GDPR & Data Protection

This page explains how personal data is collected, used, stored and protected when you visit our website, create an account or order number plates and accessories from us. It also sets out your rights and how to use them.

The main laws that apply are the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The Privacy and Electronic Communications Regulations 2003 (PECR) also apply to cookies and electronic marketing.

This page is a summary. Where it and our Privacy Policy differ, the Privacy Policy gives the fuller and authoritative detail.

Enhanced Plates Ltd, trading as Enhanced Plates, is the controller of the personal data described on this page. This means we decide why and how your personal data is used.

Business

Enhanced Plates Ltd

Location

United Kingdom

DVLA registration

Registered Number Plate Supplier (RNPS 84920)

Privacy contact

[email protected]

Depending on how you use our website, we may collect:

• Account and contact details — your name, email address, telephone number and account login details. Passwords are stored only as a one-way hash, never in readable form.
• Billing, delivery and order information — delivery and billing addresses, the products you order and your order history.
• Vehicle registration and number-plate order details — the registration number(s) you order, your plate design choices and, for road-legal plates, the entitlement and identity documents described below.
• Payment-related information — payments are handled by our payment providers. We receive confirmation of whether a payment succeeded and a transaction reference. Our website does not store your full card number or security code.
• Technical and usage data — such as IP address, browser and device type and pages visited, plus cookies and similar technologies (see Cookies and tracking).
• Customer service communications — messages you send us by email or contact form, return or dispute requests, and messages typed into our on-site assistant.

Documents required for road-legal number plates

Separately from data protection law, registered number plate suppliers are legally required to check that a customer is entitled to the registration number and to confirm their identity before supplying a road-legal plate, and to keep records of these checks. This duty comes from the Vehicles (Crime) Act 2001, its supplier regulations and the DVLA Register of Number Plate Suppliers rules. We use these documents only for that purpose. Show plates, which are not for road use, do not need them.

• To process, make and deliver your order, take payment and send order and dispatch updates.
• To provide customer support, handle returns and complaints, and run your customer account.
• To prevent fraud, misuse of registration numbers and abuse of our website, and to keep our systems secure.
• To meet our legal and regulatory duties, including number plate supplier record-keeping and accounting and tax rules.
• For website measurement and marketing, only where applicable and where the law permits it.

UK GDPR requires a lawful basis for each use of personal data. The basis we rely on depends on the specific activity:

• Contract — where we need your data to take, make and deliver your order or run your account.
• Legal obligation — for example, document checks and record-keeping required of number plate suppliers, and accounting records.
• Legitimate interests — for example, preventing fraud, keeping our website secure and answering customer questions, where these interests are not overridden by your rights.
• Consent — where the law requires it, for example for certain marketing and non-essential cookies. You can withdraw consent at any time.

The Privacy Policy explains which basis applies to each activity.

We share personal data only where needed, and only the data the recipient needs. Recipients fall into these categories:

• Payment processors, which handle your payment.
• Delivery and fulfilment providers, which deliver your order and send tracking updates.
• Hosting, database, storage and email providers that run our website and services.
• Service providers that power features such as our on-site assistant and staff order notifications.
• Marketplaces, where you buy from us through one.
• Professional advisers and public authorities, such as the DVLA or the police, where the law requires it.

The named providers we use are listed in our Privacy Policy. We do not sell your personal data.

Some service providers may store or access personal data outside the UK. Where personal data is transferred outside the UK, UK GDPR requires it to be protected by a recognised safeguard, such as a UK adequacy regulation, the ICO International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

See our Privacy Policy for details, or contact us to ask about the safeguard used for a particular provider.

We keep personal data only for as long as it is needed for the purpose it was collected for, and for as long as the law requires us to keep it (for example, number plate supplier and accounting records). When it is no longer needed, it is deleted or anonymised.

The retention periods for each type of record are set out in our Privacy Policy.

Under UK GDPR you have the following rights:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data, where applicable.
• Right to restrict processing — to ask us to limit how we use your data in certain cases.
• Right to data portability — to receive data you gave us in a commonly used, machine-readable format, where applicable.
• Right to object — to processing based on legitimate interests, where applicable, and to direct marketing at any time.
• Right to withdraw consent — where we rely on consent, at any time, without affecting processing that took place before.
• Rights relating to automated decisions — not to be subject to decisions based solely on automated processing that have legal or similarly significant effects, where applicable.

These rights are subject to legal conditions and exceptions. For example, we may need to keep some records that the law requires us to hold even if you ask for erasure.

We use cookies that are strictly necessary for the website to work, such as keeping you signed in and keeping your basket. Under PECR, non-essential cookies and similar technologies require your consent.

Details of the cookies and similar technologies on our website are in the Cookies section of our Privacy Policy. You can also block or delete cookies in your browser settings, although blocking strictly necessary cookies will stop sign-in and checkout from working.

We use technical and organisational measures appropriate to the data we hold, including:

• Passwords stored only as one-way hashes.
• Login sessions held in HTTP-only cookies that page scripts cannot read.
• Verification documents kept in private storage, opened by authorised staff only through short-lived links.
• Access to order systems limited to staff who need it.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the ICO as the law requires.

Our website and products are not aimed at children, and we do not knowingly collect personal data from children. You must be 17 or over to order road-legal number plates from us. If you believe a child has given us personal data, please contact us and we will deal with it.

To use any of your rights, contact us at [email protected] with “Data Protection” in the subject line. We may ask you to confirm your identity before acting on a request.

We will normally respond within one month. This can be extended by up to two further months for complex or numerous requests, in which case we will tell you. There is normally no charge.

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

We may update this page when our privacy practices or the legal requirements change. Please check back from time to time. For questions about this page, see our Privacy Policy or contact us.