Privacy policy

This notice explains how Numberplater Ltd collects, uses and protects your personal data — including the identity and entitlement documents we’re legally required to check before making a number plate.

Who we are

Numberplater Ltd (Company No. 17202692), registered in England & Wales, is the data controller for the personal data described here. We’re a DVLA Registered Number Plate Supplier (RNPS No. 75456), registered office 42 Dorset Road, London, E7 8PS. For any data question or request, email support@numberplater.co.uk.

What we collect

Order & contact details — your name, delivery address, email, phone and order information.
Payment information — taken and processed by our payment provider (Shopify). We don’t store your full card details.
RNPS verification documents (sensitive) — the identity and entitlement documents you upload (e.g. photo ID, V5C logbook) so we can confirm you’re entitled to the registration, as the law requires of a registered supplier. We handle these with extra care.
Technical data — a session identifier and basic, privacy-friendly usage data needed to run and secure the site.

Why we use it, and our lawful basis

Contract (UK GDPR Art. 6(1)(b)) — to take, make and deliver your order, take payment and provide customer service.
Legal obligation (Art. 6(1)(c)) — to verify your identity and entitlement to the registration and to keep the sale record, as required of a DVLA registered supplier.
Legitimate interests (Art. 6(1)(f)) — preventing fraud and misuse, and keeping our site secure.
Consent (Art. 6(1)(a)) — only if you opt in to marketing; you can withdraw at any time.

Your verification documents

Your ID and entitlement documents are encrypted in transit and at rest on UK/EU infrastructure, used only to verify your order and meet our record-keeping duty, and never used for marketing or shared for unrelated purposes. Public product images are hosted on Cloudflare — your documents are never placed there.

Who we share it with

We use trusted service providers who process data only on our instructions:

Shopify — checkout, store hosting and payment processing. Processes in the UK/EU with transfers to the US/Canada under appropriate safeguards.
Anthropic (Claude) — assists our team by reading your uploaded ID/entitlement documents to check them against your order. US transfer under appropriate safeguards (see below).
Resend — sends our transactional emails (order & dispatch confirmations). US transfer under appropriate safeguards.
Cloudflare — website hosting/security and product-image delivery. Transfers under appropriate safeguards.
Umami — privacy-friendly analytics that we host ourselves, cookieless, with no data shared with any third party.

We may also share data where the law requires it — including with the DVLA, police or Trading Standards, who are entitled to inspect our RNPS records. We don’t sell your data.

Sending data outside the UK

Some providers (in particular Anthropic and Resend, in the US) process data outside the UK. Where they do, we rely on safeguards approved under Article 46 UK GDPR — such as an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and/or the UK Extension to the EU–US Data Privacy Framework where the provider is certified. Ask us at support@numberplater.co.uk for details.

Automated processing

We use software (including Anthropic’s Claude) to help read and check your documents against your order. This supports our team — a person reviews the result before we approve or decline an order, so we don’t make solely automated decisions that produce legal or similarly significant effects about you. You can ask us about this, ask for a human review, or contest a decision.

How long we keep it

RNPS verification records (your identity/entitlement details and the sale record) — kept for 6 years. The DVLA requires registered suppliers to keep sale records for a minimum of 3 years; we choose to keep them for 6 years to align with the 6-year limitation period under the Limitation Act 1980.
Uploaded document images (ID / V5C) — kept securely only as long as needed to verify and evidence the sale, then deleted on our retention schedule.
Order, payment & accounting records — kept for 6 years in line with the Limitation Act 1980 and tax record-keeping.
Marketing consent — until you unsubscribe.

Your rights

You have the right to access, correct, erase, restrict or object to our use of your personal data, to data portability, and — where we rely on consent — to withdraw consent. Because we have a legal duty (DVLA RNPS) to keep sale/verification records, we may not be able to erase those records until the retention period ends. To exercise any right, contact support@numberplater.co.uk — this is free and we’ll respond within one month.

Cookies & analytics

We use only an essential session cookie needed to keep the site and your order working — no advertising or cross-site tracking cookies. Our analytics (Umami) is self-hosted and cookieless. If we add non-essential cookies in future, we’ll update this section and ask for your consent where required.

Complaints

If you’re unhappy with how we handle your data, please contact us first at support@numberplater.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk (helpline 0303 123 1113). Complaining to the ICO doesn’t affect any other legal rights.

Contact

Questions about your data? Email support@numberplater.co.uk or write to Numberplater Ltd, 42 Dorset Road, London, E7 8PS.