Driving licence information
As part of our driver licensing and compliance services, Drive An Limited uses the Driver and Vehicle Licensing Agency (“DVLA”) Access to Driver Data (“ADD”) service to obtain driving licence information where we have a permitted reason to do so.
Information obtained through ADD may include:
- driving licence status and entitlement;
- licence categories;
- endorsements and penalty points;
- offence and endorsement codes;
- disqualifications and restrictions; and
- other driving licence information made available by DVLA through the ADD service.
We may also process information required to make and evidence an ADD enquiry, including your name, date of birth, driving licence number, Data Protection Declaration, declaration ID, enquiry date and time, purpose of the enquiry, DVLA response reference and compliance outcome.
Why we use your information
We only use DVLA ADD information for the permitted purpose for which it was obtained.
This may include:
- verifying that you hold a valid driving licence;
- confirming your driving entitlement;
- checking endorsements, penalty points and disqualifications;
- assessing driver eligibility;
- supporting taxi and private hire licensing requirements;
- monitoring ongoing driver compliance;
- identifying matters requiring further compliance review; and
- supporting legitimate safeguarding and road-safety requirements.
We do not obtain or use DVLA ADD information for unrelated marketing, advertising or general intelligence-gathering purposes.
DVLA's ADD guidance requires DVLA data to be used only for the original reason for which it was requested.
Data Protection Declaration
Before we make an ADD enquiry, you will be required to provide the appropriate Data Protection Declaration.
The declaration provides evidence that you have been informed about the processing and that an ADD enquiry may be made for the stated purpose.
Under current DVLA requirements, a Data Protection Declaration is valid for no more than three years from the date it is signed, or until you stop driving in connection with the relevant purpose or relationship, whichever occurs first.
We may therefore ask you to complete a new declaration when your existing declaration expires or where otherwise required.
Lawful basis for processing
We process personal information obtained through ADD only where we have an appropriate lawful basis under UK data-protection legislation.
Depending on the circumstances and purpose of the processing, this may include processing necessary to comply with our legal or regulatory obligations and/or processing necessary for our legitimate interests in verifying driver eligibility, maintaining licensing and compliance standards, protecting the integrity of our services and supporting road safety and safeguarding.
Driving licence information may include information relating to offences, endorsements or disqualifications. Where information constitutes criminal offence data, we will only process it where the additional requirements of applicable UK data-protection legislation are satisfied.
The Data Protection Declaration required for ADD should not be interpreted as meaning that Drive An necessarily relies upon consent as its UK GDPR lawful basis for all processing of your information.
Where we obtain the information
Information processed through ADD is obtained from:
- you, including identification and driving licence information you provide to us; and
- DVLA, through the Access to Driver Data service.
The underlying driving licence record is maintained by DVLA. Drive An does not create or alter your DVLA driving record.
How we use ADD information
Information obtained through ADD may be used to:
- perform the authorised driving licence enquiry;
- verify your licence and driving entitlement;
- assess relevant endorsements, penalty points or disqualifications;
- determine whether further compliance action or review is required;
- maintain an auditable record of the enquiry;
- investigate discrepancies;
- comply with DVLA contractual and audit requirements;
- respond to suspected misuse or security incidents; and
- demonstrate that an enquiry was made for an authorised purpose.
Who can access your information
Access to live DVLA-sourced information is restricted to authorised personnel who require access for an approved purpose.
Drive An uses individual authenticated accounts and appropriate access controls to restrict access to ADD information.
At present, ADD information is not made available to operators or other third-party customers through Drive An: Manage.
If this changes in the future, we will only introduce such access or sharing after satisfying the applicable DVLA, contractual and data-protection requirements. We will update our privacy information where required before commencing that processing.
Where your information is stored
DVLA-sourced information processed within Drive An's production environment is stored within UK-hosted infrastructure.
Access to the production environment containing live DVLA-sourced information is restricted to authorised UK-based personnel.
Drive An does not intentionally make live DVLA ADD information accessible outside the United Kingdom.
How we protect your information
We use technical and organisational security measures designed to protect ADD information against unauthorised access, alteration, disclosure, loss or misuse.
These measures include:
- individual user accounts;
- multi-factor authentication;
- access controls;
- access and enquiry logging;
- company-authorised devices;
- security updates and patching;
- controlled production access;
- restrictions on personal devices and removable media; and
- security incident and data-breach procedures.
These controls are consistent with the operating model recorded in Drive An's ADD audit documentation.
How long we keep ADD information
We retain ADD information only for as long as necessary for the purpose for which it was obtained and to meet applicable legal, contractual, security and audit requirements.
Data Protection Declarations supporting an ADD enquiry are retained in accordance with DVLA requirements.
DVLA's current ADD guidance requires supporting Data Protection Declarations to be retained for two years from the date of the relevant ADD enquiry and stored so they can be readily recovered for DVLA inspection.
Our ADD enquiry records also contain appropriate retention and review information to support our audit and compliance obligations.
When information is no longer required, it will be securely deleted or otherwise disposed of in accordance with our retention procedures.
Where DVLA cannot return a record electronically
Not all driver records are available through the electronic ADD service.
Where DVLA returns a 404 response, this means that the record could not be returned through the electronic service. It does not necessarily mean that no driving record exists.
Where required, Drive An may follow DVLA's manual enquiry process, including submitting the appropriate Data Protection Declaration to DVLA for investigation.
DVLA's current guidance confirms this process for records that cannot be returned electronically.
Accuracy of DVLA information
The driving licence information returned through ADD originates from DVLA.
If you believe that information held on your underlying DVLA driving record is incorrect, you may need to contact DVLA directly to have the source record investigated or corrected.
Where information held directly by Drive An is inaccurate, you can contact us to request that it is reviewed and, where appropriate, corrected.
Your data protection rights
Depending on the circumstances and the lawful basis applicable to the processing, you may have rights under UK data-protection law, including the right to:
- request access to personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request erasure where the right applies;
- request restriction of processing in certain circumstances;
- object to certain processing; and
- raise a concern about how your personal information is being processed.
These rights are not absolute. For example, we may be required to retain certain ADD records to comply with DVLA contractual, audit or other legal requirements.
Complaints
If you have a concern about how we process your personal information, please contact Drive An so that we can investigate your concern.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
Drive An Limited is registered with the ICO under registration number ZB345405.
Changes to our ADD processing
We may update the way we operate the ADD service as a result of changes to DVLA requirements, legislation, our systems or our services.
Where a material change affects how your personal information is processed, we will update this Privacy Policy and provide any additional information required by law.
