Skip to content

Legal

Privacy Policy

Last updated: July 2026

1. Who we are

TOFU Driving School is a trading name of Azura And Partners Limited, a company registered in England and Wales (company number 16687856), registered office 8d Ashfield Parade, London, N14 5AB. We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise your rights, contact us at hi@tofudriving.com or write to the registered office above.

2. The personal data we collect

From learners and people who enquire, we may collect:

  • Your name, phone number, email address, and postcode or area
  • Your driving licence status and lesson preferences (for example automatic or manual)
  • The content of your enquiry and our correspondence with you
  • Limited website usage data (see our Cookie Policy)

3. Data from instructors, trainees, and franchisees

If you apply to train, teach, or franchise with us, we may additionally collect:

  • ADI/PDI licence and registration details
  • Criminal-records (DBS) information relevant to suitability and safeguarding
  • Insurance and vehicle details
  • Work history and references

4. Health data and criminal-records data

Some information we handle needs extra protection under UK data protection law. Where you tell us about a medical condition, eyesight issue, disability, or medication that could affect driving, that is health data (a "special category" of data), and we process it with your explicit consent for the purpose of arranging safe lessons. You can withdraw that consent, though it may mean we cannot safely arrange lessons.

Where we process DBS or other criminal-records information for instructors, trainees, or franchisees, we do so only as necessary to assess suitability and meet our safeguarding and legal responsibilities, in line with an appropriate-purposes policy as required by the Data Protection Act 2018.

5. Why we use your data, and our legal bases

Under the UK GDPR we must have a lawful basis for using your data. We rely on the following:

  • To respond to your enquiry and introduce you to a suitable instructor - our legitimate interest in answering and handling enquiries, and taking steps at your request before any contract
  • To provide and administer courses, training, or a franchise you buy from us - performance of our contract with you
  • To provide customer support and handle complaints - our legitimate interest in running our services well
  • To send you marketing - your consent, or our legitimate interest in contacting existing customers about similar services, which you can opt out of at any time
  • To keep accounting, tax, and other required records, and to respond to legal requests - compliance with our legal obligations
  • For health data and criminal-records data - the additional conditions described in section 4

6. Children and young people

Learners can start driving lessons before they turn 18. Where we knowingly hold data about someone under 18, we handle it with particular care and collect only what is needed to arrange lessons safely. We do not target marketing at under-18s.

7. Who we share your data with

We do not sell your personal data. We share it only where needed, with:

  • The self-employed, franchised, or trainee instructor we introduce you to, so they can arrange and deliver your lessons
  • Our website and infrastructure providers - DigitalOcean (hosting) and Cloudflare (content delivery, security including anti-bot checks on our forms (Cloudflare Turnstile), and email routing)
  • Our always-on analytics provider, Umami, which is cookieless and does not receive data that identifies you
  • Our optional analytics providers - Google (Google Analytics) and Microsoft (Microsoft Clarity, which records anonymised session replays and heatmaps and masks text and inputs by default) - which load only if you accept and can be declined or withdrawn at any time via the cookie banner
  • Google Maps, when you choose to load a map on an About or test-centre page. Until you make that choice, the map is a local placeholder and sends no request to Google. Once loaded, Google receives technical data such as your IP address, browser and device information, and may use cookies or similar storage according to your Google settings and Google's Privacy Policy
  • Our email provider (Google, via Gmail, which receives mail forwarded to us)
  • Our accountants, insurers, and professional advisers, and regulators or law enforcement where the law requires

8. Where your data is processed

We are based in the UK. Some of our providers (for example Cloudflare, Google and Microsoft) may process data outside the UK. Where they do, we rely on appropriate safeguards recognised under UK data protection law, such as the UK's adequacy regulations or the International Data Transfer Agreement/Addendum, so your data keeps a similar level of protection.

Our website is static and self-hosted. All images and media, including the UK traffic-sign artwork (Crown copyright, reproduced under the Open Government Licence v3.0), AI-generated educational illustrations, and photographs used under the Unsplash License, are served from our own hosting. Google Maps is the only optional third-party content embed, and it contacts Google only after you choose to load it.

9. How we protect your data

We use appropriate technical and organisational measures to keep your data secure, including encrypted connections (HTTPS) on this website and limiting access to those who need it. No system is completely secure, but we take reasonable steps to protect your information and to respond to any incident.

10. How long we keep your data

We keep personal data only as long as we need it. As a guide:

  • Enquiries that do not become customers: up to 2 years
  • Learner and customer records: up to 6 years after our last dealing with you
  • Training and franchise records: up to 6 years
  • Accounting and payment records: 6 years, as tax law requires
  • Marketing data: until you unsubscribe or ask us to stop

11. Automated decisions

We do not make decisions about you using solely automated processing that produce legal or similarly significant effects.

12. Your rights

Under UK data protection law you have the right to:

  • Be informed about how we use your data (this policy)
  • Access a copy of your data and have inaccurate data corrected
  • Ask us to erase your data or restrict how we use it
  • Object to certain processing, including direct marketing
  • Ask us to transfer your data (data portability) where that right applies
  • Withdraw consent at any time where we rely on consent

13. How to complain

Please contact us first at hi@tofudriving.com so we can help. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.

14. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always published here with the date it was last updated.