the duration of your lessons + 6 months (so we can respond to any follow-up questions or test re-bookings). After that, your contact details are deleted.

One honest caveat: records we are legally required to keep — for example, payment and tax records held by Stripe — are retained for as long as the law requires, even after a deletion request. Everything within our own control, we will delete on request.

6. Your rights (UK GDPR)

You have the right to:

• Access the data we hold about you
• Have inaccurate data corrected
• Ask us to delete your data ("right to be forgotten")
• Restrict or object to certain processing
• Request your data in a portable format
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these, email or WhatsApp us at the contact details above. We respond within 30 days as required by UK GDPR — usually much sooner.

7. The AI theory tutor

Our optional AI tutor sends the specific theory question text you're viewing to Anthropic's Claude API, which generates an explanation. No personally identifying information is transmitted — only the public theory question and the standard explanation. Anthropic's privacy policy applies to that interaction.

8. Card payments via Stripe

If you buy a Block of 10 lessons or an Intensive 20-hour course via the website, your card payment is handled by Stripe. Stripe is the data controller for card data — they encrypt and store it; we never see your card number.

After successful payment, Stripe sends us a notification containing your name, email, phone number and postcode (which you enter at their checkout). We use those to contact you and schedule your first lesson — same as if you'd booked via WhatsApp. Stripe also emails you a receipt automatically.

For refunds: refunds on unused block-of-10 hours follow our Terms (7 days written notice) and are issued back to the original card via Stripe within 14 days. You can also ask Stripe to delete your stored payment method at any time via their own account.

9. Changes to this notice

If we make material changes, we'll update the "last updated" date at the top of this page. Significant changes (e.g., adding payment processing or analytics) will be notified by a banner on the site for at least 30 days.