Indian Regulatory Compliance

Privacy Policy

Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act), Information Technology Act, 2000, and SPDI Rules, 2011.

Effective DateSeptember 2026Jurisdiction: India

Notice to Users, Driving School Academies, and Learners

DriveBloom ("Platform", "we", "us", or "our") provides cloud-based driving school management software designed for motor driving training academies registered under the Motor Vehicles Act, 1988 and Central Motor Vehicles Rules (CMVR), 1989 across the Republic of India. This Privacy Policy informs Data Principals (driving academy owners, instructors, and learners/students) about how personal data is collected, processed, protected, and retained in strict adherence to Indian legal guidelines.

1. Legal Framework & Statutory Governance

This Privacy Policy is drafted and published in compliance with the following statutory provisions of the Republic of India:

The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023): Regulating the lawful processing of digital personal data respecting individual privacy rights.
The Information Technology Act, 2000 (IT Act): Specifically Sections 43A and 72A addressing compensation for failure to protect sensitive data and disclosure of information.
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).
The Motor Vehicles Act, 1988 and Central Motor Vehicles Rules, 1989 (CMVR): Mandating driving school records, student registers, syllabus logs, and instructor certifications under Rules 24 to 32.

2. Roles under the DPDP Act (Data Fiduciary vs. Data Processor)

In the context of the DriveBloom SaaS platform:

Driving School Academy

Acts as the Data Fiduciary who determines the purpose and means of collecting learner enrollments, instructor records, and training attendance.

DriveBloom Platform

Acts as the Data Processor providing cloud software, database isolation (Row Level Security), and secure communication infrastructure to process records on behalf of the academy.

3. Categories of Personal Data Collected

We only collect digital personal data that is strictly necessary to administer driving training operations:

A. Student / Learner Data:Full Name, Mobile Phone Number, Email Address, Date of Birth (to verify statutory minimum age eligibility under Section 4 of the Motor Vehicles Act), Structured Address (Street, City, State, Pincode), Learner Licence (LL) or Driving Licence (DL) number, Course Package chosen, Training Hours, Attendance Logs, Instructor Feedback, and Account Activation credentials.

B. Instructor / Staff Data:Full Name, Mobile Number, Email Address, Certified Driving Licence Number and Expiry, Commercial Driving Instructor Accreditation, Assigned Vehicle, and Teaching Schedule Logs.

C. Academy / School Owner Data:Business Name, RTO Driving School Licence Number, Business Address, GSTIN (if applicable), Fleet Vehicle Details (Registration Numbers, Dual-Control pedal confirmation), and Contact Details.

D. Technical & Session Data:IP Address, Browser Type, Session Authentication Tokens (stored via secure HTTP-only cookies), and Device Identifiers used for PWA functionality.

4. Lawful Grounds & Purpose of Processing

Under Section 4 and Section 6 of the DPDP Act, personal data is processed solely for specified, explicit, and lawful purposes based on consent or legal obligations:

Registering driving schools, allocating daily lesson slots, and preventing vehicle double-booking.
Maintaining statutory attendance and practical driving hour registers as required under Rule 27 of Central Motor Vehicles Rules (CMVR).
Delivering automated account activation emails and timetable notifications to learners and instructors.
Ensuring multi-tenant security isolation and preventing unauthorized access to academy data.
Complying with lawful audits by Regional Transport Offices (RTOs) or judicial directions under Indian law.

5. Special Provisions for Minors (Learners Aged 16 to 18)

Compliance with Section 9 of the DPDP Act & Motor Vehicles Act

Under Section 4(1) of the Motor Vehicles Act, 1988, individuals who have completed 16 years of age may apply for a learner's licence to drive a motorcycle without gear (engine capacity not exceeding 50cc) with the consent of the parent/guardian. In compliance with Section 9 of the DPDP Act:

Driving school owners must obtain verifiable consent from the parent or lawful guardian before enrolling students under 18 years of age.
DriveBloom strictly prohibits behavioral monitoring, targeted profiling, or advertising directed at children or minors.

6. Reasonable Security Practices & Data Storage

In compliance with Section 8(5) of the DPDP Act and Rule 5 of the SPDI Rules, 2011, DriveBloom implements robust administrative, technical, and physical safeguards:

AES-256 & TLS 1.3End-to-end encryption in transit and rest.

Row Level Security (RLS)Strict multi-tenant cryptographic isolation.

Indian Data ResidencyData stored on secure cloud nodes in India.

7. Rights of Data Principals under DPDP Act

Every user (student, instructor, or academy owner) possesses the following statutory rights under Chapter III of the DPDP Act:

Right to Access: The right to obtain a summary of personal data processed, identities of entities with whom data is shared, and details of processing.

Right to Correction & Erasure: The right to request correction of inaccurate data, completion of incomplete data, or erasure of personal data that is no longer required for statutory purposes.

Right of Grievance Redressal: The right to register a grievance with the Grievance Officer and receive an expeditious response.

Right to Nominate: The right to designate any individual to exercise data rights in the event of death or incapacity.

Right to Withdraw Consent: The right to withdraw consent at any time, with the understanding that withdrawal does not affect processing conducted prior to withdrawal.

8. Data Retention & Deletion Schedule

Personal data is retained only for the duration necessary to satisfy the purpose of collection or statutory requirements:

Student training logs and attendance are retained for the duration of course completion and subsequent audit periods mandated by State Transport Authorities / RTO.
Upon school account termination or written deletion request, personal data is purged within 30 days, except records required to be retained under Indian taxation, corporate, or transport statutes.