Legal
Privacy Policy
How we collect, use, store, and protect your personal data.
Last updated: 15 September 2026 · Version 2.1
1. Who we are
PassReady is operated by StagHill Software Ltd (company number 16878671), a company registered in England, based in Sudbury, Suffolk. We are the data controller for personal data processed through the PassReady platform at passready.co.uk.
ICO registration number: ZC110096
If you have any questions about this policy or your data, contact us at hello@staghillsoftware.co.uk.
2. What data we collect
We collect the following personal data depending on how you use PassReady:
Instructor accounts
- Full name and email address
- Phone number
- Business information (ADI badge number, areas covered, pricing)
- Vehicle data (make, model, year, MOT/tax/insurance expiry dates)
- Payment information processed via Stripe (we never see your full card or bank details)
- Expense and income records
- Receipt photographs uploaded by the instructor (stored in Firebase Storage, compressed to JPEG format)
- Photos of your paper diary, if you choose to send them so we can add your pupils for you. These can include your pupils' names and phone numbers. They are stored privately in Firebase Storage, used only to set up your account, and deleted after 60 days.
- How you use the app: which screens you open, in what order, and how long for, plus any errors the app hits. We use this to find and fix the parts that don't work.
Student accounts
- Full name and email address
- Phone number
- Pickup postcode and address
- Provisional licence details
- Lesson booking history and progress data
- Payment information processed via Stripe
- Test date and test centre
- How you use the app: which screens you open, in what order, and how long for, plus any errors the app hits. We use this to find and fix the parts that don't work.
Waitlist signups
- Name, email address, and teaching area
3. Why we collect your data
We use your data for the following purposes:
- Service delivery — to operate the booking platform, connect instructors with students, and process lessons
- Booking management — to schedule lessons, manage cancellations, and track progress
- Payment processing — to process payments through Stripe and manage refunds
- Email notifications — to send booking confirmations, lesson reminders, cancellation notices, and account-related emails via Brevo
- Dispute resolution — to investigate and resolve payment disputes and chargebacks
- Fraud prevention — to identify and prevent fraudulent activity, including maintaining records of banned accounts
- Legal obligations — to retain financial records as required by HMRC
- Platform improvement — to understand how the platform is used and improve it
4. Legal basis for processing
Under UK GDPR, we process your data on the following legal bases:
| Purpose |
Legal basis |
| Operating the platform for instructors and students |
Contract performance (Article 6(1)(b)) |
| Processing payments via Stripe |
Contract performance (Article 6(1)(b)) |
| Sending transactional emails (reminders, confirmations) |
Contract performance (Article 6(1)(b)) |
| Retaining financial records for HMRC |
Legal obligation (Article 6(1)(c)) |
| Retaining dispute and chargeback records |
Legal obligation (Article 6(1)(c)) |
| Fraud prevention (banned account records) |
Legitimate interest (Article 6(1)(f)) |
| Platform analytics and improvement |
Legitimate interest (Article 6(1)(f)) |
| Marketing communications |
Consent (Article 6(1)(a)) |
5. How we use Stripe
All payments on PassReady are processed by Stripe, a PCI Level 1 certified payment processor. This is the highest level of payment security certification available.
When you make a payment or set up a Stripe Connect account:
- Your card details are entered directly into Stripe's secure payment form
- We never see, store, or have access to your full card number, CVV, or bank details
- Stripe processes the payment and sends us only a confirmation with a transaction reference
- Stripe may store your payment details under their own privacy policy
For more information, see Stripe's Privacy Policy.
6. Data sharing and sub-processors
We share your data only with the following third parties, and only as necessary to operate the platform:
| Sub-processor |
Purpose |
Data processed |
| Stripe |
Payment processing |
Payment details, transaction data. Stripe acts as an independent data controller for payment data. |
| Firebase / Google Cloud |
Hosting, database, authentication |
All platform data. Google acts as a data processor under their Cloud Data Processing Addendum. |
| Brevo |
Transactional email delivery |
Name, email address, booking details for email content. Brevo acts as a data processor on our behalf. |
We do not:
- Sell your personal data to anyone
- Share your data with third-party marketing companies
- Use your data for advertising purposes
7. International data transfers
Our primary infrastructure runs on Firebase (Google Cloud), EU region. Some data may be processed in other jurisdictions by our sub-processors:
- Stripe processes payment data in accordance with their global privacy framework and is certified under the UK Extension to the EU-US Data Privacy Framework.
