The small print, in plain words.

01Who we are

MyDS System Ltd (company no. 00000000, sample company details) runs MyDS. It is the controller for visitors to this website, messages sent through the Contact page, the price-notify list, and school sign-up and account data.

For school and student data (learners, bookings, records) the school is the controller and MyDS is the processor. That is covered in the Data processing agreement.

To complete after legal review: Final company details and the controller split [VERIFY]. The ICO registration number.

02What we collect

• Contact messages: your name, email and what you write.
• The price-notify list: your email address, and a note of your agreement.
• School sign-up and account data: the details you give when a school applies and uses its account.
• Cookie choices: your choice, the wording you saw, the time and a random id (no IP address).
• Visit counts, only if you say yes to statistics: day, page, language and a count. No visitor id.

When you tick the Terms and Privacy box at sign-up, we save the time and the version. The optional news box is saved the same way, with the exact wording you saw.

03Why we use it

To answer your messages, to create and protect school accounts, and to keep the site safe. We tell you when prices are announced only if you joined the list; you can leave it with one click. Marketing to people under 18 is off by default.

To complete after legal review: The legal basis for each use [VERIFY].

04Where it is stored and how it is protected

Your data is stored in the UK (servers and file storage in London). It is encrypted in transit and at rest. If a data breach puts people at risk, we report it to the regulator within 72 hours.

The helpers we use are listed in the Data processing agreement.

05How long we keep it

• Contact messages: 6 months after we have dealt with them.
• The price-notify list: until we send the price email, or 12 months, whichever comes first.
• Cookie choice records: 24 months. The choice cookie itself: 6 months.
• Visit counts: 13 months.
• School enquiries that do not become a school: 6 months.
• Financial records: at least 5 years (HMRC).
• After a school closes: the school can export its data; the rest is deleted after 30 days, except the records the law says we must keep.

To complete after legal review: Retention periods checked by the solicitor [VERIFY].

06Car checks

When a car is added, and each night after that, we send its number plate to the DVLA and the DVSA, the UK government services, to read its tax and MOT details. We send only the number plate.

07Finding car chargers

When an instructor with an electric car opens fuel prices, we ask Open Charge Map, a public charger map, for chargers near them. We send only a rough spot, to about a kilometre, with no name or account, and we keep that rough spot for one day to avoid asking again.

08Facebook and Instagram

A school owner can link the school's Facebook Page and Instagram professional account. We then receive the page name, the account name and a key that lets us post for that page. We use them only to publish the posts the school writes or approves here, and to take them down when asked. We do not read your messages, friends or followers.

The key is stored encrypted and is never shown to anyone. It is removed when the owner unlinks the page. You can also remove MyDS in your Facebook settings under Apps and websites and ask there for your data to be deleted: we then remove the link and cancel the planned posts. Posts already on your pages stay there until you delete them.

09Your rights

You can ask to see your data, have it corrected or deleted, object to how it is used, or receive a copy you can move elsewhere. Write to us through the Contact page.

You can also complain to the Information Commissioner's Office (ICO): ico.org.uk.