Privacy notice

Draft for review.This page is waiting for legal review and may change.

CheapNumberPlates is the controller of the personal data described here. Contact us at [email protected] about anything in this notice.

What we collect and why

• Your account: name, email and a securely hashed password, so you can sign in, save favourites and searches, and see your orders.
• Orders: the registration, and the name and address of the person it's for (DVLA puts these on the certificate), so we can secure the registration and help you assign it. We keep order records for 6 years for tax and accounting.
• Putting it on your vehicle: if you ask us to, we take the vehicle's registration and its V5C logbook reference number. We use them only to assign the registration, and delete the logbook number as soon as that's done or the order is cancelled.
• Payments: handled by Stripe. We never see or store your full card number.
• Vehicle checks: when you check whether a plate fits your vehicle, we look up its first registration date with DVSA. We don't store the result.
• Emails: order updates; alerts about new matching plates if you save a search, and price or status news about your favourites; certificate renewal reminders for plates you add; one request to review an order; and, if you start buying a plate but don't finish, one reminder while it's still for sale. You can turn alerts and checkout reminders off in your account at any time.

Who we share it with

DVLA (to register the plate in your nominee's name), Stripe (payments), Resend (sending email), Twilio (text messages, if you turn them on), Cloudflare (the spam check on our contact form, which looks at your browser and connection to tell people from bots) and Railway (hosting). Each processes data only on our instructions. We don't sell your data.

Cookies

We use a cookie to keep you signed in, which is strictly necessary. Optional cookies, used for our own analytics (which pages lead to an order) and to test how we show prices, are only set if you allow them in the cookie banner. Analytics data stays on our servers, isn't shared, and is deleted after 26 months. Without them we count page views with no identifier. The contact form's spam check (Cloudflare) may use cookies or similar technology for security only. We don't use advertising cookies. See cookies for the full list and to change your choice.

How long we keep it

• Orders: 6 years, for tax. After that we remove the names, addresses and messages from them.
• Photos of documents (proof of identity for number plates, or of owning a registration you're selling): only our team sees them. Proof of ownership is deleted 90 days after the listing ends; identity documents 30 days after a cancelled order, or 3 years after we checked them (the legal minimum for plate suppliers).
• Accounts never confirmed and never used: deleted after 90 days. Items left in a basket: removed after 90 days.
• Offers on private plates that didn't lead to a sale: deleted after 2 years. Turned-down trade account applications: after a year.
• Analytics: 26 months. Server error records: 90 days.
• Newsletter: only if you sign up and confirm by email. We keep your address and when you confirmed, as a record of your consent, until you stop the emails (every one has a link) or delete your account. If an email bounces, or you mark one as spam, we stop sending optional emails to you.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. If you have an account, you can download your data or delete your account yourself, under Your data in your account. Deleting it removes everything except the records of your orders, which we must keep for 6 years for tax. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).