Privacy Policy
How Car Facts UK handles personal data when you use our vehicle checks, paid reports, accounts, reminders, support and payment journey.
At a glance
The key privacy points
This summary helps you find the main points quickly. The numbered policy below contains the full explanation.
Account & contact data
We use the personal information needed to operate accounts, purchases, support and reminders.
Vehicle searches
A VRM can be linked to your account or request and may therefore form part of your personal-data record.
Paid data: 7 days
Paid provider payloads and paid-history Buyer Confidence outputs are removed after the 7-day premium-data window.
No card storage
Stripe handles card details. Car Facts UK does not store your full payment-card number.
In this policyJump to a section
Section 01
Who we are and who controls your data
Car Facts UK is a trading name of Thomas John Kennard, a UK sole trader. Where Car Facts UK determines why and how personal data is processed for this Service, Thomas John Kennard trading as Car Facts UK is the data controller for the purposes of applicable UK data-protection law.
You can contact Car Facts UK about privacy or data-protection matters at support@carfactsuk.co.uk.
Plain-English scope
Section 02
Information we collect
The information we process depends on which Car Facts UK features you use. It can include:
- Account information such as your name, email address and secure account identifiers used to sign you in and manage your account.
- Vehicle Registration Marks (VRMs) that you enter, purchase a report for, compare, save or use with reminder features.
- Account preferences, saved vehicles, report credits and reminder settings.
- Checkout and transaction information such as product, order, session, payment-status and report references.
- Support information such as your email address, message, relevant VRM/report reference and technical evidence needed to investigate the issue.
- Security and anti-abuse information such as IP address, user agent, timestamps and security-verification data where collected by the relevant feature.
- MOT, tax and vehicle information used by supported vehicle, account or reminder features.
Passwords and card details
Marketing preferences and consent evidence
Section 03
Where information comes from
We obtain information directly from you when you create an account, enter a VRM, buy a report, enable a reminder or contact support. We also receive or generate information through the services needed to fulfil those requests.
You
Account details, VRMs, preferences, support information and reminder choices.
DVLA / DVSA sources
Available official or authorised vehicle, MOT and tax information used by supported checks.
Established automotive data providers
Paid vehicle-history and related vehicle information where available for the requested vehicle.
Stripe
Checkout, payment-status and transaction information needed to verify and fulfil a purchase.
Security and infrastructure services
Technical and security information generated while protecting, operating and troubleshooting the Service.
Car Facts UK calculations
Derived vehicle-risk outputs such as Buyer Confidence and comparison recommendations generated from available vehicle information.
Section 04
How and why we use personal data
UK data-protection law requires a lawful basis for processing personal data. The basis depends on the purpose and the feature involved.
Provide paid reports, checkout, report access and purchased account features
Information
Email, account identifiers, VRM, product/order information, report and transaction references
Lawful basis
Contract — processing needed to provide the service you request or purchase.
Provide free vehicle checks and requested free tools
Information
VRM and the technical information needed to respond to the request
Lawful basis
Legitimate interests — operating the requested free service and responding to user requests.
Create and operate accounts, saved vehicles, credits and dashboard features
Information
Name, email, authentication identifier, account preferences and saved vehicle information
Lawful basis
Contract where the account feature forms part of the service you request; legitimate interests for secure administration.
Protect forms, accounts and payments from bots, fraud and abuse
Information
IP address, user agent, security events, security-verification data and relevant transaction signals
Lawful basis
Legitimate interests — keeping the service secure, preventing abuse and protecting customers and Car Facts UK; legal obligation where applicable.
Send MOT or tax reminders you enable
Information
Email address, VRM, relevant MOT/tax dates and reminder preferences
Lawful basis
Consent — you choose whether to enable the reminder and can turn it off.
Provide customer support and investigate report, payment or account issues
Information
Contact details, message content, report/order references and relevant technical evidence
Lawful basis
Contract where support relates to a service you bought or requested; legitimate interests for resolving problems and defending legal rights.
Keep records required for tax, accounting, fraud prevention, disputes or legal compliance
Information
Transaction references, payment status, audit records and necessary account/support evidence
Lawful basis
Legal obligation where a law requires retention; legitimate interests for fraud prevention, disputes and legal claims.
Use any non-essential cookies or similar technologies where consent is legally required
Information
The information described in the Cookies Policy for the relevant technology
Lawful basis
Consent — non-essential technologies are not treated as accepted merely because you continue browsing.
