Data Processing Agreement

• Version: 1.0
• Effective date: 30 October 2026
• Website: https://roadpath.co.uk
• Data Processor: ROADPATH LTD, a company registered in England and Wales (company number 17518473)
• Registered address: 2 Bright Ridge, Tunbridge Wells, Kent, TN4 0JL
• Data protection contact: contact (at) roadpath.co.uk

1. Parties and purpose

1.1 This Data Processing Agreement (“Agreement”) is between:

• The Controller: the approved driving instructor, trainee instructor, driving school or other authorised business subscribing to RoadPath (“Instructor”).
• The Processor: ROADPATH LTD, which operates the RoadPath software platform (“RoadPath”).

1.2 This Agreement forms part of the RoadPath Terms of Service and governs the processing of personal data by RoadPath on behalf of the Instructor.

1.3 This Agreement is intended to satisfy Article 28 of the UK General Data Protection Regulation (“UK GDPR”), as supplemented by the Data Protection Act 2018 and other applicable UK data protection legislation.

1.4 It takes effect when the Instructor creates a RoadPath account (which includes accepting the Terms of Service and this Agreement) or otherwise enters into a binding contract incorporating it. For Instructors whose accounts existed before the effective date, it takes effect on the effective date.

1.5 If this Agreement and the Terms of Service conflict about the processing of Controller Personal Data, this Agreement takes precedence to the extent of that conflict.

2. Definitions

• Controller Personal Data: personal data processed by RoadPath on behalf of the Instructor in connection with the Services.
• Data Subject: an identifiable individual whose personal data is processed, including learner drivers and other individuals recorded by the Instructor.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• Sub-processor: a third-party processor engaged by RoadPath to process Controller Personal Data.
• Services: the RoadPath instructor management, lesson scheduling, learner tracking, assessment, reporting and related software services.

Other defined terms have the meanings given under applicable UK data protection legislation.

3. Roles and responsibilities

3.1 The Instructor is the Data Controller of the learner information entered into, or collected through, RoadPath for them.

3.2 RoadPath is the Data Processor when providing the Services and processing that information on the Instructor’s behalf.

3.3 The Instructor is responsible for:

• Having an appropriate lawful basis for processing.
• Giving privacy information to learners where required.
• Making sure the information entered is accurate, relevant and necessary.
• Deciding how long learner records are kept, and archiving or deleting them in RoadPath when no longer needed.
• Responding to data subject requests.
• Meeting any additional legal conditions for special category data.
• Keeping their account credentials confidential and managing anyone they allow to use their account.

3.4 RoadPath shall process Controller Personal Data only in accordance with this Agreement and the Instructor’s documented lawful instructions.

3.5 RoadPath acts as an independent Controller for its own subscription records, billing administration, customer communications with Instructors, security administration and other purposes it decides itself. That processing is governed by RoadPath’s Privacy Policy, not this Agreement.

4. Scope and purpose of processing

4.1 RoadPath provides a digital environment for Instructors to run their driving instruction business.

4.2 Processing may include:

• Creating and managing learner profiles.
• Scheduling, rescheduling and cancelling driving lessons.
• Recording lesson attendance, cancellations and no-shows.
• Recording lesson duration, charges, payments, blocks of hours and gift vouchers.
• Keeping lesson history and learner progress.
• Recording driving faults and assessment outcomes, including DL25-related categories.
• Producing learner readiness scores and recommendations.
• Managing mock driving test records and progression criteria.
• Producing automated or AI-assisted lesson summaries and insights.
• Diary management, reporting, and offering freed lesson times to learners and people on the Instructor’s waiting list.
• Sending lesson confirmations, reminders, receipts, links and messages by email, browser notification and, if the Instructor connects it, WhatsApp.
• Backing up, retrieving, securing and maintaining the data needed to provide the Services.

4.3 RoadPath shall not use Controller Personal Data for unrelated marketing, advertising, selling personal information, or training general-purpose AI models.

4.4 The detailed description of processing is in Schedule 1.

5. Documented instructions

5.1 RoadPath shall process Controller Personal Data only on documented instructions from the Instructor, including instructions about international transfers, unless processing is required by UK law.

5.2 The Instructor’s documented instructions are this Agreement, the Terms of Service, the Instructor’s settings, the actions the Instructor takes in RoadPath, and any additional lawful written instructions RoadPath accepts.

5.3 Where RoadPath is legally required to process data outside those instructions, it shall tell the Instructor before processing unless the law prohibits this.

5.4 RoadPath shall immediately tell the Instructor if, in its opinion, an instruction infringes data protection legislation.

6. Confidentiality

6.1 RoadPath shall ensure that anyone it authorises to process Controller Personal Data, including employees, temporary and agency staff and contractors, is bound by appropriate contractual or statutory confidentiality obligations.

6.2 Access is limited to people who need it for service delivery, maintenance, support, security or legal compliance.

6.3 Confidentiality obligations continue after a person’s authorisation or engagement ends.

7. Security of processing

7.1 RoadPath shall implement appropriate technical and organisational measures in line with Article 32 UK GDPR, taking account of the risks, nature and context of processing.