- Google Cloud data is stored in the EU region. Google's Cloud Data Processing Addendum includes Standard Contractual Clauses for any transfers outside the UK/EEA.
- Brevo processes email data in the EU.
All transfers are protected by appropriate safeguards as required by UK GDPR.
7a. Google Calendar import (Google user data)
If you choose to connect your Google Calendar to import your existing diary, PassReady requests read-only access to the list of your calendars (the calendar.calendarlist.readonly scope, so you can pick the calendar that holds your lessons) and to the events in the calendar you pick (the calendar.events.readonly scope), for the sole purpose of importing your lessons into your PassReady diary.
PassReady's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:
- We access your calendar events only to perform a one-time import that you initiate — we read event titles and start/end times over a bounded date range to create the matching pupils and lessons.
- The access token is used once at import and then discarded. We do not maintain an ongoing sync and we do not store the raw calendar data beyond the diary entries you import.
- We never sell or transfer this data to third parties, and we never use it for advertising.
- We do not allow any human to read your calendar data except with your explicit consent, or where required for security or to comply with the law.
- You can revoke PassReady's access at any time from your Google Account permissions.
8. Data retention
- Active accounts — your data is retained for as long as your account is active
- Inactive accounts — if your account has been inactive for 2 years, we will delete your personal data
- Financial records — transaction records, invoices, expense data, and receipt photographs are retained for 6 years after the relevant tax year, as required by HMRC. Receipt photos are stored in Firebase Storage (Google Cloud) and are scoped to the instructor's account
- Diary photos — photos of a paper diary sent so we can add your pupils are deleted 60 days after they arrive
- Dispute and chargeback records — retained for 6 years from the date of the dispute, as required for financial record-keeping under UK law
- Banned user data — where an account has been banned for fraudulent activity, we retain enough data (name, email, payment identifiers) to prevent re-registration. This is processed under legitimate interest (Article 6(1)(f) UK GDPR) and is retained indefinitely for fraud prevention purposes
- Account deletion — you can request immediate deletion of your account and data at any time (see Section 9), subject to the retention periods above
9. Your rights
Under UK GDPR, you have the following rights:
- Right of access — request a copy of all personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data (subject to legal retention requirements)
- Right to restriction — request that we limit how we process your data
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest
You can exercise your rights directly through the PassReady platform (account settings include data export and account deletion), or by emailing hello@staghillsoftware.co.uk.
We will respond to all data rights requests within 30 days. Data exports requested by email will be provided within 14 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
10. Under 18s
PassReady may be used by students under the age of 18 (learner drivers can start lessons from age 17). Where a student is under 18:
- Under-18 students are encouraged to have a parent or guardian involved in the booking process
- The student controls whether their progress data is shared with parents or guardians
- We collect only the minimum data necessary to operate the booking service
- We do not knowingly collect data from children under the age of 13. The minimum age to hold a provisional driving licence in the UK is 16 (for PIP recipients) or 17
11. Cookies and local storage
PassReady uses only essential cookies required for the platform to function:
- Firebase Auth session cookie — keeps you logged in. This is strictly necessary and does not require consent under UK GDPR.
We do not use:
- Google Analytics or any analytics cookies
- Facebook Pixel or any advertising cookies
- Any third-party marketing or tracking cookies
For full details, see our Cookie Policy.
12. Data Protection Officer
StagHill Software Ltd is a small organisation that does not carry out large-scale systematic monitoring of individuals or large-scale processing of special category data. We are therefore not required to appoint a Data Protection Officer (DPO) under Article 37 of UK GDPR.
For all data protection enquiries, contact: hello@staghillsoftware.co.uk
13. Data Protection Impact Assessments
We have conducted Data Protection Impact Assessments (DPIAs) for data processing activities that may present a high risk to individuals, including the processing of location data (postcodes), financial transaction data, and data relating to under-18 users. These assessments are reviewed periodically and are available for inspection by the ICO on request.
14. Data controller
The data controller for PassReady is:
StagHill Software Ltd
Company number: 16878671
Sudbury, Suffolk
ICO registration: ZC110096
Email: hello@staghillsoftware.co.uk
Website: passready.co.uk
15. Changes to this policy
We may update this privacy policy from time to time. If we make significant changes, we will notify you by email or through a notice on the platform. The "last updated" date at the top of this page will always reflect the most recent version.
16. Contact
If you have any questions about this privacy policy, your data, or your rights, contact us at:
StagHill Software Ltd
Company number: 16878671
Sudbury, Suffolk
hello@staghillsoftware.co.uk