Draft wording, not yet in force. This page is a starting point for the operator and their legal adviser. It has not been reviewed, it does not yet state the terms of any contract, and no orders can be placed while it stands unconfirmed.
This policy explains what [trading name to be confirmed] does with your personal data when you order a vehicle history report from this website.
What we hold
- The vehicle registration you entered. In the context of an order this identifies a vehicle and, indirectly, a person, so we treat it as personal data.
- Your order: the email address and billing details you gave at checkout, the amount paid, and the version of our terms you accepted.
- Delivery facts: when your order was paid for, when your report was delivered, and when a delivery email failed or was resent.
- The report itself, as a file.
- An audit record of what our staff did with your order and when.
We do not hold your card details. Payments are taken by our payment provider and we see only the outcome.
Why we hold it
To research and deliver the report you paid for and to support your order; to keep the financial and audit records we are required to keep; and to secure the service against abuse.
We do not use your details for marketing, we do not add you to a mailing list, and we do not sell, rent or share them with anyone who wants to sell to you.
How the report is kept
Report files are stored privately, outside the public part of this website, under names that cannot be guessed. There is no public web address for a report. The link we email you is signed, works only for your order, and expires. We can revoke it and issue a new one at your request.
Who else sees it
Our own staff, limited to those working on fulfilment and support; our payment provider, for the payment; our email provider, for the delivery message; and our hosting provider, which holds the site and its backups. We disclose data otherwise only where the law requires it.
How long we keep it
Orders and the audit record are kept for as long as our financial and accounting obligations require. Report files are kept while they may still be needed for support, and are deleted when you ask us to erase your data.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask us to erase it. Email [support address to be confirmed].
When you ask for erasure we delete the stored report, the registration and the contact details held against your order, and any download link already sent to you stops working. We keep the order itself, its totals and the audit record: we are required to retain financial records, and an audit record that can be deleted on request would not be an audit record. We will tell you exactly what was removed and what was kept.
You can also complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.
For the operator: before publication this policy needs the data controller’s legal name and address, the lawful bases named per purpose, the actual payment, email, hosting and analytics processors and where they store data, the retention periods your accountant requires, and a decision on whether a data protection officer or ICO registration applies. Nothing above is invented: the processors and periods are described in general terms precisely because they must be filled in by you.