Western Driving School is an FRSC-certified driving school in Sangotedo, Lekki, Lagos. This policy explains what personal information we hold about you, why we hold it, who we share it with, and what you can ask us to do with it. It covers both westerndrivingschool.cloud and the Western Driving School mobile app.
1. Who we are
Western Driving School is the data controller for the information described in this policy. That means we decide what is collected and what it is used for, and we are responsible for looking after it.
We handle personal information in line with the Nigeria Data Protection Act 2023.
2. What information we collect
Information you give us when you enrol
You provide this when you register on our website, in our office, or through the mobile app:
- Identity: first name, surname, date of birth, gender, nationality, and National Identification Number (NIN)
- Contact: phone number, email address, residential address, city, state, and local government area
- Emergency and record details taken at enrolment: next of kin phone number, blood group, and mother's maiden name (the last is used only to confirm your identity if you contact us to recover an account)
- Course choices: vehicle type, transmission, training duration, and payment plan
Information created while you train with us
- Lesson attendance records and your progress through the course
- Training status, and the certificate number issued when you complete the programme
- Payment records: amounts, dates, payment plan, payment reference, and the status of each payment
- Payment proof images that you or your representative upload, for example a photograph or screenshot of a bank transfer receipt
Information for your mobile app account
- Your phone number, which is your login
- Your password, which we store only as an irreversible cryptographic hash. We never store, and cannot read, your actual password.
- A one-time code sent to your registered email address when you reset a forgotten password
- A device notification token issued by Google Firebase, so we can send you notifications. It identifies your app installation, not you personally.
What we do not do. The Western Driving School app contains no advertising, no advertising identifiers, and no third-party analytics or tracking software. We do not track you across other apps or websites, we do not build advertising profiles, and we never sell your personal information to anyone.
3. Why we use your information
We use your information only for the purposes below, and each has a lawful basis under the Nigeria Data Protection Act 2023:
- To deliver the driving course you paid for, including scheduling lessons, recording attendance and tracking your progress. Basis: performance of our contract with you.
- To process your payments and keep an accurate record of what has been paid and what is outstanding. Basis: performance of our contract, and our legal obligation to keep business records.
- To submit the details required for your FRSC certification and your Nigerian driver's licence application. Basis: performance of our contract, and legal obligation.
- To run your app account, including signing you in, keeping you signed in securely, and letting you reset a forgotten password. Basis: performance of our contract.
- To contact you about your lessons, payments, certificate and account, by phone, WhatsApp, email or in-app notification. Basis: performance of our contract, and our legitimate interest in keeping students informed.
- To keep our systems secure and to detect and prevent misuse of accounts. Basis: our legitimate interest in protecting students' data.
4. What the mobile app stores on your device
So the app still shows your real figures when your connection is poor, it saves the last successful response from our server on your phone. This saved copy is deliberately limited.
- What is saved: your name, your course, your fees, the amount paid, your balance, your phone number, your email address and the relevant dates. In other words, only what the screens actually display, always shown with the date it was last updated.
- What is deliberately not saved: your NIN, date of birth, residential address, mother's maiden name, blood group and next of kin phone number. The app filters these out before anything is written to your device, because no screen in the app displays them.
- Your session tokens are held separately in the operating system's encrypted secure storage, not alongside the saved data above.
- On Android, the saved data is excluded from cloud backup and from device-to-device transfer, so it does not travel to a new phone.
- It is cleared when you log out, when you delete your account, and when you uninstall the app.
5. Camera and photo access
The app asks for permission to use your camera or your photo library for a single purpose: so you can photograph or select a receipt and upload it as proof of payment. We access nothing else in your photo library, and the app never opens your camera on its own. If you decline the permission, every other part of the app continues to work, and you can still submit proof of payment through our website or in the office.
An uploaded proof image is stored on our server outside the public web root and is not publicly accessible. It can only be viewed through a link that expires, which is issued to our office staff for the purpose of verifying your payment.
