Privacy Policy

PRIVACY POLICY Last updated: 4 October 2026 This Privacy Policy explains how Enhanced Plates UK Ltd ("Enhanced Plates", "we", "us", "our") collects, uses, stores and protects your personal data when you visit enhancedplates.co.uk, create an account, or buy number plates and accessories from us. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Please read this policy together with our Terms of Service. 1. WHO WE ARE Enhanced Plates UK Ltd is a company registered in England and Wales, trading as Enhanced Plates from London, United Kingdom. We are a registered number plate supplier with the DVLA Register of Number Plate Suppliers (RNPS 84920). We are the "controller" of the personal data described in this policy. This means we decide why and how your personal data is used. Contact for all privacy questions and requests: Email: [email protected] Please put "Data Protection" in the subject line so your message reaches the right person quickly. 2. WHY WE ASK FOR IDENTITY AND VEHICLE DOCUMENTS UK law requires every registered number plate supplier to check that a customer is entitled to the registration number being made up, and that the customer is who they say they are, before a road-legal plate is supplied. This is set out in the Vehicles (Crime) Act 2001 and the Vehicles (Crime) Act 2001 (Registration Plate Suppliers) Regulations 2008 and the DVLA's RNPS rules. For this reason, before we can manufacture road-legal plates we must see: (a) one document that proves your entitlement to the registration number, such as: - V5C vehicle registration certificate (logbook) - V750 certificate of entitlement - V778 retention document and (b) one document that proves your identity, such as: - a current passport - a current UK photocard driving licence You upload these documents securely through the verification link we send you after you place your order. We cannot make road-legal plates until your documents have been checked and approved. Show plates, which are not for road use, do not require these documents. We only use these documents to verify your order and to meet our legal record-keeping duties. We never use them for marketing, we never sell them, and we never share them except as set out in Section 6. 3. THE PERSONAL DATA WE COLLECT 3.1 Data you give us - Identity and contact data: first name, last name, email address, telephone number. - Delivery and billing data: delivery address, billing address (if different) and postcode. - Vehicle data: the registration number(s) you order and your plate design choices. - Verification documents: images or PDF copies of the documents listed in Section 2. These may show your photograph, date of birth, address, licence or passport number, signature, and vehicle details. - Account data: your email address and password. Passwords are stored only as a one-way encrypted hash; we can never see your actual password. - Communications: messages you send us by email, our contact form, return or dispute requests, and any messages you type into our on-site AI assistant. 3.2 Data we collect automatically - Technical data: IP address, browser type, device type, and pages visited. Your IP address is recorded with your order and with on-site assistant conversations to help prevent fraud and abuse. - Cookies and similar technologies: see Section 9. 3.3 Data from third parties - Payment providers (PayPal, myPOS) tell us whether your payment succeeded and give us a transaction reference. We never receive or store your full card number or security code. - Couriers (DPD, Royal Mail, Evri, and our shipping platform ShipStation) give us tracking and delivery status updates. - If you buy through a marketplace channel we sell on (such as eBay, Etsy or Shopify-powered stores), that platform passes us the order and delivery details needed to fulfil your order. We do not knowingly collect data from anyone under 17. You must be 17 or over to order road-legal plates from us. 4. HOW WE USE YOUR DATA AND OUR LAWFUL BASIS Under UK GDPR we must have a lawful basis for each use of your personal data. (a) To take, make and deliver your order, process payment, send order and dispatch emails, and handle returns and complaints. Lawful basis: performance of a contract with you (Article 6(1)(b)). (b) To check your entitlement and identity documents before making road-legal plates, and to keep the records required of registered number plate suppliers. Lawful basis: legal obligation (Article 6(1)(c)). (c) To keep accounting and tax records. Lawful basis: legal obligation (Article 6(1)(c)). (d) To create and run your customer account. When you check out as a guest, we create an account for you automatically so you can track your order, upload documents and request returns. We email you a link (valid for 7 days) to set your own password. You can ask us to close the account at any time. Lawful basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in letting you track and manage your orders (Article 6(1)(f)). (e) To prevent fraud, misuse of registration numbers and abuse of our website, and to keep our systems secure. Lawful basis: legitimate interests (Article 6(1)(f)) and, where it applies, legal obligation. (f) To answer questions you put to our on-site AI assistant. Lawful basis: legitimate interests (Article 6(1)(f)) in providing quick customer help. Please do not type identity document details, card details or other sensitive information into the assistant. (g) To measure the performance of our advertising. Lawful basis: your consent (Article 6(1)(a)) and PECR. You can withdraw consent at any time (see Section 9). (h) To send you marketing emails about offers and new products, only if you have opted in or, as an existing customer, have not opted out. Every marketing email includes an unsubscribe link. Lawful basis: consent or the "soft opt-in" under PECR, with legitimate interests (Article 6(1)(f)). Special category data: we do not ask for, and do not intend to process, special category data (such as health, ethnicity or religion). Identity documents may incidentally show a photograph; we use it only to confirm your identity, not to identify any special category information. We do not use automated decision-making that produces legal or similarly significant effects on you. Every document check is reviewed by a member of our team. 5. HOW WE PROTECT YOUR DATA - Verification documents are stored in private, encrypted