Privacy Policy

Data Controller

The data controller responsible for your personal data is Permio Ltd, registered in England and Wales (Company No. 15482309). Registered address: 128 City Road, London, EC1V 2NX, United Kingdom. For data protection enquiries, contact our Data Privacy team at privacy@permio.com.

1. Information We Collect

When you apply for an International Driving Permit through Permio, we collect the information necessary to process your application. This includes your full legal name, date of birth, home address and delivery address, contact email address and phone number, a copy or photograph of your current driving licence, a passport-style photograph, and payment information (processed securely by Stripe — we do not store card details).

We may also collect technical information when you visit our website, including your IP address, browser type, device information, and pages visited. This is collected via cookies and analytics tools (Google Analytics) to improve our service.

2. How We Use Your Information

We use your personal information to process and issue your International Driving Permit, verify your identity and driving licence validity, deliver your permit (digital and physical), communicate with you about your application, comply with legal obligations, and improve our services and website.

We do not sell your personal information to third parties. We do not use your data for advertising profiling. We do not share your information with anyone except the parties necessary to fulfill your application (payment processor, shipping provider, verification partner).

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Contract performance (Article 6(1)(b)): Processing your IDP application, verifying your documents, issuing and delivering your permit, and communicating with you about your order.
• Legitimate interest (Article 6(1)(f)): Fraud prevention, service security, and improving our services and website functionality.
• Consent (Article 6(1)(a)): Sending marketing communications and newsletters. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): Retaining tax, financial, and transaction records as required by law.

4. Data Retention

We retain your application data for 7 years from the date of issue to comply with legal and regulatory requirements. After this period, your data is securely deleted. You may request early deletion of non-essential data at any time by contacting us, subject to legal retention obligations.

5. Your Rights (GDPR)

If you are located in the European Economic Area or United Kingdom, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data (subject to legal retention obligations), object to or restrict processing of your data, request portability of your data in a machine-readable format, and withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@permio.com. We will respond within 30 days.

6. Cookies

We use essential cookies required for the website to function, analytics cookies (Google Analytics) to understand how visitors use our site, and preference cookies to remember your settings. You can control cookies through your browser settings. Disabling cookies may affect some functionality of the site.

7. Data Security

We use industry-standard security measures to protect your data, including SSL/TLS encryption for all data in transit, encrypted storage for sensitive documents, access controls limiting who can view your data, regular security audits, and PCI DSS compliant payment processing via Stripe.

8. Third-Party Services

We use the following third-party services to operate our business: Stripe (payment processing), Supabase (database and authentication), Google Analytics (website analytics), SendGrid by Twilio (transactional email delivery), and shipping carriers (physical delivery). Each of these providers acts as a data processor on our behalf and has their own privacy policy and data practices.

9. International Data Transfers

Some of the third-party services we use are based outside the European Economic Area (EEA). Where your data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Stripe (United States): Certified under the EU-US Data Privacy Framework.
• Supabase (United States): Transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.
• SendGrid by Twilio (United States): Transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Contact

For privacy-related enquiries or to exercise your data rights, contact our Data Privacy team at privacy@permio.com. We aim to respond to all privacy requests within 5 business days.