Privacy Policy & UK Data Protection Notice
This Privacy Policy explains how Pacific Cloud Computing Limited (trading as GrabTest) collects, encrypts, processes, and protects your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Data Controller Identity & UK GDPR Scope
1.1. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller responsible for your personal data is Pacific Cloud Computing Limited, operating the website grabtest.com (“Company”, “we”, “us”, or “our”).
1.2. We are committed to protecting the privacy and security of UK learner drivers, motorcycle candidates, Trainee Driving Instructors (PDIs), Approved Driving Instructors (ADIs), and vocational LGV/PCV drivers. We never sell, rent, or trade your personal data to third-party data brokers or external advertisers.
2. Categories of Personal Data We Collect
We apply strict data minimisation principles and collect only the information necessary to deliver your priority test slot alerts, statistical intelligence, and account management:
- Contact & Alert Routing Data: Your email address and UK mobile telephone number (
+44) used to deliver automated telephone voice call alerts, priority notification emails, and onboarding completion links. - Candidate & Instructor Exam Profile Data: Your selected UK exam category (Car Practical, Motorcycle Mod 1/2, ADI Part 2, ADI Part 3 / Standards Check, LGV/PCV, or Extended Test), up to three (3) preferred UK DVSA test centres, your 30-day availability calendar, your 16-digit UK Driving Licence Number, your DVSA Application / Booking Reference Number, and (for instructor tracks) your ADI Personal Reference Number (PRN) and optional 9-digit ADI Part 1 Theory Test Certificate Number.
- ADI Partner & Referral Data: For registered instructors, your name, email address, 5-digit referral code, referred pupil attribution logs, and commission payout records.
- Payment Verification Metadata: Transaction status, payment timestamp, and billing confirmation tokens provided by our PCI-DSS Level 1 accredited payment gateway. We never store or have access to your full credit/debit card number or CVV security code.
- Technical & Audit Logs: IP address, browser/device metadata, checkout consent timestamps, and automated voice/email dispatch logs required for security and anti-fraud compliance.
3. Lawful Basis & How We Process Your Personal Data
Under Article 6 of the UK GDPR, we process your personal data on the following lawful bases:
- Performance of a Contract (Article 6(1)(b) UK GDPR): To provision your £14.99 Priority Alert Pass, configure your test centre watchlists, place automated UK
+44voice call alerts, send priority notification emails and post-payment onboarding reminders, and calculate £5.00 ADI referral commissions. - Consent (Article 6(1)(a) UK GDPR & PECR): Where you register your UK
+44mobile number and email address to receive automated voice call and email notifications. You may withdraw or modify this consent (including setting Quiet Hours) at any time in your Candidate Portal. - Legitimate Interests (Article 6(1)(f) UK GDPR): To maintain platform security, prevent unauthorised scraping or account sharing, verify payment authenticity, and improve our UK test centre statistical models.
- Legal Obligation (Article 6(1)(c) UK GDPR): To comply with UK tax, accounting, anti-fraud, and statutory consumer protection obligations.
4. Strict Safeguards for Your Driving Licence & DVSA Reference Numbers
4.1. No Unauthorised GOV.UK Login or Bot Scraping: Unlike legacy cancellation bots that use candidate credentials to log into GOV.UK without supervision, we never use your 16-digit UK Driving Licence Number, DVSA Booking Reference, or ADI PRN to log into GOV.UK on your behalf or modify your existing test booking without your knowledge.
4.2. Your candidate credentials are used exclusively within our encrypted platform to verify your single-candidate pass eligibility, structure your exam category profile, and prepare your personalised “Open GOV.UK” self-service handover links so that you remain in 100% control of your official DVSA booking at all times.
5. Payment Processing & Telecommunications Infrastructure
To deliver reliable, low-latency alerts across the United Kingdom while protecting our proprietary system architecture, we partner with industry-certified infrastructure sub-processors bound by strict UK GDPR Data Processing Agreements (DPAs):
- PCI-DSS Level 1 Payment Gateways (Stripe & PayPal): All £14.99 checkout payments (including Visa, Mastercard, American Express, Apple Pay, Google Pay, and PayPal) are processed directly over encrypted TLS 1.3 connections by PCI-DSS Level 1 certified payment providers.
- Dedicated UK & European Telecommunications Voice Gateway: Routes our automated
+44British English telephone voice alerts to your registered UK mobile number. - Enterprise Transactional Email Delivery Network: Dispatches instant slot notification emails, GOV.UK handover links, and post-payment onboarding reminders with high inbox deliverability.
Where any sub-processor processes data outside the United Kingdom, we ensure full compliance with Chapter V of the UK GDPR via the UK International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses (SCCs).
6. Data Security, Retention Period & Instant Account Deletion
6.1. Technical Security Measures: All candidate records are protected using industry-standard encryption in transit (TLS 1.3) and at rest, strict role-based access controls, and automated security monitoring.
6.2. Retention Period: Active candidate alert profiles are retained for the duration of your 12-month pass. Accounts that remain inactive for more than twelve (12) months are automatically purged and anonymised, except where financial transaction records must be retained for up to six (6) years under UK HMRC tax law.
6.3. Self-Service Account Deletion: You can permanently delete your candidate profile and stop all voice and email alerts at any time using our instant Delete Account (/delete-account) tool or inside your Candidate Portal (/portal).
7. Your UK GDPR Data Subject Rights & Supervisory Authority
Under the UK GDPR and the Data Protection Act 2018, you have the statutory right to:
- Right of Access (Subject Access Request): Request a copy of the personal data we hold about you;
- Right to Rectification: Update or correct your email address, UK mobile number, driving licence number, or test centre preferences at any time;
- Right to Erasure (“Right to be Forgotten”): Request immediate deletion of your candidate profile;
- Right to Restrict or Object to Processing: Pause or opt out of automated
+44voice calls or emails with a single click; and - Right to Data Portability: Receive your profile data in a structured, machine-readable format.
To exercise any of these rights, please contact our Data Protection Desk via /contact or email [email protected]. We respond to all verified requests within 72 hours (and always within the statutory 30-day limit). You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) (ico.org.uk), though we encourage you to contact us first so we can resolve your query immediately.