Privacy Policy
Last updated: 2026-08-19
VDS Pro is operated by CGA Simulation Limited (company number 07787094), registered at 37-45 Windsor Street, Liverpool, L8 1XE. Contact us at support@vdspro.net.
Younger learners can read our short privacy guide.
Who is responsible
- For Family accounts and direct customers, CGA Simulation Limited is the data controller.
- For a school, college, driving school, employer, or other managed organisation, that organisation normally controls learner records and CGA processes them on its instructions.
- CGA remains a controller for its own billing, account security, fraud prevention, support, and legal records.
Information we use
- Account: name, email, user ID, age-assurance basis, policy acceptance, and sign-in records.
- Learning: lesson and course activity, answers, scores, attempts, play time, driving events, achievements, certificates, assignments, assessor feedback, and progress.
- Organisation: membership, role, invitations, class or cohort information, reporting settings, and audit history.
- Payments: plan, subscription status, invoices, and Stripe customer or subscription references. CGA does not receive full card details.
- Support and diagnostics: support messages, application version, platform, controller and wheel configuration, technical logs, crash information, and files you choose to upload.
- Security: IP address, browser or device information, request history, session identifiers, and security events.
Please do not put health information or other sensitive personal information into free-text notes or diagnostic uploads.
Why we use it
- Contract: to create accounts, provide simulator access, save progress, deliver reports, and manage subscriptions.
- Legitimate interests: to secure, support, troubleshoot, and improve the service, where those interests are not overridden by your rights.
- Legal obligation: for tax, accounting, fraud prevention, lawful requests, and data-protection duties.
- Consent: where we specifically ask for an optional use. Consent can be withdrawn at any time.
- For organisation-managed learners, we also process information on the organisation's documented instructions and lawful basis.
Children and young people
Family owners and organisation account owners must be adults. A person aged 13 to 17 may have a separate learner login with parent or guardian awareness. For a child under 13, the account must be created and managed by a person with parental responsibility, or be provided through a school or other organisation with an appropriate lawful basis. We record the type of age or authority declaration, not a copy of an identity document.
We do not use learner data for advertising and do not make decisions with legal or similarly significant effects solely by automated means.
Who receives information
- Your organisation: authorised instructors, managers, and administrators can see the learner information needed for teaching, safeguarding, assessment, and reporting.
- AWS: hosting, database, file storage, sign-in, and transactional email.
- Stripe: subscription and payment processing.
- Professional advisers or authorities: only where necessary to meet legal obligations, protect rights, or respond to a lawful request.
We do not sell personal information or use it for third-party advertising.
International transfers
Some AWS and Stripe processing may take place outside the UK. Where required, we use the provider's data-processing terms and recognised transfer safeguards, such as the UK International Data Transfer Addendum or an adequacy regulation.
How long we keep information
- Account and learning records are kept while the account or organisation relationship is active.
- Uploaded diagnostics and wheel-controller reports are normally deleted within 90 days.
- Routine application and security logs are normally retained for up to 30 days, unless needed to investigate an incident.
- Support records are normally retained for up to two years after the issue closes.
- Financial and transaction records may be retained for up to seven years where required for tax and accounting.
- After account deletion, identifying account and membership fields are anonymised. Learning totals may remain anonymously where an organisation needs an accurate historical report.
- Encrypted backups expire through their normal rotation rather than being altered individually. Deleted information is not restored to live use.
Your choices and rights
- Download your account information or request deletion from Your Account.
- Ask us to correct information, restrict or object to processing, or provide portable information.
- Withdraw consent where consent is the basis being used.
- For an organisation-managed account, contact the organisation first about learning records; CGA will assist it with your request.
- Complain to the Information Commissioner's Office at ico.org.uk.
Cookies and security
We use essential cookies for sign-in, security, and form protection. We do not use third-party advertising cookies. We use access controls, encryption in transit, restricted administration, audit records, and backups to protect information, but no online service can promise absolute security.
Contact
Email support@vdspro.net or write to CGA Simulation Limited, 37-45 Windsor Street, Liverpool, L8 1XE. We normally respond to data-rights requests within one month.