Privacy

TSO respects the privacy of every individual whose personal information it handles. This Privacy Policy explains how TSO collects, stores and uses personal information.

“TSO”, “we”, “us” and “our” mean The Stationery Office Limited, having its registered office at 18 St Andrews Business Park, Norwich, England, NR7 0HR.

The Stationery Office Limited is the controller of the personal information we process for the purposes described in this notice through the Safe Driving for Life website, https://www.safedrivingforlife.info, the official DVSA mobile applications, and related telephone, email, live chat and social media interactions.

A controller is the organisation responsible for deciding why and how personal information is used. Our relationship with the Driver and Vehicle Standards Agency (DVSA) is explained in section 2.

This notice explains our processing under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. Where EU GDPR also applies to our processing, we comply with its applicable requirements.

You can contact us about this notice or our use of your personal information using the details in sections 3 and 12.

2. Relationship between TSO and the Driver and Vehicle Standards Agency (DVSA)

TSO is the official publisher for the Driver and Vehicle Standards Agency (DVSA). TSO hosts, manages and fulfils orders made through this Site on behalf of the DVSA.

If the arrangement between TSO and DVSA ends, we may share your name, email address and details of the products or services you have purchased with DVSA and an appointed replacement service provider where necessary to support the transition and continuity of the relevant services.

We will explain any material change affecting who controls your personal information and how it will be used. We will not treat a service transition as permission for a new organisation to send you marketing outside the scope of your existing choices.

3.Our Data Protection Officer

Our Data Protection Officer can also be contacted by email at global.privacy@williamslea.com or in writing at:

Data Protection Officer

Williams Lea

18 Central Avenue

St Andrews Business Park

Norwich, NR7 0HR

United Kingdom

4.How we collect and process your personal information

When you sign up for an account on our Site

When you create a Safe Driving for Life account, we collect your first name, last name and email address. These details are required to create and administer your account, authenticate you when you sign in, provide access to account features, and send you essential account, security and service-related communications.

You may also choose to provide a telephone number. Providing a telephone number is optional and is not required to create or use an account. If you provide a telephone number, we may use it to contact you if there is a problem with the delivery of an order.

We use the information collected when you create an account to:

• create and maintain your account;
• enable you to sign in securely;
• provide access to products and services associated with your account;
• process and manage orders placed through your account; and
• contact you regarding your account, orders and other service-related matters.
• Required fields are clearly identified during registration. If you do not provide the required information, we will be unable to create your account or provide the services associated with it. Optional information is identified separately and can be left blank without affecting your ability to register for or use an account.

Account, order and service communications are necessary for the operation of your account and the fulfilment of products and services you have requested. These communications are separate from marketing communications.

Creating an account does not automatically subscribe you to marketing emails. Any marketing preferences are presented separately and are entirely optional. Choosing not to receive marketing communications will not affect your ability to create an account, place orders or use Safe Driving for Life products and services.

When you place an order or return a product

When you place an order through our Site, we collect and use the information needed to process and fulfil your order. This includes your first name, last name, email address, billing address, delivery address, delivery preferences and details of the products or services you have ordered. If you choose to provide a telephone number, we may use it to contact you if there is an issue with the delivery of your order or if we need to resolve a problem relating to your purchase.

Payments made through our Site are processed by our third-party payment provider, Stripe. When you make a payment, your credit or debit card details are collected and processed directly by the payment provider. We do not receive or store your full payment card details. We receive limited transaction information, such as confirmation that a payment has been authorised or completed, the payment method used, transaction reference numbers and information required to administer your order, process refunds and maintain our financial records.

We use this information to:

• confirm and administer your order;
• arrange delivery of products or provision of services;
• process payments and refunds;
• provide customer support and respond to enquiries about your order;
• detect, prevent and investigate fraud or other unlawful activity; and
• establish, exercise or defend legal claims and resolve disputes.
• We identify the information required to process your order, arrange delivery or provide a refund. If you do not provide the required information, we may be unable to fulfil your order, provide the relevant service, process your payment or arrange a refund or return.

The collection and processing of payment card information by our payment providers is governed by their own privacy notices and security arrangements. We do not store full credit or debit card numbers, card verification values (CVV/CVC) or other payment card authentication data.

Marketing and newsletter subscriptions

The Stationery Office Limited (TSO) sends Safe Driving for Life marketing emails according to the choices you make. We use your contact details, subscription preferences and, where relevant, purchase history or selected user category for the purposes described below. Our lawful basis for this processing is your consent.

