Privacy Policy

1. Data Controller

The data controller for personal data processed through the Driving.lt platform is the Driving.lt platform (beta release). All GDPR-related questions and requests can be sent by email to info@driving.lt. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the laws of the Republic of Lithuania.

1.1. Joint and Independent Controllers

Driving.lt acts as a data controller only for the data it collects and processes directly, namely: account and authentication data, booking and lesson metadata, payment metadata (excluding card details), and transactional and marketing email.

Driving schools you contract with through the platform act as independent data controllers for the following data: identity documents you upload to them, enrollment records, lesson notes, attendance logs, and any other documents the school stores in its own systems to comply with regulatory requirements.

To exercise your GDPR rights with respect to data held by a school, contact the school directly using the contact details shown in your account or in your contract with that school. Driving.lt can assist with forwarding the request but is not the controller of that data.

2. Personal Data We Collect

We collect and process the following categories of personal data depending on your role (student, instructor, or driving school):

• Full name
• Email address
• Date of birth
• Personal identification number (asmens kodas) — required for driving school enrollment records
• Residential address
• Phone number
• Profile photographs
• Uploaded documents (identity document scans, passport copies)
• Booking and lesson history
• Payment information (processed securely by Stripe; we do not store card details)
• Digitally signed contracts and agreements

3. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR): Processing is necessary to provide our marketplace services, including account management, booking, payment processing, and communication between students, instructors, and driving schools.
• Legal obligation (Art. 6(1)(c) GDPR): Driving schools are required by Lithuanian law to maintain student records, including personal identification numbers and lesson completion data. We process this data to enable compliance with these regulatory requirements.
• Legitimate interest (Art. 6(1)(f) GDPR): We process certain data for platform security, fraud prevention, service improvement, and communication about service-related matters.

4. Data Processors and Transfers

We share your personal data with the following third-party service providers who act as data processors on our behalf:

• Stripe — Payment processing (EU-based infrastructure, PCI DSS certified)
• Neon (PostgreSQL) — Database hosting (data stored within the EU)
• Vercel — Application hosting and file storage
• Resend — Transactional email delivery

5. Data Retention

• Account data is retained for as long as your account remains active. Upon account deletion, personal data is erased within 30 days, except where retention is required by law.
• Booking and payment records are retained for 7 years after the last transaction in accordance with Lithuanian tax and accounting legislation.
• Uploaded documents (ID scans, passport copies) are deleted upon account deletion or upon your request.

6. Your Rights

Under the GDPR, you have the following rights with respect to your personal data:

• Right of access — obtain a copy of the personal data we hold about you
• Right to rectification — correct any inaccurate personal data
• Right to erasure — request deletion of your personal data, subject to legal retention requirements
• Right to data portability — receive your data in a structured, machine-readable format
• Right to restriction — request that we limit processing of your data in certain circumstances
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us at info@driving.lt. We will respond to your request within 30 days. If you believe your data protection rights have been violated, you have the right to lodge a complaint with the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija, VDAI).

7. Cookies

Our platform uses cookies to ensure proper functionality. For detailed information about the cookies we use, please refer to our Cookie Policy page.

8. Contact

For any questions regarding this privacy policy or the processing of your personal data, please contact us at info@driving.lt.