Privacy policy

Who we are and our role

TUZO HQ is software that driving schools use to run their business. It is provided by TUZO HQ LTD (“TUZO”, “we”, “us”), registered in England and Wales with company number 17444620. Our registered office is 82a, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. ICO registration number: ZC282632.

For learners', parents' and enquirers' details, the driving school is the controller and TUZO processes them on the school's behalf. For school staff accounts and billing, TUZO is the controller.

What we collect

• Account details: name, email address and sign-in records.
• Learner records: contact details, date of birth where needed, licence details, lessons, progress, test results, availability and pickup address.
• Parents and guardians: name, relationship, contact details and messages.
• A school’s record of a learner’s photograph and publicity choices (what was agreed, where, when, and any withdrawal). TUZO HQ does not store the photographs themselves.
• Enquiries made to a school.
• Payments and receipts. Card and bank details are taken by the school’s payment provider and are never stored by TUZO.
• Messages from Facebook Messenger, Instagram and WhatsApp sent to a school’s connected accounts: the sender’s name and platform id or phone number, the message text, and delivery and read status.
• Vehicle and compliance records for instructors.
• Device push tokens, so the app can send notifications.

How we use it

• Running lessons, bookings, progress and payments.
• Sending the messages and reminders a school chooses to send.
• Keeping the service secure.
• Giving support.

We do not sell personal data and we do not use it for advertising.

Messaging channels

When a school connects its Facebook Page, Instagram account or WhatsApp number, messages people send to it are received through Meta's platform and shown to that school's staff in TUZO. Replies are sent through Meta.

Message contents are stored encrypted. Raw notifications from Meta are deleted within 7 days. A school can disconnect at any time.

Who we share it with

We use these processors, and each receives only what it needs.

• Hetzner: hosting, in the EU.
• Cloudflare R2: encrypted backups.
• Resend: email.
• The SMS Works: text messages.
• Meta (Messenger, Instagram and WhatsApp): only when a school connects them.
• The school’s own payment providers.

The full list of the providers we use, what each does and where it is, is on our Sub-processors page.

Security

• Contact details are encrypted at rest.
• Access is limited by role.
• Backups are encrypted and are kept for up to 400 days.
• If a backup ever has to be restored, everyone who has been erased since it was taken is erased again before anyone can use the service.

How long we keep it

• For as long as the school keeps the record or account, unless one of the rules below removes it sooner.
• Learners: a learner with no meaningful activity for 24 months is anonymised automatically. The period is the same for every school, and being marked Active does not prevent it. Lessons and bookings that have taken place, test results, payments, messages the learner or their parent or guardian sent, and a cancellation by the learner all count as activity. Signing in, editing a record and messages sent automatically or by staff do not. The school’s administrators are told at least 30 days before, and nothing is done if the learner is active again or the school asks us to hold the record. We do this on the school’s instructions and it does not need a person to approve each one.
• Housekeeping runs once a month, on the third Tuesday at 02:30 London time. A learner is warned once they have had no activity for 23 months, and is anonymised at 24 months only if the warning was given at least 30 days earlier; otherwise it happens at a later monthly run. Third Tuesdays are 28 or 35 days apart, so a learner may remain slightly longer than 24 months. A small daily task only keeps the list of erased people up to date, ends holds that have expired and sends the reminder that a hold is about to end.
• Housekeeping does not go ahead while there is a lesson or test still to come, money owing, prepaid hours left, an open or disputed payment, funded training that has not ended, an open privacy request, a hold placed by the school, an open photograph review, a record that does not add up, or no administrator to warn. If one of these ends, the learner is warned again, with a fresh 30 days.
• Separately, a school’s staff see an amber reminder on a learner who has had no completed lesson for 8 weeks (or no first lesson since they were added). It is only a prompt for the school to ask whether the learner still wants lessons. It sends nothing to the learner, and it does not change when a record is anonymised or stop it.
• What housekeeping removes: the learner’s contact details, licence details, notes, availability and login, the text of their messages, their WhatsApp, Messenger and Instagram conversations, and their skill ratings and reflections. What stays: the learner’s record under the name “Former learner” and a number, lessons and bookings as dated records without notes, and the school’s financial records in full, because the law requires the school to keep them.
• A school’s administrator can place a hold on a learner’s record for a stated reason, such as a complaint, a dispute, an incident, a safeguarding matter or a legal obligation. A hold needs a reason, lasts no more than 12 months, the administrator is reminded 14 days before it ends, and it can be renewed only with a new reason and date. When it ends it no longer prevents housekeeping, which carries on with a fresh warning.
• A parent’s or guardian’s access to a learner ends when the learner is anonymised. A parent’s or guardian’s own login is closed automatically in the monthly run when no linked learner remains. It is kept if another learner is still linked, and a login that also has another role keeps that role. The consent, financial and audit records are kept.
• When a school’s subscription ends, or its account becomes inactive at the end of a free trial, its records are kept for 90 days, so the school can subscribe again or ask for a copy, and are then deleted. The school’s administrators are emailed at least 14 days before.
• A trainee instructor’s (PDI’s) records are not deleted because their free access or its grace period has ended. They can ask for a copy, or ask for their account to be deleted, as described below.
• Enquiries follow the school’s enquiry retention.
• Meta notifications are deleted within 7 days.
• Backup copies are encrypted and kept for up to 400 days: daily copies for 35 days at most, and one monthly copy for up to 400 days. They are then deleted. We do not edit a backup, so a person who has been erased from the live service leaves the backups as each copy reaches the end of that time.