Safe Driving for Life website account marketing

When you create or manage your website account, you can separately choose to receive:

• Emails for product updates and additional products of interest: emails about new products we think may interest you, based on your purchase history or selected user category, and updates to existing products. We send these emails no more than twice per calendar month.
• Monthly newsletters: newsletters containing blogs, product updates, industry updates, special offers, content from UK-based sponsored partnerships approved by DVSA, and messages from DVSA.
• Emails for research purposes: occasional invitations to give feedback on our products and your customer experience. Taking part is optional. We provide further information about the use and sharing of your responses when we invite you to participate.

Your choices are optional. Choosing not to receive these emails does not affect your ability to create an account, purchase products or use the services available to you.

Where we use your purchase history or selected user category to choose product-update emails, we use this information to identify products that are likely to be relevant to you.

Subscribe through our email newsletter forms

You can subscribe to our learner-driver or approved driving instructor newsletter through a dedicated newsletter form. By submitting a form clearly identified as a newsletter subscription, you ask TSO to send you the monthly newsletter you select.

These newsletters may include blogs, product updates, industry updates, special offers, content from UK-based sponsored partnerships approved by DVSA, and messages from DVSA.

We use your email address and any other information you choose to provide on the form to manage your subscription and, where applicable, personalise the newsletter. Required and optional fields are identified on the form.

Subscribing through a newsletter form does not subscribe you to separate product-update emails or research invitations.

Sponsored content and use of your information

Sponsored content is included within the Safe Driving for Life newsletter sent by TSO. Subscription to our newsletter does not, by itself, authorise sponsored partners to contact you directly. We do not share your subscriber contact details with sponsored partners for their own direct marketing.

If we propose to share your details with another organisation for its own email marketing, we will identify that organisation and obtain the necessary separate consent before doing so.

Changing your marketing choices

You can withdraw your consent at any time by using the unsubscribe link in our marketing emails or by emailing tso_marketing@williamslea.com. If you subscribed through your website account, you can also change your preferences in your account settings.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You also have the right to object at any time to the use of your personal information for direct marketing, including related profiling.

Unsubscribing from marketing does not stop necessary account, order or service communications.

We keep records of your marketing choices and may retain limited information on a suppression list to ensure that we respect your decision not to receive marketing. Further information about recipients, international transfers and retention is provided in sections 6, 7 and 8.

Both the learner-driver newsletter and the approved driving instructor (ADI) newsletter are issued on a monthly basis. When you subscribe, we collect your first name and email address and use this information to manage your subscription and personalise the newsletter, including addressing communications to you by name.

Subscriber details are used by TSO solely for the administration and delivery of the relevant newsletter. DVSA does not have access to subscriber contact details and does not receive copies of the subscriber database.

We do not share newsletter subscriber details with sponsored partners or other organisations for their own marketing purposes. We do not operate partner-sponsored newsletter sign-up arrangements, joint marketing initiatives or third-party commissioned email campaigns. Your subscription is used only to deliver the newsletter you have requested and associated subscription-management communications.

You can withdraw your consent and unsubscribe at any time using the unsubscribe link included in every newsletter email or by contacting us using the details set out in this Privacy Notice.

When you contact us

If you contact us by telephone, email, post or using another function offered by our Site, e.g. livechat we will collect any information about you that you choose to give us. We will use this information to review, investigate and respond to any comment or question that you may raise.

Information we collect automatically from you

When you use our website or mobile applications, we collect technical and usage information including your Internet Protocol (IP) address, browser type, operating system, device information, and information about how you interact with our services.

This information may constitute personal information where it relates to an identifiable individual, including where it can be linked to your account, device or other information about you. Online identifiers such as IP addresses and device identifiers can also be personal information under applicable data protection laws.

We use this information to provide and maintain our website and mobile applications, authenticate users, support account functionality, maintain the security of our services, prevent and detect fraud and misuse, diagnose and resolve technical issues, process transactions, and administer and improve the performance and reliability of our services. The relevant lawful bases are explained in section 5.

The technical information we collect includes your IP address, browser type, operating system, device information, account-related activity, pages and features accessed, transaction activity, and other information generated through your use of our website and mobile applications. Where location information is processed, it is limited to approximate location derived from your IP address. We do not collect precise location data from GPS or similar device-location services through the Safe Driving for Life website.

We use cookies and, where applicable, similar technologies that store information on or access information from your device. These technologies support functions such as website operation, account management, security, fraud prevention, shopping basket functionality and user preferences. Further information about the technologies we use, their purposes, providers, retention periods and the choices available to you can be found in our Cookie Policy.

