Privacy

A registration number can be personal data

A vehicle registration does not name anybody, but it can identify a person indirectly, so we treat it as personal data rather than arguing about it.

What that means in practice is that we do not publish who checked what, report addresses are random references rather than registrations so they cannot be guessed, and those pages carry a directive telling search engines not to index them.

What we collect, and why

Only what the service needs to work.

• The registration you enter, and the report produced from it. Needed to provide the service. Legal basis: contract, or our legitimate interest in providing a free check you asked for.
• Your IP address. Used to rate limit and to detect abuse of the free checks, which protects finite supplier quota. Legal basis: legitimate interests.
• Your email address, when you buy a report or create an account. Used to send the report, the receipt and the statutory confirmation, and to answer support. Legal basis: contract.
• Your name and password, if you create an account. Legal basis: contract.
• Payment records: the amount, currency, status and the payment provider's reference. Legal basis: contract, and legal obligation for tax records. We never receive or store card numbers.
• Vehicles you save to My Garage, and whether you asked for reminders. Legal basis: contract for the garage, consent for the reminders, which you can withdraw at any time in your settings.

Who else sees it

Running a check means asking somebody else about the vehicle. The registration is sent to whichever registers the check covers, and nothing else about you goes with it.

• The DVLA, for vehicle details and tax status.
• The DVSA, for MOT history.
• Our provenance supplier, for finance, stolen and write-off records. Paid checks only.
• Stripe and PayPal, whichever you pay with. The one you use processes the payment and receives your email address for the receipt, and is a separate controller for its own purposes; see stripe.com/privacy and paypal.com/privacy.
• Our email delivery provider, which handles messages we send you.
• Our hosting provider, which stores the data on our behalf under contract.

What we deliberately do not do

This list is short and it is the part worth reading twice.

• We do not sell personal data, and we do not share it for anybody else's marketing.
• We do not sell or share your data for advertising. We do use Google Analytics to count how the pages are used, and only if you agree: nothing loads and no cookie is set until you say yes, and saying no is remembered.
• We do not hold or display the names or addresses of vehicle keepers. Keeper history in a paid report is dates only.
• We do not use your data to make automated decisions with legal or similarly significant effects.

Cookies

Analytics cookies are set only if you agree, and you are asked before anything loads. Your answer, either way, is remembered so you are not asked again. The cookies are these:

We count visits ourselves, without cookies. A visit is identified by a one-way code made from your address, your browser description and a secret that changes every day, so the same person on two days cannot be connected and the code cannot be turned back into an address. We do not store your address or your browser description, and any registration you looked up is removed from the page address before it is recorded. It is kept for 90 days. Because nothing stored identifies you, this needs no consent and there is nothing here to ask us to delete.

• A session cookie, which keeps you signed in and protects forms against cross-site request forgery. Strictly necessary.
• A cross-site request forgery token, which pairs with the session cookie. Strictly necessary.
• An appearance cookie, which remembers whether you chose light or dark. Set only when you change it.
• A sidebar cookie, which remembers whether you collapsed the sidebar. Set only when you change it.
• A consent cookie, which remembers whether you agreed to analytics. It holds a yes or a no and nothing else, and it is set whichever way you answer.
• Google Analytics cookies, set ONLY after you agree. They count visits and pages. They never receive a registration you looked up, and we do not use them to advertise to you.

How long we keep things

Keeping data longer than it is useful is a liability rather than an asset.

• A free check you ran without buying anything: kept for at least 12 months so you can return to it, then removed in a periodic clear-out, unless you saved the vehicle to a garage.
• A report you paid for: kept for as long as the order it belongs to, so you always have access to what you bought.
• Orders, payments and the consent record attached to them: six years after the end of the relevant financial year, which is the period HMRC requires for tax records.
• Account details and saved vehicles: until you delete your account, which you can do yourself at any time.
• Supplier call logs, used to reconcile invoices and diagnose failures and holding no personal data: 12 months.
• Server logs including IP addresses: 90 days.

Your rights

Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can withdraw consent for reminders at any time without affecting anything else.

Write to privacy@motorfacts.co.uk and we will respond within one month. We do not charge for this.

Deleting your account removes your account, your saved vehicles and your reminders straight away. Purchase records are kept for the tax period above, because we are required to, and are then deleted.

If you think we have handled your data badly, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you do not have to come to us first.

Where the data is held

Our systems are hosted in the United Kingdom. Some of our providers, including Stripe and PayPal, may process data outside the UK. Where that happens it is covered by the safeguards UK data protection law requires, such as the UK addendum to the standard contractual clauses.

Security

The site is served only over HTTPS. Passwords are stored hashed and are not recoverable, by us or by anyone else. Two-factor authentication and passkeys are available on accounts and we recommend using one.

Access to customer data by our own staff is restricted by role, and the roles that can see commercial data are separate from the ones used to answer support questions.