6. Push notifications
With your permission, we send notifications about your lessons, payments and certificate through Firebase Cloud Messaging, a service provided by Google. To do this, Firebase issues a token that identifies your app installation, and we store that token against your account so the message reaches the right device. You can turn notifications off at any time in your phone's settings, and everything else in the app will continue to work.
7. Who we share your information with
We do not sell your personal information, and we do not share it for advertising. We share it only in these cases:
- The Federal Road Safety Corps (FRSC) and the associated licensing bodies, with the details required to certify your training and process your driver's licence. This is the core reason you enrolled.
- Google (Firebase Cloud Messaging), which delivers push notifications to your device.
- Our email provider, which delivers transactional messages such as password reset codes and payment confirmations.
- Our hosting provider, which operates the server where our systems and data are held.
- Where the law requires it, for example in response to a lawful request from a regulator, a court, or law enforcement.
These providers process data on our instructions and for the purposes above only.
8. How long we keep your information
- Training and certification records are kept for as long as we are required to hold them for FRSC certification purposes and to answer later queries about a certificate we issued.
- Payment records are kept for as long as required for our accounting and tax obligations.
- App account details are kept while your account is active, and are deleted when you ask us to close it. See section 10.
- Payment proof images are kept while the payment they support remains on record.
When information is no longer needed for any of the purposes in this policy, we delete it or remove the details that identify you.
9. Your rights, and how to use them
Under the Nigeria Data Protection Act 2023 you have the right to:
- Ask what personal information we hold about you, and get a copy of it
- Have inaccurate or incomplete information corrected
- Ask us to delete your information, where we are not required to keep it
- Object to a particular use of your information, or ask us to restrict it
- Withdraw a consent you previously gave, such as consent to notifications, at any time
- Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your information
To use any of these rights, email info@westerndrivingschool.cloud or call the office. We will respond within 30 days. Because these records concern your identity documents and your money, we will first confirm who you are, normally by asking for your date of birth and your mother's maiden name as recorded at enrolment, or by asking to see photo identification. We do this to make sure nobody else can obtain or change your records.
10. Deleting your account
You can delete your mobile app account yourself, directly in the app: open the More tab, choose Delete account and confirm. This takes effect immediately and also removes the app's saved data from your device.
You can also ask us to delete it for you. Email info@westerndrivingschool.cloud from your registered address, or call the office, and ask for your app account to be deleted. Once we have confirmed your identity we will delete it, and confirm to you when it is done.
Deleting your app account removes your login, your password and your saved data on the device. It does not, on its own, erase your training and payment records, because we are required to keep those for FRSC certification and for our accounting obligations. If you want those records erased as well, say so in your request and we will tell you what we are able to delete and what we must keep, and why.
11. How we protect your information
- All traffic between the app, the website and our servers is encrypted in transit using HTTPS.
- Passwords are stored only as irreversible hashes, never as readable text.
- Access to student records in the app requires you to be signed in, and each student can reach only their own record.
- Payment proof images are stored outside the public web root and are reachable only through links that expire.
- Access to our office systems is restricted to authorised staff, and destructive actions require an administrator password.
No system can be guaranteed completely secure, but we review these protections regularly and improve them as our systems change.
12. Children
Our courses and our app are intended for people old enough to be issued a Nigerian driver's licence. The app is not directed at children, and we do not knowingly create app accounts for children. Where a young person trains with us with the involvement of a parent or guardian, their records are handled under this policy, and the parent or guardian may exercise the rights in section 9 on their behalf. If you believe a child has created an account, contact us and we will remove it.
13. Changes to this policy
If we change what we collect or how we use it, we will update this page and change the "Last updated" date at the top. Where a change materially affects you, we will tell you directly, by email or through the app. The version published on this page is always the current one.
For any question about this policy, or to exercise any of the rights in section 9:
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC).
