Privacy Policy

1. What we collect

Identity and contact details: first and last name, date of birth, gender, nationality; identity card, passport or immigration (residence) number; mother's and father's name; occupation; phone, email and address; an optional profile photo.

Documents: the identity card, passport, photograph, medical report, residence document, application form and similar files uploaded for the licence application, either by the school or by you through the portal (PDF, JPG, PNG or WebP, up to 10 MB).

Training records: your lesson schedule and attendance (completed, cancelled, no-show), the instructor's end-of-lesson evaluation, topic progress, exam dates and results, learner licence issue and expiry dates, lesson rights and remaining lessons, and the school's notes about you.

Payment records: your payment plan, instalment amounts and due dates, payment status and the payment proofs you upload. We do not collect card details; payments are made by bank transfer to the school's IBAN shown to you.

Account and activity records: the email address and last sign-in time of your portal account, and an audit log that records who changed which record and when. Audit entries also include the IP address and browser of the user who made the change.

2. Where the data comes from

Most information is given by you at enrolment and entered by school staff. With a portal account you can update your own email, phone and address, upload documents and payment proofs, and request lessons.

Lesson, exam and payment records are created by school staff and instructors during your training.

3. Why we process it

To plan and deliver your training and manage the schedule, instructor and vehicle assignments.

To prepare your exam and driving licence applications and submit them to the relevant TRNC authorities, and to track the validity of your learner licence.

To track your payment plan and instalments and verify your payment proofs.

To send service notifications: in-portal notifications and, where the school has enabled them, emails (lesson scheduled, cancelled or rescheduled; request accepted or rejected; instalment paid; enrolment status changed).

To keep the system secure, detect errors and make every change to your records auditable.

4. Where the data is kept and which providers we use

The application server and database are hosted on Render in the Frankfurt (Germany) region. The website is served by Vercel.

Authentication is handled by Google Firebase Authentication: your email address and a hash of your password are held by Firebase; your password is never stored in our system.

Documents and photos are stored on Cloudinary. Identity documents, medical reports and payment proofs are kept in a private area and can only be viewed by authorised staff through signed links that expire after one hour. Profile photos are kept at a public address so they can be displayed in the portal and panel.

Email notifications are sent through Resend, technical error reports go to Sentry, and background jobs run through a Redis queue. These providers process your data only to deliver the service and under contractual confidentiality obligations.

Some of these providers (Google, Cloudinary, Vercel, Sentry) may process data outside the European Union. YouTube links in the Resources section open on YouTube's own site, where YouTube's privacy terms apply.

5. Who can access it

School management and administrative staff can access your records within the limits of their role. Sensitive fields such as identity number, address, parents' names and notes are shown only to staff with that permission.

Instructors see your name, schedule and topic progress only for the lessons they teach; they enter the end-of-lesson evaluation and topic status.

The information required for exam and licence procedures is shared with the relevant TRNC authorities.

Your data is never sold, rented or shared with third parties for advertising or marketing.

6. Security

All connections are encrypted (HTTPS). The portal session is kept in a cookie that browser scripts cannot read (httpOnly) and expires after at most five days.

Each user can see and change only what their role allows; student accounts can access only their own records. The school can disable an account at any time.

Every change to a record is written to the audit log with its previous and new values. Server logs never contain passwords, session tokens or identity numbers.

7. Retention and deletion

Your training, exam and payment records are kept by the school without a fixed time limit, until you ask for them to be deleted. This lets you reach your training history and payment records years later.

When you request deletion, or the school deletes a record, it is removed from access and marked as deleted; audit entries are preserved for accountability. Records relating to exam and licence procedures and financial records continue to be kept for as long as regulations require, even after a deletion request.

When your portal account is disabled you can no longer sign in; your records remain with the school as described above.

8. Your rights

You may ask which of your data we process, request a copy, ask for incorrect or incomplete data to be corrected, request deletion to the extent the law allows, and object to processing.

From your portal account you can update your email, phone and address yourself and delete documents that have not yet been verified. For any other request, contact the school.

9. Changes

This policy is updated when the system starts using a new provider or notification channel (for example SMS or WhatsApp). The current version is always published on this page; the date at the top shows the last update.