Privacy Notice
Compulsory Basic Training (CBT) for Motorcyclists
Who is responsible for your personal data?
The Minister for Transport, acting through the Driver and Vehicle Licensing Department (DVLD), is the data controller for the personal data you provide when applying for Compulsory Basic Training (CBT).
You can contact the DVLD at:
- Address: Driver and Vehicle Licensing Department, HM Government of Gibraltar, Eastern Beach Road Gibraltar
- Email: DVLD@gibraltar.gov.gi
- Telephone: 20050287
Motorcycle Pitstop is collecting your personal data on behalf of the Ministry of Transport. Pitstop is a data processor whose instructor, Mr Aaron Vella, has been authorised to provide CBT training and examination services under the Traffic (Compulsory Basic Training) Regulations 2013. Pitstop processes your data only in accordance with the Ministry's instructions.
What personal data do we collect?
| Data Type | Examples |
|---|---|
| Identity information | Your full name, ID card number, date of birth, and age. |
| Contact information | Your address, telephone number, and email address. |
| Medical information | Your medical declaration confirming you are fit to undertake CBT training. |
| Training information | Your booking dates, the modules you are enrolled in, modules you have passed, and your examination results. |
| Payment information | Records of any training fees you have paid (where applicable). |
Why do we need your personal data?
- Register you for CBT training;
- Schedule your training sessions and examinations;
- Record your progress and examination results;
- Issue your CBT certificate and Module 3 permit (where applicable);
- Maintain records as required by law; and
- Contact you about your training.
We also use your date of birth or age to ensure that training classes are appropriately composed. By law, different CBT modules have different minimum age requirements:
- Modules 1 and 2: You must be at least 16 years and 6 months old.
- Module 3: You must be at least 17 years old.
We ensure that trainees under 18 are not mixed with trainees aged 18 and over in the same training class.
What is our legal basis for using your data?
Our legal basis for processing your personal data is Article 6(1)(e) of the Gibraltar GDPR: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
The relevant laws are:
- The Traffic Act 2005; and
- The Traffic (Compulsory Basic Training) Regulations 2013.
For medical declaration information (which is special category data), our legal basis is Article 9(2)(g) of the Gibraltar GDPR, read with paragraph 6 of Schedule 1 to the Data Protection Act 2004 (statutory and government purposes). The processing of your medical declaration is necessary for the exercise of the Ministry of Transport's statutory functions under the Traffic Act 2005 and the Traffic (Compulsory Basic Training) Regulations 2013, which require you to confirm your medical fitness before undertaking CBT training.
Who do we share your data with?
| Recipient | Purpose |
|---|---|
| Motorcycle Pitstop | Delivers your CBT training and examinations on behalf of the Ministry, and issues CBT certificate and Module 3 permit. |
| Driver and Vehicle Licensing Department (DVLD) | Processes your CBT certificate, Module 3 permit, and maintains official records. |
We do not share your personal data with anyone else unless required by law.
Where is your data stored?
Your personal data is stored in Gibraltar. We do not transfer your data outside Gibraltar.
How long do we keep your data?
If you successfully complete CBT: We will retain your personal data for as long as you remain eligible to hold a driving licence under the Traffic Act 2005. Your CBT record is evidence that you have completed a statutory prerequisite for the issue of a learner's licence and, ultimately, a full driving licence. We will retain your CBT records for so long as they remain relevant to your driving licence entitlement.
If you do not complete CBT: Under Regulation 6(3) of the Traffic (Compulsory Basic Training) Regulations 2013, you must complete all three CBT Modules within 30 months from the commencement of Module 1. If you do not complete the course within this period, all Modules must be retaken. We will retain your personal data for 1 year following the expiry of the 30-month completion period (i.e., up to 42 months from the date you commenced Module 1), after which your records will be securely destroyed.
What are your rights?
| Right | Description |
|---|---|
| Access | You can ask for a copy of the personal data we hold about you. |
| Rectification | You can ask us to correct any personal data that is inaccurate or incomplete. |
| Erasure | In certain circumstances, you can ask us to delete your personal data. |
| Restriction | You can ask us to limit how we use your personal data. |
| Objection | You can object to our processing of your personal data. |
| Data portability | You can ask to receive your personal data in a commonly used electronic format. |
To exercise any of these rights, please contact the DVLD using the contact details above. We will respond to your request within one month.
Please note that some of these rights are not absolute. For example, we may not be able to delete your data if we are required by law to keep it.
How to complain
- Contact the DVLD using the details above to raise your concern; or
- Lodge a complaint with the Gibraltar Regulatory Authority (GRA) at gra.gi
Changes to this privacy notice
We may update this privacy notice from time to time. Any changes will be posted on this page.
This privacy notice was last updated on 02 March 2026.
For Pitstop's own privacy policy regarding other services (unrelated to CBT), please see privacy policy.
Start Your CBT Journey today
Take the next step in your professional journey—enroll in CBT training.
