Privacy & Cookie Policy
How O’Malleys Driving School handles information about website visitors, learners and people who arrange or pay for lessons.
Last updated: 24 August 2026
Tricia O’Malley is the data controller.
O’Malleys Driving School is operated by Tricia O’Malley, known as Trish. She decides how personal information is used for enquiries, bookings, tuition, safety, payments and business administration.
This policy covers information handled through the website and throughout the learner relationship. Privacy questions, requests and complaints can be made using the contact details on this page.
Only what is reasonably needed.
Not every item applies to every visitor or learner.
Contact and availability
- Name and contact details
- Postcode or collection area
- Availability and driving experience
- Messages and contact preferences
Lessons and progress
- Bookings and attendance
- Licence checks and entitlement
- Lesson notes and progress
- Test details and outcomes
- Relevant safety information
Payments and website records
- Payments, refunds and balances
- Invoices and transaction references
- IP address and access times
- Security and technical logs
Health information receives extra protection
A learner may disclose a medical condition, disability or medication effect where it is relevant to safe and lawful driving. This information is collected only when necessary. O’Malleys Driving School will identify both a lawful basis and an additional special-category condition, such as explicit consent where appropriate.
Learners under 18
Some learners may be under 18. Information about a younger learner is handled with particular care and is limited to what is needed for the enquiry, tuition, payment, safety and communication. Where a parent or guardian arranges or pays for lessons, their contact and payment details are treated as their own personal information.
Trish may communicate with both the learner and the person arranging lessons where this is appropriate, while still respecting the learner’s privacy and safeguarding needs.
Each use has a purpose and legal basis.
Enquiries, bookings and tuition
Information is used to answer enquiries, check availability, arrange lessons, provide tuition and communicate about progress or tests. The usual bases are taking steps before a contract, performing the lesson contract and legitimate interests in running a safe, organised service.
Safety and legal responsibilities
Licence, conduct and relevant health information may be used to assess whether tuition can be provided lawfully and safely. The applicable basis may include contract, legal obligation or legitimate interests, together with an appropriate condition for any special-category data.
Payments, records and disputes
Payment and lesson records are used to manage accounts, meet tax or insurance duties, answer complaints and establish or defend legal claims. The usual bases are contract, legal obligation and legitimate interests.
Website operation and security
Limited technical data may be used to deliver, secure and troubleshoot the website. This is normally based on legitimate interests in providing a reliable and secure service.
Where information comes from
Most information comes directly from the learner or from a parent, guardian or other person arranging lessons. It may also come from records the learner shows Trish, communications providers, payment records or basic website security logs.
No sale or automated decision-making
Personal information is not sold or rented. Trish does not use solely automated decision-making or profiling that produces legal or similarly significant effects. Lesson planning and test-readiness judgments are made personally.
Direct marketing
Enquiry and learner details are not currently used for unrelated email or text marketing. If promotional communications are introduced later, the appropriate consent or other lawful permission will be obtained and every message will include a straightforward way to stop them.
Information is shared only where there is a reason.
Technology and communications
Hosting, security, backup, telephone, SMS, WhatsApp and future business-email providers may process limited information when supplying their services.
Payments and advisers
Banks, payment providers, accountants, insurers, legal advisers or IT support may receive information where necessary and subject to appropriate duties.
Authorities and protection
Information may be disclosed where the law requires it, for legal claims or where reasonably necessary to protect someone from serious harm.
External services and international processing
WhatsApp, Google and other external services apply their own privacy terms when you choose to use them. Some providers may process information outside the UK. Where O’Malleys Driving School controls an international transfer, an appropriate UK transfer mechanism or other lawful safeguard will be used.
Security
Reasonable measures include protected accounts and devices, limited access, current software and appropriate sharing methods. No system is completely risk-free. Suspected incidents will be assessed and reported where the law requires.
Information is not kept indefinitely.
Periods are reviewed against the purpose, legal duties, insurance requirements and possible claims.
Enquiries
An unsuccessful or inactive enquiry is normally kept for up to 12 months after the last meaningful contact, unless there is a clear reason to retain it longer.
Tuition and financial records
Lesson and contractual records may normally be kept for up to six years after tuition ends where needed for insurance, contractual records or possible legal claims. Financial records are retained for the period required by tax law, generally at least five years after the relevant Self Assessment filing deadline.
Health and safety information
Reviewed more carefully and removed when no longer needed for active tuition, safety, insurance or a legal claim.
Website logs
Usually kept for a shorter operational period determined by the hosting and security setup, unless an incident requires investigation.
You can ask about information held about you.
The rights available depend on the information, purpose and lawful basis.
Access
Ask for a copy of your personal information.
Correction
Ask for inaccurate or incomplete details to be corrected.
Erasure
Ask for deletion where no overriding reason requires retention.
Restriction
Ask for use of your information to be limited in some circumstances.
Your right to object
You may object to processing based on legitimate interests and may object to direct marketing at any time. You may also withdraw consent at any time where consent is relied upon. Other rights can include data portability and safeguards concerning automated decisions.
Identity may need to be checked before personal information is released. Avoid sending identity documents or detailed health information through an unsecured message unless Trish has agreed a suitable method.
A clear route if something feels wrong.
Contact Trish and explain what happened, which information is involved and what outcome you are seeking.
O’Malleys Driving School will investigate the concern appropriately, keep you informed where necessary and respond without undue delay. Requests relating to formal data-protection rights will normally be answered within one calendar month, subject to the rules that apply.
You also have the right to complain to the Information Commissioner’s Office. It is usually helpful to raise the matter with Trish first so she has an opportunity to resolve it.
The website should not track more than it needs.
What is a cookie?
A cookie is a small piece of information stored on a browser or device. Similar technologies can support security, remember a choice or measure how a website is used.
What does this website intend to use?
At launch, the website is intended to operate without advertising cookies, behavioural profiling or non-essential analytics. WordPress, the hosting platform or security tools may use limited technology needed to deliver, protect or administer the site.
What if analytics or embedded services are added?
Analytics, advertising pixels, maps, video and other third-party tools can add cookies, scripts or similar technologies. Before any are introduced, the site must be reviewed and this policy updated. Prior consent, a clear way to object or another permitted approach will be provided where the law requires it.
Do external links set cookies here?
A normal link to WhatsApp, Google or another service does not itself place that provider’s cookies on this website. The external provider may collect information under its own policy after you follow the link.
How can cookies be controlled?
You can block or delete cookies using browser settings. Blocking essential technology may affect security or functionality. If on-site privacy controls are introduced, they will provide the choices required for the technologies in use.
Why might there be no cookie banner?
A consent banner is not required simply to announce technology that is strictly necessary to provide or secure a service. Because this website is not intended to use advertising or other non-essential tracking at launch, an intrusive banner may not be necessary. If non-essential technologies are added, they will not be activated until the required choice or consent mechanism is available.
Current cookie position
The public website is not intended to use advertising cookies, behavioural profiling or non-essential analytics. Essential technologies may be used where they are needed to provide, protect or administer the website. If that position changes, this section and any required privacy controls will be updated.
Ask Trish directly.
Explain the information or privacy right concerned so it can be handled clearly and securely.