DrivePrep Book← Back to site

Privacy Policy

DrivePrep Book is scheduling software for driving schools. This policy explains what we collect, why, and who else touches it. It covers book.driveprep.eu only.

The controller is Individual Entrepreneur Danyil Klymenko (ФОП Клименко Даниїл Олександрович), 4 Vysotskoho St., apt. 18, Dnipro, 49033, Ukraine, Tax ID (RNOKPP) 3753002970.Contact: info@driveprep.eu, or +40 750 198 160.

Two kinds of people, two different roles

This distinction decides who is responsible for what, so it comes first.

  • Driving schools are our customers. For their account and billing data we are the controller.
  • Instructors and students are added by their school. For their data we are a processor acting on that school's instructions. If you are a student, your school decides what is held about you — ask them first, and we will support them in answering you.

What we collect

  • Everyone signing in: email address, and a short-lived one-time code. We store a hash of the code, never the code itself.
  • Schools: school name, country, city and map coordinates, timezone, the administrator's email and a password hash.
  • Instructors: name, email, optional phone, the licence categories they teach.
  • Students: name, email, optional phone, licence category, the balance of paid hours and its full history, and their bookings.
  • Technical: IP address and user agent, kept to rate-limit sign-in attempts and to secure sessions. Your IP address and user agent are also processed — transiently, and not stored — by our analytics and performance measurement; see “Who else processes it” below.

When a lesson is booked, the student and the instructor can each see the other's name, and their phone number if they have given one, from the moment of booking until a day after the lesson ends — so the two of them can find each other at the meeting point. The number is not shown on a cancelled lesson, and not for anyone your school has removed.

We do not collect payment card details. We never see them — see Terms.

Why we are allowed to hold it

  • Performance of a contract — running the school's account and its bookings.
  • Legitimate interests — keeping the service secure, preventing abuse of sign-in, keeping an audit trail of changes to a student's hour balance, and measuring aggregate use and page performance of the site so we can improve it.
  • Consent — WhatsApp reminders, which are off unless a student opts in explicitly; and website analytics by DataFast, which does not run until you allow it. Both can be withdrawn at any time.
  • Legal obligation — tax and accounting records for purchases.

Who else processes it

These are the only third parties that receive personal data.

  • Paddle.com Market Ltd — payments. Paddle is the Merchant of Record and an independent controller for the purchase itself; card details go to Paddle and never to us.
  • Resend — transactional email (sign-in codes, booking confirmations, reminders, calendar invitations).
  • Railway — hosting for the application server and the database. This is where your account, your bookings and the hour ledger actually live.
  • yourgood.app — the support widget, which loads on the public site and the school admin area. It is deliberately not loaded on the student booking pages.
  • 360dialog / Meta — WhatsApp reminders. Only if a school buys the add-on and a student opts in. Off by default.
  • OpenFreeMap — map tiles. Address lookups are proxied through our own servers, so the geocoder never receives your IP address.
  • DataFast (JustShipIt Pte. Ltd., Singapore) — website analytics, only if you allow it in the prompt shown on your first visit. Until you do, its script is not loaded at all. Once allowed, it records which pages are visited and where visitors arrive from, on every page of this site including the student booking pages. It sets no cookie. It keeps a visit identifier and a visitor identifier in your browser's session storage, which are deleted when you close the tab, and reads one setting from local storage that lets a visitor switch it off. It processes your IP address and user agent, from which it derives a visitor hash that changes every 24 hours. DataFast states that most of its infrastructure is outside the EEA, including in the United States.
  • Vercel Inc. — two separate things, so we list them separately.
    • Hosting for the website you are reading. Every page of book.driveprep.eu is served from Vercel's network, so every request you make to this site reaches Vercel first, carrying your IP address and user agent the way any web request does. Vercel keeps short-lived operational logs of those requests. It does not hold your account data — that is on Railway, above.
    • Vercel Web Analytics and Vercel Speed Insights — aggregate page-view counts and page-loading measurements, so we can see which parts of the product are used and where they are slow. They run on every page of this site, including the student booking pages. Neither sets a cookie, neither reads or writes anything on your device, and neither tracks you across other sites. They do process your IP address and user agent: Vercel uses them in the moment of the request to derive coarse information — country, device type, and a hash that lets one visitor be counted once per day — and documents that the IP address itself is not retained afterwards. The raw IP is never visible to us; what reaches us is counts, not people.

We do not sell personal data, and we do not use it for advertising or profiling.

Where it is stored

The data itself — accounts, bookings, the hour ledger, everything under “What we collect” — is stored in the Netherlands (Amsterdam), within the EEA. That is the Railway application server and database, and it does not move.

Serving the website is a separate matter, and we would rather be exact about it than tidy. book.driveprep.eu is delivered from Vercel's global edge network, so the request that loads a page is answered at whichever of Vercel's locations is nearest to you. For visitors in Europe that is normally a European one, but we do not choose it and cannot promise it. Those requests, the short-lived logs Vercel keeps of them, and the analytics and performance data described above are processed by Vercel Inc., which is established in the United States.

If you allow analytics, DataFast's data is processed by JustShipIt Pte. Ltd., established in Singapore, on infrastructure that is mostly outside the EEA, including in the United States.

Some processors above therefore operate outside the EEA; those transfers rely on Standard Contractual Clauses or an adequacy decision.

How long we keep it

  • One-time sign-in codes: 10 minutes.
  • Sessions: 30 days, or until sign-out.
  • Bookings and the hour ledger: for as long as the school's account is open. The ledger is append-only by design — corrections are added as new entries rather than by editing history, because a balance nobody can audit is worse than one that shows its workings.
  • After a school closes its account: deleted within 90 days, except records we are required to keep for tax purposes.

Your rights

Under the GDPR you may request access, correction, erasure, restriction, portability, or object to processing. Write to info@driveprep.eu. If you are a student or instructor, contact your driving school first — we act on their instructions and will help them respond.

Getting a copy of your data. Your driving school can download it for you from your profile in their admin area: your details, your lessons and every movement of your prepaid hours, as spreadsheet files. It covers you and nobody else. Ask your school — the button is on the page where they already manage your account, so this is not a request that has to go anywhere or wait for us.

A school can also export its own records in the same way, which is how it moves to another system or keeps a copy of its own accounts.

You may also complain to your national data protection authority.

Cookies

We use no advertising cookies and no analytics cookies. Vercel's analytics and performance measurement writes nothing to your device and reads nothing from it. DataFast analytics runs only if you allow it, and then keeps two identifiers in session storage for the length of your visit, as described above. Your answer to that question is remembered in local storage as dp_analytics_consent. Your session token is kept in local storage so you stay signed in, and a dp_locale cookie remembers which language you chose; clearing site data signs you out.

That is why the only prompt you see here is about analytics. Everything else we store on your device is strictly necessary for the site to work and needs no permission; DataFast's identifiers are not, so DataFast waits for yours. The IP-address processing by Vercel's measurement is covered by legitimate interests, described above — you can object to it by writing to us.

You can give or withdraw consent for DataFast analytics here at any time:

Changes

If we change this policy materially we will email account administrators before it takes effect.