7.2 These measures include, as appropriate: secure sign-in and access controls; separation of each Instructor’s records; restricted and logged administrative access; encryption in transit and at rest; monitoring and incident response; backups; applying security updates; and reviewing and testing controls.

7.3 RoadPath shall configure its database, sign-in and server so that one Instructor cannot access another Instructor’s records.

7.4 RoadPath shall not describe a security measure as in place unless it has been deployed and checked.

7.5 The measures currently in place are described in Schedule 2. RoadPath keeps Schedule 2 up to date.

8. Sub-processors

8.1 The Instructor gives RoadPath general written authorisation to engage Sub-processors for the purposes in this Agreement, subject to the safeguards below.

8.2 RoadPath keeps an up-to-date Sub-processor register (Schedule 3) showing each provider, what it does, where it processes data and the transfer safeguards relied on.

8.3 RoadPath shall tell the Instructor by email at least 30 calendar days before adding or replacing a Sub-processor, and update Schedule 3. If an urgent change is needed to deal with a material security or service risk, RoadPath shall give notice as soon as reasonably practicable.

8.4 The Instructor may object to a change on reasonable data protection grounds before it takes effect, by emailing contact (at) roadpath.co.uk. The parties shall try to resolve the objection. If no reasonable resolution is available, the Instructor may end the affected Services without an early termination penalty and with a refund of any prepaid, unused subscription period.

8.5 RoadPath shall put written data protection obligations on each Sub-processor that give the same level of protection as this Agreement.

8.6 RoadPath remains responsible to the Instructor for its Sub-processors’ data protection obligations.

9. International data transfers

9.1 RoadPath shall not transfer Controller Personal Data outside the United Kingdom, or allow a Sub-processor to make a restricted transfer, unless authorised by the Instructor and compliant with UK data protection law.

9.2 Where needed, RoadPath relies on an appropriate transfer mechanism, such as UK adequacy regulations (including the UK–US data bridge), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9.3 RoadPath shall carry out any necessary transfer risk assessment and add supplementary safeguards where required.

9.4 By accepting this Agreement the Instructor authorises the transfers shown in Schedule 3.

10. Data subject rights

10.1 The Instructor is primarily responsible for handling requests from learners and other Data Subjects.

10.2 Taking account of the nature of the processing, RoadPath shall help the Instructor respond to requests for access, correction, erasure, restriction, data portability, objection, and rights about automated decision-making. Within RoadPath, Instructors can edit learner records, download a copy of a learner’s records, and delete a learner permanently.

10.3 If RoadPath receives a request directly about Controller Personal Data, it shall promptly pass it to the Instructor unless the law prohibits this, and shall not decide the response itself without the Instructor’s authorisation.

10.4 RoadPath shall give reasonable help through the app and through support at contact (at) roadpath.co.uk.

11. Personal data breaches

11.1 RoadPath shall tell the affected Instructor without undue delay after becoming aware of a Personal Data Breach affecting their Controller Personal Data.

11.2 RoadPath aims to give a first notice within 24 hours of becoming aware of the breach. This target does not replace the duty to notify without undue delay.

11.3 The notice shall include, as far as reasonably available: what happened; the categories of data and people affected; the likely impact; what has been or will be done to contain and fix it; and a contact for the incident.

11.4 Information not available at first shall be given in stages without further undue delay.

11.5 RoadPath shall cooperate with the Instructor in investigating and responding to the breach.

11.6 The Instructor decides whether to notify the ICO or affected individuals, subject to any legal duties that apply to RoadPath itself.

12. Compliance assistance

12.1 Taking account of the nature of processing and the information available to it, RoadPath shall reasonably help the Instructor with their obligations under Articles 32 to 36 UK GDPR: security of processing, breach assessment and notification, data protection impact assessments, and prior consultation with the ICO where required.

12.2 The parties shall cooperate in good faith to meet their legal obligations.

13. Retention, return and deletion

13.1 Controller Personal Data is kept for as long as needed to provide the Services, subject to the Instructor’s instructions and legal obligations. The periods are in Schedule 4.

13.2 RoadPath shall not keep Controller Personal Data indefinitely without a documented and lawful purpose.

13.3 When the Services end, RoadPath shall, at the Instructor’s choice, return or securely delete the Controller Personal Data, unless UK law requires it to be kept.

13.4 The Instructor can download a copy of any learner’s records in RoadPath at any time, and can ask for a copy of all their data before deletion.

13.5 RoadPath shall securely delete remaining copies except where the law requires them to be kept. Backup copies are protected, not used, and removed when the backups expire (Schedule 4).

13.6 Where the law requires data to be kept, RoadPath shall limit it to that purpose and period and tell the Instructor unless legally prohibited.

14. Audits and compliance information

14.1 RoadPath shall make available the information reasonably needed to show it meets its obligations under Article 28 UK GDPR.

14.2 RoadPath shall allow for and contribute to audits and inspections by the Instructor or an independent auditor the Instructor appoints.