Where consent is required for the use of a particular technology, we obtain that consent before using it. Where a legal exception applies, we use the technology in accordance with the applicable requirements.

Apple Smart App Banner
We use Apple's Smart App Banner feature on supported Apple devices and Safari browsers to promote The Official DVSA Theory Test Kit app. The feature displays information about the app and provides a link to the Apple App Store or, where applicable, allows users to open the installed app directly. The banner is provided and managed by Apple Safari. Users can dismiss the banner using standard Safari controls.

When you take part in a research project, user testing or a competition

If you take part in research, user testing or a competition, we use the information requested for the purposes explained when you participate. These may include organising the activity, contacting participants, analysing feedback, administering entries and contacting or arranging prizes for winners.

We explain the information required, the applicable lawful basis, relevant recipients and retention arrangements in the information provided for that activity.

Participation does not automatically subscribe you to marketing.

Where we share research results described as anonymous, we first take steps to ensure that individuals are not identifiable from those results. If identifiable information is shared with DVSA or a research service provider, we explain that sharing in the information provided for the activity.

You can contact tso_marketing@williamslea.com to ask about withdrawing from an activity. Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. We will explain any practical consequences, such as being unable to continue your competition entry.

5. Our legal basis for using your personal information

Purpose	Lawful Basis
Creating and operating an account; providing purchased products or services; handling orders and returns	Performance of a contract, where the processing is necessary to provide the relevant service.
Sending the optional marketing emails and newsletters described in section 4	Consent.
Selecting relevant product-update emails using purchase history or user category	Consent, within the scope of the marketing choice described in section 4.
Maintaining records required by tax or other applicable law	Compliance with a legal obligation. Processing necessary to comply with applicable UK tax, accounting and statutory record keeping obligations.
Preventing fraud and maintaining service security	Our legitimate interests in preventing fraud and protecting customers, accounts, transactions and our services against misuse and security threats.
Responding to enquiries and resolving complaints	Performance of contract and in some cases our legitimate interests. Where it is necessary to handle a statutory privacy-rights request or legally required privacy complaint.
Establishing, exercising or defending legal claims	Our legitimate interest in establishing, exercising or defending legal claims and protecting our legal rights. A binding court order or specific statutory disclosure.
Maintaining marketing suppression records	Legal Obligation, processing necessary to respect your objection to direct marketing or withdrawal of consent and prevent further unwanted marketing.
Website/app usage analysis and other automatic collection	Consent, your consent for analytics and other technologies where consent is required. For limited technical processing that does not require consent, our legitimate interests in operating, securing and improving our services.
Research, user testing and competitions	Our legitimate interest in understanding customer experiences and improving our products and services through proportionate research and user testing. For competitions, processing necessary to administer your entry and provide prizes under the competition terms.
Sharing information for a DVSA service transition	Our legitimate interests, and those of DVSA and affected customers, in maintaining continuity of relevant services during a change of provider.

Where we rely on legitimate interests, we assess whether our interests are overridden by your interests, rights and freedoms.

Where we rely on consent, you can withdraw it at any time using the methods explained in this notice or the information provided for the relevant activity.

6. How we may share your information

We may disclose the personal information we hold about you to:We share personal information where necessary for the purposes described in this notice. The information shared depends on the recipient and the service or activity involved.

• The Driver and Vehicle Standards Agency (DVSA);
• our group companies and affiliates;

our service providers, including Amazon Web Services (for DVSA mobile apps), IT hosting companies and providers supporting email marketing, customer support, research and order fulfilment, where applicable;

• banks, other financial institutions and credit reference agencies;
• payment service providers;
• third party companies in the event that we are involved in a corporate transaction such as an actual or potential merger, joint venture, consolidation or asset sale;
• professional advisors such as attorneys, accountants, auditors, financial and other professionals;
• regulatory authorities, including tax authorities;
• law enforcement agencies, courts and other relevant tribunals.

Where a service provider processes personal information on our behalf, we require it to act under appropriate contractual arrangements and instructions.Some recipients, such as payment providers, professional advisers or public authorities, may act as independent controllers for their own processing.Information about sponsored-partner marketing is provided in section 4. We do not treat this recipient list as consent to another organisation’s marketing.

7. International transfers of personal information

We and our service providers may process personal information outside the United Kingdom, including where information is hosted overseas or accessed by overseas support teams.Where a transfer is subject to the UK GDPR’s international-transfer requirements, we use an applicable lawful transfer arrangement. Depending on the destination and recipient, this may include UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.You can obtain further information about these transfers and a copy of the relevant safeguards, subject to appropriate redactions, by contacting global.privacy@williamslea.com.

