Privacy notice

Summary

• Who we are: Changing Lanes Limited (company number [to be confirmed: company number]), an HGV driver training and employment service in England. We are the "controller" of the personal information described here. ICO registration number: [to be confirmed: ICO data protection fee registration number].
• What we collect: what you tell us (for example on an application, a job profile or an employer registration), what we record while you train or recruit with us, and limited technical information when you use the site.
• Why: to answer enquiries, assess applications, deliver and evidence training, meet funding and legal duties, keep people safe, help work-seekers find jobs with employers, take payments, and keep the service secure and working.
• Sensitive information (health, benefit status, safeguarding, driving offences) is kept in separate restricted records that only named roles can see, and is never shown to employers.
• Who we share with: only those who need it — for example a funding body or lead provider for a funded place, DVSA when we book a test for you, an employer you apply to (only what you choose to share), and the service providers that run our systems. We never sell personal data.
• Nothing important is decided by a computer alone. The platform prepares recommendations; a person makes every decision — see the Automated processing and AI notice.
• Your rights: you can ask for a copy of your information, ask us to correct or delete it, object, and more. You can complain to us and to the Information Commissioner's Office.

This is a layered notice. The sections below apply to everyone. The notice for your situation gives the detail:

• Privacy notice for applicants and learners
• Privacy notice for work-seekers using the jobs service
• Privacy notice for employers and their staff
• Privacy notice for website visitors
• Privacy notice for staff and job applicants

Who we are and how to contact us

Changing Lanes Limited is registered in [to be confirmed: place of registration (for example England and Wales)] (company number [to be confirmed: company number]) with its registered office at [to be confirmed: registered office address]. We are registered with the Information Commissioner's Office (ICO) under number [to be confirmed: ICO data protection fee registration number].

Contact our Data Protection Lead ([to be confirmed: Data Protection Lead (name or role holder)]) at [to be confirmed: privacy and data protection email address] or write to [to be confirmed: postal address for letters and rights requests].

Where a funding body is involved

If you are on a funded place, the organisation that funds it (for example the Department for Education, a local or mayoral authority, or a lead provider we subcontract to) may also be a controller of your information and will give you its own privacy notice — for Skills Bootcamps, the Department for Education's Skills Bootcamp privacy notice. We will give you that notice before we share anything. Our funding arrangements: [to be confirmed: funding contract or subcontract (funding body, lead provider and contract reference)].

What we use and why

Where we rely on legitimate interests we have balanced them against your rights; you can object (see Your data rights and how to use them).

Special category and criminal offence data

Some information is more sensitive: health (for example a D4 medical outcome or a support need), benefit status used for eligibility, and driving-offence information (penalty points). We only use it where the law allows — for example to meet our obligations under the funding contract and the Equality Act 2010, for statutory and government purposes, for safeguarding of individuals at risk, and for preventing fraud — relying on the conditions in Schedule 1 to the Data Protection Act 2018, with an appropriate policy document. It is stored in restricted records separate from everything else, is visible only to named roles, never appears in lists, exports, logs or notifications, and is never shared with employers.

We do not currently collect equality monitoring information. If we start, it will be optional, kept separately and never used to make decisions about you.

Who we share information with

• Funding bodies and lead providers — for a funded place, the information the contract requires, including for audits. Nothing is sent automatically; staff prepare and approve every submission.
• DVSA — when staff book a theory or practical test for you, the details DVSA requires.
• Employers — only if you use the jobs service and only what you chose to share, for the vacancy you applied to (see Privacy notice for work-seekers using the jobs service).
• Awarding bodies — if you take a regulated qualification with us: [to be confirmed: awarding body or bodies for any regulated qualification delivered].
• Our processors — the service providers listed below, who act only on our instructions under contract.
• Authorities — the police, local authority safeguarding teams, the Prevent team, HMRC, the courts or regulators where the law requires or allows it, or to protect someone from serious harm.
• Professional advisers, insurers and auditors — where needed, under confidentiality.

If we ever sell or transfer our business, information would pass to the buyer under this notice.

Processors we use

Transfers outside the UK

Our main database is hosted in the United Kingdom. Some providers may process data elsewhere (for example the European Union, which the UK recognises as adequate, or the United States). Where data leaves the UK we make sure it is protected by UK adequacy regulations, the UK–US data bridge, or the UK International Data Transfer Agreement or Addendum. Each provider's location and safeguard is shown in Processors we use.

Keeping the service working

To find and fix faults we use error monitoring (Sentry) and uptime and log monitoring (Better Stack). Error reports contain technical details — the page address without its query string, the browser type and what went wrong. Before anything leaves our systems, email addresses, phone numbers, National Insurance numbers, postcodes, names in form fields, cookies and form contents are removed. Our lawful basis is legitimate interests: keeping the service secure and working.

When you report a problem

If you use "Report a problem", we keep your description, the kind of problem, the page you were on and, unless you untick it, a session transcript: the pages you opened and the buttons you pressed in that browser tab in the last 30 minutes. The transcript never contains anything you typed, and personal details are masked before it is sent. If you are not signed in you can choose to give an email address so we can reply. Only our platform administrators can read reports. We keep them for 12 months, then delete them. Our lawful basis is legitimate interests: debugging related issues and improving the platform.

Cookies and analytics

We only use analytics cookies (PostHog, hosted in the EU) if you accept them — see the Cookie policy and the cookie settings page. We also count page views on our own server without cookies or identifiers.

How long we keep information

We keep information only as long as we need it. The main periods are in the Data retention schedule, which is generated from the rules our software enforces. For example: unsuccessful applications are anonymised 12 months after the decision; enrolled learner records are kept for the funding year plus six years; financial records for six years.

Your rights

You have the right to be informed; to access your information; to have it corrected; to have it erased; to restrict or object to its use (including an absolute right to object to direct marketing); to data portability; and rights about automated decisions. Where we rely on consent you can withdraw it at any time. How to use these rights, and our timescales, are in Your data rights and how to use them.

Automated processing

The platform works some things out automatically — for example an eligibility pre-check, a job-match score with its reasons, or a reminder when evidence is missing. These are recommendations to staff. No decision with a legal or similarly significant effect on you is made solely by automated means. See the Automated processing and AI notice.

Young people

Our programmes are for adults. Funded Skills Bootcamps are normally for people aged 19 or over. If an 18-year-old applies, we explain things in clear language, apply our safeguarding policy and do not use their information for marketing without their consent.

Complaints

If you are unhappy with how we have used your information, please tell us first at [to be confirmed: privacy and data protection email address] — you can use any method, including our contact form. Under the Data Protection Act 2018 (section 164A, from 19 June 2026) we will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113. The ICO may ask whether you have complained to us first. Our wider Complaints policy and procedure explains the process.

Changes to this notice

We review this notice at least every year and whenever the platform changes how it uses personal information. The version and a summary of every change are shown below. If a change affects you significantly we will tell you directly.

Change history