Your rights

Under UK GDPR you can ask for access to your data, correction, deletion, restriction, to object, and to take your data with you (portability).

We answer within one month. If your request is complicated, or we have had several from you, we may take up to two more months, and we will tell you why within the first month. We will ask you to prove who you are before we give anything out or change anything, and if you ask on behalf of someone else we will ask for their written authority, unless they are a child who cannot decide for themselves.

A copy of your information (access) and a file you can take to another service (portability) are different things: the first is everything we hold about you, in a readable form, and the second is the information you gave us, in a form a computer can read. We will not give you information that identifies someone else unless the law allows it. Files are made available through a link that works for a short time.

Ask your driving school first, or contact TUZO using the details below. You can also complain to the Information Commissioner's Office at ico.org.uk.

Deleting your data

To have your data deleted, ask your driving school, or email [email protected]. This includes messages you sent to a school through Facebook, Instagram or WhatsApp. Tell us your name, and the school and the platform you used, so we can find them.

We will check who you are, then delete or anonymise your records and messages, and tell you when it is done. This takes place within one month of your request. A request is never carried out automatically: a person decides first. Some records must be kept where the law requires it, such as the school's financial records of lessons and payments. Those stay, but we remove what we can from them, and say what we kept and why.

This is separate from the automatic housekeeping of learner records described under “How long we keep it”, which happens without a request after 24 months with no activity (in a monthly run, so a record may remain slightly longer), and at least 30 days after the school's administrators have been warned.

Backup copies are not edited when you ask. They are encrypted and kept for up to 400 days, then deleted, so your information leaves the backups up to 400 days after it leaves the live service. A backup is used only to recover the service. If one is ever restored, we first erase again everyone who has been erased since it was taken, using a list of erased people (numbers and codes, never names or contact details) that is kept outside the database, and the service stays closed until that is done.

Children

Learners can be under 18, and a parent or guardian can be linked to them. From the age of 18 the learner controls guardian access.

For a learner under 16, a linked parent or guardian must authorise a photograph or publicity choice, and may do so before the learner answers. For a learner aged 16 or 17, the learner's own agreement and a parent or guardian's authorisation are both needed, for the same places or fewer. The parent or guardian confirms that they have the authority to give it, and we do not routinely ask for court documents. If an Administrator marks that authority as disputed, the photograph is not used until the school settles it. A choice waiting for authorisation never allows anything to be published. If the learner says No, or withdraws, that always wins.

When a current learner turns 18 we send one birthday email. At their next sign-in they are asked to accept the adult Terms in their own name and to review their photograph choices (they can choose “Not now”). The Terms never depend on a photograph choice, and essential records are not blocked by it. A parent or guardian's access pauses unless the learner agrees to it. A former learner (one who has passed, become inactive, left or been anonymised) is not sent the email, is not asked to accept the Terms again and is not asked to renew a choice. Their existing permissions carry on only for what was originally agreed, subject to withdrawal and the law. A parent or guardian's permission is not authority beyond the original agreement.

Photographs and publicity

A school may ask a learner whether it can use their photograph on its website, on its own social media, in paid advertising or in print. TUZO HQ does not store publicity photographs. It keeps the school's record of the choice: the wording the learner saw and its version, the places agreed, whether their name may be shown, the dates, any withdrawal, and any authorisation by a parent or guardian.

A school may keep using a photograph for the purposes originally authorised unless the permission is withdrawn or another legal restriction applies. It does not need to be renewed each year. A learner can withdraw at any time. That stops any further use. The school is told to review its publications and take reasonable steps to remove the photograph from channels it controls, and the evidence is kept. TUZO HQ cannot remove it from a website, social media or printed material for the school.

When a learner's record is anonymised, this record of the choice is kept separately, with the name encrypted, so the school can show what was agreed. While a permission is authorised and in use the record is kept. It is then kept for six years after the final authorised use or the withdrawal, with justified exceptions, and then removed. The school records the date of the last use in Housekeeping, and an administrator can record a former learner's withdrawal there.

Changes and contact

We will update this page when things change. Questions: [email protected] or call, text or WhatsApp 07466 785266, or write to TUZO HQ LTD, 82a, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE.

The cookies and device storage TUZO HQ uses are listed in our Cookie Policy. Our Terms and Conditions include the Data Processing Agreement under which we process data for schools.