Send the monthly Car Facts UK newsletter and other Car Facts UK marketing emails, including selected partner or affiliate offers, where you choose to receive them
Information
Your email address, marketing-consent choice, consent wording and version, consent timestamp, checkout or collection source, and later withdrawal or unsubscribe records
Lawful basis
Consent. Email marketing is optional, is kept separate from the purchase contract, and can be withdrawn at any time.
| Purpose | Information | Lawful basis |
|---|---|---|
| PurposeProvide paid reports, checkout, report access and purchased account features | InformationEmail, account identifiers, VRM, product/order information, report and transaction references | Lawful basisContract — processing needed to provide the service you request or purchase. |
| PurposeProvide free vehicle checks and requested free tools | InformationVRM and the technical information needed to respond to the request | Lawful basisLegitimate interests — operating the requested free service and responding to user requests. |
| PurposeCreate and operate accounts, saved vehicles, credits and dashboard features | InformationName, email, authentication identifier, account preferences and saved vehicle information | Lawful basisContract where the account feature forms part of the service you request; legitimate interests for secure administration. |
| PurposeProtect forms, accounts and payments from bots, fraud and abuse | InformationIP address, user agent, security events, security-verification data and relevant transaction signals | Lawful basisLegitimate interests — keeping the service secure, preventing abuse and protecting customers and Car Facts UK; legal obligation where applicable. |
| PurposeSend MOT or tax reminders you enable | InformationEmail address, VRM, relevant MOT/tax dates and reminder preferences | Lawful basisConsent — you choose whether to enable the reminder and can turn it off. |
| PurposeProvide customer support and investigate report, payment or account issues | InformationContact details, message content, report/order references and relevant technical evidence | Lawful basisContract where support relates to a service you bought or requested; legitimate interests for resolving problems and defending legal rights. |
| PurposeKeep records required for tax, accounting, fraud prevention, disputes or legal compliance | InformationTransaction references, payment status, audit records and necessary account/support evidence | Lawful basisLegal obligation where a law requires retention; legitimate interests for fraud prevention, disputes and legal claims. |
| PurposeUse any non-essential cookies or similar technologies where consent is legally required | InformationThe information described in the Cookies Policy for the relevant technology | Lawful basisConsent — non-essential technologies are not treated as accepted merely because you continue browsing. |
| PurposeSend the monthly Car Facts UK newsletter and other Car Facts UK marketing emails, including selected partner or affiliate offers, where you choose to receive them | InformationYour email address, marketing-consent choice, consent wording and version, consent timestamp, checkout or collection source, and later withdrawal or unsubscribe records | Lawful basisConsent. Email marketing is optional, is kept separate from the purchase contract, and can be withdrawn at any time. |
Our legitimate interests
Email marketing is optional
Section 05
Vehicle searches, paid reports and Buyer Confidence
A VRM identifies a vehicle rather than a person by itself, but a VRM can become part of personal data where it is associated with your account, purchase, saved vehicle, reminder or identifiable usage record.
Free vehicle checks use the available DVLA and DVSA data supplied to that feature. Paid reports can additionally use information returned by established automotive data providers, depending on the report product and the information available for that vehicle.
7-day paid-history rule
Limited MOT, tax, reminder-safe, transaction and account information can be retained separately where needed for reminders, account functionality, compliance, fraud prevention, audit evidence or legal/dispute purposes.
Report access and the availability of the original paid provider payload are therefore not the same thing. An account/report record can remain while paid-history fields subject to the seven-day rule have been removed.
Section 06
Payment processing
Stripe processes payments for Car Facts UK. During checkout, Stripe receives the card and billing information you enter. Car Facts UK receives the checkout and payment information needed to verify the transaction, fulfil the correct product and maintain appropriate transaction and audit records.
Car Facts UK does not store full card details
Stripe can process personal data both on our behalf and for certain purposes it determines itself, including payment security, fraud prevention, authentication and regulatory compliance. Read Stripe's Privacy Policy for its own processing information.
Section 07
Service providers and data recipients
We use specialist providers where they are needed to deliver, secure or support the Service. The data shared depends on the feature involved and is limited to what is reasonably needed for that purpose.
Secure account and platform services
Purpose
Secure sign-in, account operation, database, hosting and service infrastructure.
Typical information
Account identifiers, email, saved-account information, report records and service data needed for the relevant feature.
Stripe
Purpose
Checkout, payment processing, payment status, fraud prevention and payment compliance.
Typical information
Payment and billing information supplied to Stripe, plus checkout/order metadata needed to complete and verify the purchase.
Established automotive data providers
Purpose
Paid vehicle-history information and provider-supplied vehicle records where available.
Typical information
VRM and the vehicle/report request information needed to obtain the relevant result.
