Last updated: 1 November 2026
This notice explains what personal data SeruCoach collects, why, and your rights. It covers the UK GDPR and Data Protection Act 2018 (for UK users) and the EU GDPR (we are based in the EU).
1. Who is responsible for your data
Controller: SeruCoach. See our Company information page.
Contact for privacy questions: support@serucoach.co.uk.
We don't have a Data Protection Officer because the law doesn't require one for a business of our size and type.
2. What we collect and why
We keep data to a minimum. Our own systems don't store your name, phone number, postal address, ID documents or payment card details.
Nothing is on sale yet, so we collect no payment data. In short, we collect: your email if you ask for the launch-price email (or create an account), usage statistics, and your answers to the post-test survey if you fill it in. The table has the details.
| Data | When | Why | Lawful basis |
|---|---|---|---|
| Email address | When you create an account or ask to save your result | To sign you in (one-time codes) and send service emails (important changes) | Contract (Art. 6(1)(b)) |
| Launch-price email: your email, which product you asked about (SERU Practice, Topographical Practice, the PCO Tests Pack or Add Topographical Practice), your test (PHV or taxi), the page you were on, campaign tags of the link that brought you (only while usage statistics are on), the time and which version of the tick-box text you saw | When you tap a buy button before paid access opens, leave your email and tick the box | To send you one email when paid access opens, with the launch price, and to count how many people want each product. Nothing else, and never for other marketing. No outside email service: we store it ourselves | Consent (Art. 6(1)(a)). Withdraw any time by writing to support@serucoach.co.uk |
| Post-test survey: your answers about the format of your real test (multiple choice only, no free text), PHV or taxi, the test date and the score you report | Only if you fill it in after your test | To keep our practice tests in the real test's format | Legitimate interests. Not linked to your account |
| Study data: answers, practice test results, mistakes, readiness score, exam date (optional), language and display settings | When you use the app | To run the Service: progress, readiness, sync across devices | Contract. Free users without an account: this stays on your device only |
| Error reports: the question, your comment, optional email | When you report a problem | To fix mistakes and reply to you | Legitimate interests (accurate content). Your email is optional |
| Support emails | When you write to us | To answer you | Contract or legitimate interests |
| Usage statistics (see §4): pages viewed, features used, device type, browser, referral source, approximate country, performance and app errors | When you use the site, unless you turn it off | To understand how the site is used and improve it, and to find and fix errors | Legitimate interests (Art. 6(1)(f)); you can object at any time |
| Session recordings (masked) and ad measurement | Only if you click "Accept" | To see where people get stuck; to measure our ads | Consent (Art. 6(1)(a)); withdraw any time in Privacy settings |
| Security data: IP address, browser signals for bot checks, rate-limit counters (stored as one-way hashes) | When you request a sign-in code, send a form or use the API | To prevent abuse, fraud and attacks | Legitimate interests (security) |
| Waitlist email (for example, the topographical practice waitlist): your email, the module, your explanation language, the date and which version of the sign-up text you saw | When you ask us to tell you when a new practice module opens | To send you one email when that module opens. Nothing else, and never for other marketing | Consent (Art. 6(1)(a)). Leave any time with the link in the email, on the page while signed in, or by writing to us |
| Marketing emails | Only if you tick the separate box | Tips and offers | Consent. Unsubscribe link in every email |
We don't make decisions about you based only on automated processing that have legal or similarly significant effects. The readiness score is a study estimate only.
Language preference. Your choice of explanation language is used only to show explanations. We don't use it to guess your ethnicity or nationality, for advertising or for profiling.
Children. The Service is for adults preparing for a driver licence. It is not intended for anyone under 18.
3. Who we share data with
We don't sell your data. We share it only with these providers:
| Provider | Role | What they get | Where |
|---|---|---|---|
| Cloudflare, Inc. (US) | Processor: hosting, database (EU location hint), email forwarding, security, bot checks (Turnstile) | All data stored by the Service; IP addresses | Global network; database in Western Europe |
| PostHog Inc. (EU Cloud) | Processor: usage statistics, error tracking, session recordings (only with consent) | Pseudonymous IDs and events. Never your email. IP capture is turned off | EU (Frankfurt) |
| Resend (Plus Five Five, Inc., US) | Processor: sends sign-in and service emails | Your email address and the email content | US |
| Cloudflare Email Service | Processor: backup email sending | Your email address and the email content | Global |
| Cloudflare Web Analytics | Processor: privacy-first page-view statistics, no cookies | Page address, referrer, browser type and page load times | Global |
We may also share data if the law requires it, or to protect our rights (for example, in a payment dispute).
4. Usage statistics and your right to object
- For UK visitors we use PostHog to collect statistics about how the site is used, under the UK statistical-purposes exception (PECR Sch. A1 para 5). Read the Cookie notice for details.
- To object, click "Reject all" on the banner, or turn off Analytics in Privacy settings at any time. We also respect your browser's Global Privacy Control signal.
- Statistics are not used for advertising or to build profiles about you.
- We count button taps in aggregate, with no identifier.
5. International transfers
- We are in Poland (EU). The UK recognises the EEA as adequate, and the EU recognises the UK as adequate (renewed until 27 December 2031).
- Cloudflare and Resend are US companies. Transfers to them rely on the EU–US Data Privacy Framework and its UK Extension (where the provider is certified) and on Standard Contractual Clauses with the UK Addendum in their data processing agreements.
- PostHog stores our data in its EU Cloud. Any access from outside the EU is covered by its data processing agreement.
- You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | How long |
|---|---|
| Account, study data, access records | While your account exists. Accounts inactive for 24 months are deleted; we warn you 30 days before |
| Launch-price emails | Until we send the one email about paid access, then deleted. At most 12 months, and straight away if you delete your account |
| Sign-in codes / sessions | 5 minutes / up to 30 days |
| Error reports | 12 months. The optional email is deleted when the report is closed, or after 90 days |
| Waitlist emails | Until we send the one email about that module, then deleted. If the module has not opened within 12 months of your sign-up, we delete your email without writing |
| Support emails | 24 months after the last message |
| Usage statistics (PostHog) | Up to 12 months; deleted when you delete your account |
| Server logs | Up to 7 days |
| Email delivery logs (Resend) | 30 days |
| Free users without an account | On your device only. Clear it in Settings or in your browser |
7. Your rights
You have the right to:
- access your data and get a copy;
- correct it;
- delete it ("right to erasure");
- restrict how we use it;
- data portability: get it in a machine-readable format;
- object to processing based on legitimate interests, including usage statistics;
- withdraw consent at any time, without affecting earlier processing.
How:
- Settings → Export my data gives you a JSON file.
- Settings → Delete my account (we send a code to confirm).
- Or email support@serucoach.co.uk.
We reply within one month (we can extend this by two months for complex requests and will tell you if we do). We may ask you to confirm you own the email address.
When you delete your account, we delete your data and ask PostHog to delete its records.
8. Complaints
- Please complain to us first at support@serucoach.co.uk. We acknowledge every complaint within 30 days and tell you the outcome without undue delay.
- You can also complain to a regulator:
- UK: the Information Commission (the ICO), ico.org.uk/make-a-complaint, 0303 123 1113.
- EU / Poland: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. If you live elsewhere in the EU, you can also complain to your local authority.
9. Security
- We use HTTPS everywhere.
- Sign-in codes are short-lived and stored hashed.
- Paid content is served only after an access check.
- Logs never contain emails or codes.
- Only the business owner has admin access, protected by two-factor sign-in.
10. Changes
We'll post updates here with a new date. If a change is important, we'll email account holders.