14.3 Audits are carried out on reasonable notice (at least 30 days unless a breach makes a shorter period necessary), during normal working hours, and in a way that protects the confidentiality, security and rights of other customers.

14.4 RoadPath may first provide documentation, its Sub-processors’ independent assessments or other evidence of compliance. This does not remove the Instructor’s statutory audit rights.

14.5 Each party pays its own ordinary audit costs unless otherwise agreed or required by law.

15. AI-assisted processing and automated assessments

15.1 RoadPath uses automated rules, scoring and AI-assisted features to support lesson planning, learner progress, mock test analysis and the Instructor’s decisions.

15.2 These features operate only within the purposes and instructions in this Agreement.

15.3 RoadPath does not use identifiable learner records to train AI models, and its AI provider does not use data sent through its API for training.

15.4 Third-party AI providers that process Controller Personal Data are listed as Sub-processors in Schedule 3.

15.5 Readiness scores and mock test results are decision-support tools for Instructors. They are not DVSA assessments, driving test results or guarantees of passing.

15.6 The Instructor remains responsible for professional decisions about learner progress, readiness and instruction. RoadPath’s assistant suggests changes; nothing changes until the Instructor confirms it.

15.7 RoadPath shall give Instructors the information they need to assess automated decision-making rights and data protection risks.

16. Special category personal data

16.1 RoadPath is built for driving instruction and business management, not medical diagnosis or clinical record keeping.

16.2 Free-text notes may still contain information about disabilities, health conditions or other special category data.

16.3 The Instructor shall not enter such information unless it is necessary and lawful.

16.4 Where special category data is processed, the Instructor is responsible for an Article 6 lawful basis, an Article 9 condition and any additional UK requirements.

16.5 RoadPath processes such information only on the Instructor’s instructions and with appropriate safeguards.

16.6 RoadPath does not infer or generate medical diagnoses from driving performance.

17. Duration and termination

17.1 This Agreement applies while RoadPath processes Controller Personal Data for the Instructor.

17.2 Ending a subscription does not end obligations about confidentiality, lawful retention, return, deletion or other protections for personal data.

17.3 Processing after termination is limited to returning, deleting or lawfully keeping data.

18. Liability and governing law

18.1 Each party remains responsible for its own obligations under data protection legislation.

18.2 Nothing in this Agreement excludes or limits liability where the law does not allow it, or limits the powers of the ICO or the rights of Data Subjects.

18.3 Subject to the law, liability between the parties is governed by the liability terms of the Terms of Service.

18.4 This Agreement is governed by the law of England and Wales.

19. Acceptance and changes

19.1 This Agreement is accepted electronically when the Instructor creates a RoadPath account.

19.2 By accepting the Terms of Service, which include this Agreement, the Instructor appoints RoadPath as Data Processor on these terms.

19.3 RoadPath keeps a record of acceptance with the account, including the account identifier, the Agreement version and the time of acceptance.

19.4 RoadPath shall email Instructors about material changes to this Agreement at least 30 days before they apply, except changes needed to comply with the law.

Schedule 1: Description of processing

• Subject matter: providing the RoadPath driving instructor platform.
• Duration: for as long as the Services are provided, plus any lawful processing needed after termination (Schedule 4).
• Nature of processing: collection, recording, organisation, storage, retrieval, consultation, analysis, automated assessment, transmission where authorised, export and deletion.
• Purposes: lesson scheduling, learner management, progress assessment, diary administration, waiting list management, payments, messages and reminders, reporting and related features.

Categories of Data Subjects

• Learner drivers, including those aged 16 and 17.
• People on the Instructor’s waiting list.
• Parents, guardians or other people who pay for or are kept informed about a learner’s lessons.
• People who buy or receive gift vouchers.
• Other individuals whose information the Instructor lawfully enters.

Categories of personal data

• Names and contact details (email, phone).
• Addresses, postcodes and pick-up locations.
• Date of birth, gearbox type, test date and test centre where entered.
• Lesson bookings, attendance and cancellations.
• Lesson notes, performance observations and driving faults.
• DL25 assessment categories, mock test results, readiness scores and progress records.
• Lesson charges, payments, receipts, balances, blocks of hours and gift vouchers.
• Messages sent through RoadPath and replies, and records of agreement to be contacted.
• Possible special category data in free-text notes (clause 16).

Processing instructions: as set out in this Agreement, the subscribed Services and the Instructor’s actions and settings.

Schedule 2: Technical and organisational security measures

These are the measures in place on the effective date. RoadPath updates this Schedule when they change.

Schedule 3: Sub-processor register

Last changed: 30 October 2026. Changes are emailed to Instructors at least 30 days in advance (clause 8.3).

Stripe: card payments from learners go to the Instructor’s own Stripe account under Stripe’s terms with the Instructor, so Stripe acts for the Instructor directly rather than as RoadPath’s Sub-processor. Stripe is also used for RoadPath’s own subscription billing, where RoadPath is the controller (see the Privacy Policy).

Schedule 4: Retention and deletion