DVLA / DVSA data services
Purpose
Available UK vehicle identity, tax, MOT and road-status information used by supported free and report features.
Typical information
VRM and vehicle-related request information.
Transactional email services
Purpose
Transactional email, report links, support replies, account communications and MOT/tax reminders where enabled.
Typical information
Recipient email address and the content or metadata needed to deliver the relevant message.
Security and anti-abuse services
Purpose
Bot detection, anti-abuse checks and protection of forms and lookup endpoints.
Typical information
Security and browser-environment signals needed for the relevant protection checks, which can include IP address and user-agent information.
| Provider / category | Purpose | Typical information |
|---|---|---|
| Provider / categorySecure account and platform services | PurposeSecure sign-in, account operation, database, hosting and service infrastructure. | Typical informationAccount identifiers, email, saved-account information, report records and service data needed for the relevant feature. |
| Provider / categoryStripe | PurposeCheckout, payment processing, payment status, fraud prevention and payment compliance. | Typical informationPayment and billing information supplied to Stripe, plus checkout/order metadata needed to complete and verify the purchase. |
| Provider / categoryEstablished automotive data providers | PurposePaid vehicle-history information and provider-supplied vehicle records where available. | Typical informationVRM and the vehicle/report request information needed to obtain the relevant result. |
| Provider / categoryDVLA / DVSA data services | PurposeAvailable UK vehicle identity, tax, MOT and road-status information used by supported free and report features. | Typical informationVRM and vehicle-related request information. |
| Provider / categoryTransactional email services | PurposeTransactional email, report links, support replies, account communications and MOT/tax reminders where enabled. | Typical informationRecipient email address and the content or metadata needed to deliver the relevant message. |
| Provider / categorySecurity and anti-abuse services | PurposeBot detection, anti-abuse checks and protection of forms and lookup endpoints. | Typical informationSecurity and browser-environment signals needed for the relevant protection checks, which can include IP address and user-agent information. |
We can also disclose information where reasonably necessary to comply with law, a court order, regulatory requirements, prevent fraud or abuse, protect legal rights, or establish, exercise or defend legal claims.
Section 08
International data transfers
Paid automotive report data received for Car Facts UK reports is processed and stored using UK-hosted report infrastructure in accordance with the applicable automotive-data-provider requirements.
Vehicle-report data location
Separate personal data used for account administration, payment processing, transactional email, support or security services may be processed outside the United Kingdom by the relevant operational service providers.
Where that processing constitutes a restricted transfer under UK data-protection law, Car Facts UK uses an applicable UK adequacy arrangement or an appropriate contractual transfer safeguard as required by law.
Contact support@carfactsuk.co.uk if you would like further information about the safeguard relevant to a particular transfer.
Section 10
How long we keep information
We do not use one retention period for every type of information. We keep information for the period required by the purpose for which it is processed, the relevant product rules and any separate legal, security, fraud-prevention, accounting, audit or dispute requirement.
Paid provider report data
Retention
Available for 7 days after the paid report is generated, then removed under the Car Facts UK premium-data retention process.
Buyer Confidence derived from paid-history data
Retention
Shares the same 7-day window as the underlying paid-history data and is removed with that premium-data expiry.
Secure report-sharing token
Retention
A secure WhatsApp report-sharing link expires after 48 hours.
MOT, tax and reminder-safe information
Retention
May be retained separately while needed for enabled reminder, My Garage or account features, or until it is no longer required for those purposes.
Account profile and saved-account information
Retention
Kept while needed to operate the account and afterwards only where a separate legal, security, transaction, fraud-prevention or dispute purpose requires it.
Transaction, payment-reference and audit records
Retention
Kept for the period required by applicable legal, tax, accounting, fraud-prevention, audit or dispute requirements.
Support and security evidence
Retention
Kept only for as long as reasonably needed to resolve the issue, protect the service, prevent abuse, handle disputes or meet legal obligations.