cloud storage. Each file is given a random name and cannot be reached by a public web address. Only authorised Enhanced Plates staff can open a document, through a secure link that expires within minutes. - Uploads are limited to JPEG, PNG, WebP and PDF files of up to 10MB, and are rate-limited to block automated attacks. - All traffic between your device and our website is encrypted using TLS (HTTPS). - Passwords are hashed with bcrypt and are never stored in readable form. - Login sessions use secure, HTTP-only cookies that cannot be read by page scripts. - Access to our order system is restricted to authorised staff who need it to do their job. No system is completely secure, but we review our safeguards regularly. If a data breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires. 6. WHO WE SHARE YOUR DATA WITH We only share your data with organisations that help us run our business, and only the data they need. They act as our processors under written contracts, or as independent controllers where stated. - Payment providers: PayPal (Europe) S.à r.l. et Cie, S.C.A. and myPOS, which process your payment. They are independent controllers of your payment data and have their own privacy policies. - Delivery partners: DPD, Royal Mail, Evri and ShipStation receive your name, delivery address, phone number and email so they can deliver your parcel and send tracking updates. - Hosting and database providers: our website and order database are hosted with specialist cloud providers, including MongoDB Atlas. - Document storage: DigitalOcean (Spaces object storage) stores verification documents and uploaded images privately. - Email delivery: Resend sends our order, account and dispatch emails. - Internal order notifications: we use Telegram to alert our staff instantly when a new order arrives. These alerts contain your name, contact details, delivery address, delivery and payment method, and the plates ordered, so we can start your order quickly. They are sent only to Enhanced Plates staff accounts. - AI assistant providers: messages typed into our on-site assistant are processed by Google (Gemini) and, as a backup, OpenAI, to generate a reply. - Advertising measurement: OpenAI's advertising measurement tag, where you have consented (see Section 9). - Marketplaces: if you buy through eBay, Etsy or a Shopify-powered store, that platform shares your order with us and is an independent controller of the data it holds. - Professional advisers, such as accountants and lawyers, where needed. - Authorities: the DVLA, the police or other public bodies where we are required by law to share information, for example to assist with an investigation into a misused registration number. We never sell your personal data. 7. INTERNATIONAL TRANSFERS Some of our providers (for example PayPal, Google, OpenAI, Resend, DigitalOcean, ShipStation and Telegram) may store or access data outside the UK, including in the United States and the European Economic Area. When your data is transferred outside the UK, we make sure it is protected by one of the safeguards recognised by UK law: a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more details of the safeguard used for a specific provider. 8. HOW LONG WE KEEP YOUR DATA We keep personal data only for as long as we need it: - Order records and the related entitlement and identity verification records: 3 years from the date of sale, as required for registered number plate suppliers, after which copies of your identity and entitlement documents are deleted. - Accounting and invoice records: 6 years from the end of the financial year in which the order was placed, as required by HMRC. - Customer accounts: while your account is open. If you ask us to close it, we delete or anonymise your account data, except records we must keep by law as set out above. - Unfinished orders (where no payment was completed): up to 12 months. - Returns, disputes and complaints: 6 years from closing the case, in case of legal claims. - On-site assistant conversation records and related IP addresses: up to 12 months. - Marketing preferences: until you unsubscribe, and then a suppression record so we do not contact you again. 9. COOKIES AND SIMILAR TECHNOLOGIES Strictly necessary cookies: we use secure cookies to keep you logged in to your account and to keep your basket working. These are essential for the website to function and do not need your consent. Advertising measurement: we use an advertising measurement tag provided by OpenAI to understand whether our adverts lead to visits and sales. This tag is only used with your consent, which you can give or refuse through our cookie banner, and change at any time through the cookie settings link on our website. Embedded videos: some blog articles contain videos from YouTube or Vimeo. These services may set their own cookies when you play a video. Where possible we use privacy-enhanced embed modes. You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop login and checkout from working. 10. YOUR RIGHTS Under UK GDPR you have the right to: - Access: ask for a copy of the personal data we hold about you. - Rectification: ask us to correct inaccurate or incomplete data. - Erasure: ask us to delete your data where we no longer need it or have no lawful reason to keep it. We may have to keep some records for the legal reasons set out in Section 8. - Restriction: ask us to limit how we use your data in certain cases. - Portability: ask for data you gave us in a commonly used, machine-readable format. - Object: object to processing based on legitimate interests, and to direct marketing at any time. - Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting earlier processing. To use any of these rights, email [email protected] with the subject "Data Protection". We may ask you to confirm your identity before we act on the request. We will respond within one month, which may be extended by two further months for complex requests. There is normally no charge. 11. COMPLAINTS If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: Website: ico.org.uk Telephone: 0303 123 1113 12. CHANGES TO THIS POLICY We may update this policy from time to time, for example when we add a new service or provider. The "Last updated" date at the top shows when it was last changed. If a change materially affects how we use your data, we will tell you by email or by a notice on our website.