8. Retention of personal information

We keep personal information only for as long as needed for the purposes for which it was collected, including applicable legal, accounting and record-keeping requirements and the establishment, exercise or defense of legal claims.Our retention periods or the criteria used to determine them are:

• Account information: retained while your account remains active and for up to six years after account closure or last activity where necessary to manage the service, resolve disputes, respond to regulatory requirements or establish, exercise or defend legal claims.
• Orders, payments and returns: retained for up to six years after the end of the relevant financial year, or longer where required to comply with tax, VAT, accounting, audit or legal requirements. VAT-related records may be retained for up to 10 years where required by applicable legislation and our corporate retention schedule.
• Marketing subscriptions: retained until you unsubscribe, withdraw consent or we determine that your subscription is inactive and no longer required for the relevant marketing purpose.
• Marketing consent evidence: retained for as long as required to demonstrate compliance with data protection and electronic marketing laws and to manage any regulatory enquiries or complaints.
• Marketing suppression records: limited information retained after you opt out of marketing communications to ensure we continue to respect your preferences and do not send you unwanted marketing. These records may be retained for as long as reasonably necessary to demonstrate compliance with your opt-out request.
• Enquiries, complaints and live chat records: retained in accordance with our customer correspondence and complaints retention requirements. Complaint records may be retained for up to 10 years after a complaint is raised or six years after it is resolved (whichever is later). Customer correspondence may be retained for up to 10 years after creation, six years after last contact or inactivity, or six years after complaint closure, whichever is later.
• Research, user testing and competition information: retained for the period explained when you participate, or until the relevant activity has been completed and evaluated, unless a longer period is required by law.
• Technical logs, usage and email engagement information: retained only for as long as necessary to operate, secure and improve our services. Technical data may be retained for up to six months, backup data for up to three months, and other service usage information for periods proportionate to the purpose for which it was collected.

Cookie and similar-technology durations are explained in our Cookie Policy. Where information obtained through those technologies is retained separately, the relevant retention period or criteria are explained here or in that policy.At the end of the applicable retention period, we delete or anonymise the information, unless further retention is necessary for a documented lawful purpose.

9. Your rights

Depending on the circumstances and the lawful basis for the processing, you have rights to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request erasure of your information;
• request restriction of processing;
• object to certain processing, including processing based on legitimate interests;
• receive certain information in a structured, commonly used, machine-readable format and, where applicable, have it transferred to another organisation; and
• exercise applicable rights and safeguards relating to significant decisions made solely by automated processing.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.You have the right to object at any time to processing for direct marketing, including related profiling. We will stop using your information for those purposes if you object.You can make a rights request by contacting foirequest@tso.co.uk or global.privacy@williamslea.com. Requests can be made verbally or in writing; you do not need to use a particular form or legal terminology.We may request information reasonably needed to verify your identity or clarify your request. We respond within the applicable legal timeframe, normally one month, subject to any lawful extension or other applicable timing provisions.ComplaintsIf you have a concern about how we use your personal information, you can complain to us at global.privacy@williamslea.com.You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. You can find information about making a complaint at www.ico.org.uk or contact the ICO on 0303 123 1113.Its postal address is:Information Commissioner’s OfficeWycliffe HouseWater LaneWilmslowCheshireSK9 5AF

10. Changes to this Privacy Policy

This Policy will be reviewed from time to time to take account of changes to our operations or practices and, further, to make sure it remains appropriate to any changes in law, technology and the business environment.We publish the date of the latest update at the end of this notice. Where changes materially affect how we use your personal information, we will bring them to your attention in an appropriate way.If we intend to use your information for a new purpose, we will provide the relevant privacy information before doing so and obtain additional consent where required. Updating this notice does not, by itself, change your marketing choices or authorise new processing.

11. Links to third party websites

This Site may contain links to other websites. These are not covered by this Privacy Policy. If you access other websites using the links provided, you do so at your own risk. The operators of these websites may collect and use your information in accordance with their privacy policies, which may differ from ours. Please check the relevant policies before you submit any personal information to any other websites.

12. Contact us

If you have questions about this notice, wish to raise a privacy concern or complaint, or need help exercising your rights, please contact global.privacy@williamslea.com.You can also write to the Data Protection Officer at the address in section 3. Further information about exercising your rights and contacting the ICO is provided in section 9.

Privacy notice last updated: 19 October 2026

---