Email-marketing consent, preference and withdrawal records
Retention
Kept for as long as reasonably needed to demonstrate when and how consent was obtained or withdrawn, respect suppression of future marketing after opt-out, and handle compliance, audit or dispute requirements.
| Information | Retention |
|---|---|
| InformationPaid provider report data | RetentionAvailable for 7 days after the paid report is generated, then removed under the Car Facts UK premium-data retention process. |
| InformationBuyer Confidence derived from paid-history data | RetentionShares the same 7-day window as the underlying paid-history data and is removed with that premium-data expiry. |
| InformationSecure report-sharing token | RetentionA secure WhatsApp report-sharing link expires after 48 hours. |
| InformationMOT, tax and reminder-safe information | RetentionMay be retained separately while needed for enabled reminder, My Garage or account features, or until it is no longer required for those purposes. |
| InformationAccount profile and saved-account information | RetentionKept while needed to operate the account and afterwards only where a separate legal, security, transaction, fraud-prevention or dispute purpose requires it. |
| InformationTransaction, payment-reference and audit records | RetentionKept for the period required by applicable legal, tax, accounting, fraud-prevention, audit or dispute requirements. |
| InformationSupport and security evidence | RetentionKept only for as long as reasonably needed to resolve the issue, protect the service, prevent abuse, handle disputes or meet legal obligations. |
| InformationEmail-marketing consent, preference and withdrawal records | RetentionKept for as long as reasonably needed to demonstrate when and how consent was obtained or withdrawn, respect suppression of future marketing after opt-out, and handle compliance, audit or dispute requirements. |
If you ask us to erase your account or personal data, we will delete or anonymise eligible information where the right applies. Some information may still need to be retained for a separate legal, tax, security, transaction, fraud-prevention, audit or dispute purpose.
Section 11
How we protect information
We use technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration or disclosure. Measures used across the Service include encrypted HTTPS/TLS transmission, managed service infrastructure, authentication controls, restricted administrative access, anti-abuse protection and payment processing through Stripe.
No internet or electronic-storage system can be guaranteed to be completely secure. We therefore review security controls and restrict access according to the purpose and risk of the processing.
Never send Car Facts UK your full payment-card details or your account password in a support message.
Section 12
Your data-protection rights
Depending on the processing and lawful basis involved, UK data-protection law can give you the following rights:
Access
Ask for a copy of personal data we hold about you and related information about how it is used.
Rectification
Ask us to correct inaccurate personal data or complete information that is incomplete.
Erasure
Ask us to delete eligible personal data where the legal conditions for erasure apply.
Restriction
Ask us to restrict processing in circumstances provided by data-protection law.
Data portability
Receive eligible data in a structured, commonly used and machine-readable format where the right applies.
Object
Object to processing based on legitimate interests in circumstances where that right applies.
Withdraw consent
Withdraw consent at any time for processing that relies on consent, without affecting processing carried out lawfully before withdrawal.
Your right to object
To exercise a right, email support@carfactsuk.co.uk. We may need enough information to confirm your identity and locate the relevant records.
We will respond without undue delay and normally within one month of receiving a valid request. Where permitted by law, that period can be extended by up to a further two months if the request is complex or you have made a number of requests; if so, we will explain the extension within the initial one-month period.
Section 13
Automated vehicle assessments and recommendations
Car Facts UK uses automated rules to calculate vehicle-focused outputs such as Buyer Confidence and comparison recommendations from the vehicle information available for a check.
Those calculations assess vehicle records and risk signals. They are not intended to profile you as a person and are not used by Car Facts UK to make a solely automated decision about you that produces legal or similarly significant effects.
Buyer Confidence retention
Section 14
Children and age requirements
Car Facts UK is designed as a vehicle-information service. Under our current Terms, you must be at least 16 years old and able to enter into a legally binding contract to purchase a paid report.
We do not knowingly seek to collect personal information from children for unrelated purposes. If you are a parent or guardian and believe a child has supplied personal information to Car Facts UK in circumstances that should be reviewed or deleted, contact us at support@carfactsuk.co.uk.
Section 15
Third-party and affiliate links
The Service can link to websites or services operated by other organisations. Their websites and processing are governed by their own privacy information, not this Privacy Policy.
Car Facts UK may also use clearly disclosed affiliate links. A third-party service may be able to identify that a visit or purchase came through a referral link. See the Affiliate Disclosure for the commercial disclosure.
Vehicle-data accuracy, reliance and purchasing limitations are addressed separately in our Disclaimer and Terms & Conditions.
Section 16
Changes, contact and complaints
We may update this Privacy Policy when the Service, providers, legal requirements or data-handling practices change. The latest version will show an updated review date. Where a change materially affects how we use personal data, we may also provide an additional website or account/email notice where appropriate.
Privacy contact
Car Facts UK
Trading name of Thomas John Kennard, UK sole trader
support@carfactsuk.co.ukYou also have the right to complain to the Information Commissioner's Office (ICO). You can find information about your data-protection rights and how to raise a concern at ico.org.uk.
Related legal information
Read the policies that sit alongside this notice
Last reviewed: 8 September 2026. This notice should be reviewed whenever the Car Facts UK service, provider arrangements, retention rules or applicable privacy requirements materially change.