Legal
Privacy policy
Last updated 8 November 2026.
UK Plate Check ("we", "us") provides a free vehicle information service for the United Kingdom. This policy explains what personal data we process when you use ukplatecheck.com and the installed mobile version, why we process it, and your rights. It is written to meet the UK GDPR and the Data Protection Act 2018. For visitors in Brazil, it also meets the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018); see the section for Brazilian users below.
Who is the controller
UK Plate Check is the controller for the personal data described here. Contact: hello@ukplatecheck.com. We have not appointed a Data Protection Officer because the scale and nature of our processing do not require one; the same address reaches the person responsible for data protection.
What we process and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Vehicle registration number you type | Sent to the DVLA Vehicle Enquiry Service and the DVSA MOT History API to answer your query. A registration number can identify a person when combined with other information, so we treat it as personal data. | Legitimate interests (Art. 6(1)(f)): running the service you asked for. Processing is limited to answering your query. | Not stored. It exists only in memory while the request is answered. It is never written to our database or application logs. |
| Postcode you type | Sent to Postcodes.io to find your area, then used to list clean air zones and, for electric vehicles, chargers from Open Charge Map. | Legitimate interests | Not stored. |
| Company name or number you type | Sent to Companies House to show the seller's public record. | Legitimate interests | Not stored. |
| IP address | Rate limiting to protect the service and the official APIs from abuse; web server access logs for security and fault finding. | Legitimate interests: security of the service | Rate-limit counters: 1 minute, in memory. Reverse-proxy access logs: up to 30 days. |
| Usage counts | We count how many lookups happen per day and how many fail, to run and improve the service. | Legitimate interests | Counts only, with no registration number, postcode or IP attached. Kept for 24 months. |
| Administrator account (email, password hash, authenticator secret, login times) | Secure access to the administration area for the single service administrator. | Legitimate interests: security | For the life of the account. Security audit entries, including sign-in attempts to the administration area with a truncated IP address (first three groups of an IPv4 address, or the /48 of an IPv6 address): 12 months. |
| Emails you send us | Replying to you. | Legitimate interests; legal obligation where a rights request is made | 12 months after the matter is closed. |
We do not create accounts for visitors, do not profile you, do not sell data and do not use your data for marketing.
Who receives the data
- Driver and Vehicle Licensing Agency (DVLA), Vehicle Enquiry Service: receives the registration number. DVLA is an independent controller for its own processing.
- Driver and Vehicle Standards Agency (DVSA), MOT History API: receives the registration number.
- Companies House: receives the company name or number.
- Postcodes.io (Ideal Postcodes, UK): receives the postcode.
- Open Charge Map (community project): receives the location derived from the postcode, for electric vehicles only.
- Hetzner Online GmbH (Germany): hosts our server as our processor.
- Namecheap, Inc.: domain registration only; it does not receive visitor data.
Each request to these services is made by our server, so your browser never talks to them directly and they do not receive your IP address from us.
International transfers
Our server is in Germany, which the UK recognises as providing adequate protection (UK adequacy regulations for the EEA). The official UK data services are in the United Kingdom. We do not transfer personal data elsewhere.
Security
The site is served only over HTTPS. Registration numbers, postcodes and company queries are not stored. Access to the administration area requires a password and a second factor (authenticator app). Our database is on a private network and is not reachable from the internet. We keep software updated and review the code for security before each release.
Your rights
Under the UK GDPR you can ask us to access, correct, erase or restrict personal data we hold about you, object to processing based on legitimate interests, and ask for data portability where it applies. Because we do not store the queries you make, in most cases there will be no personal data to provide beyond server access logs, which are kept briefly. To exercise a right, email hello@ukplatecheck.com. We reply within one month.
You can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Children
The service is not aimed at children and we do not knowingly collect data from anyone under 13.
Automated decisions
The road tax, ULEZ, running cost and clean air zone figures are calculated estimates shown to you for information. We make no decision about you and nothing has legal or similar effect on you.
Users in Brazil (LGPD)
If you access the service from Brazil, the LGPD applies in addition to UK law. The controller ("controlador") is UK Plate Check, contact hello@ukplatecheck.com, who also acts as the person in charge ("encarregado"). The legal bases we rely on under Article 7 of the LGPD are the legitimate interest of the controller (Art. 7, IX) for answering your queries and securing the service, and compliance with a legal obligation (Art. 7, II) where we must respond to a request. You have the rights listed in Article 18: confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, information about sharing, and information about the consequences of refusing consent. International transfer of your data to the United Kingdom and Germany is based on Article 33, IX (legitimate interest), limited to what is needed to provide the service. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.
Changes
If we change this policy we will update the date at the top. Substantial changes will be announced on the home page for 30 days.