Privacy policy

1. Who we are

GOA Number Plates (“we”, “us”) is a number plate supplier based in Yeovil, Somerset, United Kingdom. We are the data controller for the personal data described in this policy.

Contact for privacy questions: info@goanumberplates.co.uk · 07467 295151 (08:00–14:00).

2. What we collect

When you place an order

• Your name, email address and telephone number.
• Your delivery address.
• The registration number and plate specification you order.
• Order, payment and delivery records.

When you upload verification documents

• The PDF documents you upload to prove your identity, address and entitlement to the registration number — for example a driving licence, utility bill, bank statement, V5C, V750 or V778. These documents contain personal data and we treat them as confidential.

Automatically

• Basic technical information needed to serve the website securely, such as IP address and request logs held by our hosting and security provider.

We do not receive or store your card number, security code or other payment credentials. Card payments are taken on the payment provider’s own secure page.

3. Why we use it, and our lawful basis

4. Who we share it with

We share personal data only where it is necessary:

• Our payment provider (SumUp) — to take your payment. They act as their own controller for payment data under their own privacy policy.
• Our delivery provider (Royal Mail) — name, delivery address and contact details so your order can be delivered.
• Our hosting and infrastructure provider (Cloudflare) — the website, database and document storage run on their platform.
• Our email provider — to send your order confirmation and updates to you, and to send the order details (your name, contact details, delivery address and what you ordered) to our own business inbox so your plates can be made and posted. Your uploaded verification documents are never sent by email.
• DVLA, the police, DVSA or Trading Standards — where they have the relevant legal authority to inspect registered number plate supplier records.

We do not sell your personal data, and we do not use it for advertising or profiling.

5. Where your data is stored

Our website, order database and document store run on Cloudflare’s platform. Data may be processed on servers inside and outside the United Kingdom. Where data is transferred outside the UK, it is protected by appropriate safeguards such as UK International Data Transfer Agreements or adequacy regulations.

6. How long we keep it

• Registered number plate supplier records — the details we are required to record (your name and address, the registration number, and the type and reference number of each document we checked) are kept for at least three years, as the number plate supplier regulations require, so that our records can be inspected by the authorities entitled to do so. This record does not include the document itself.
• Uploaded verification documents — the PDF files you upload are deleted automatically 90 days after you upload them. We keep the record of which document we checked and its reference number, because we must; we do not keep the file. If we still need to see a document after that, we will ask you to upload it again.
• Order and accounting records — kept for the period required by UK tax and accounting law.
• Website security logs — kept for a short period by our infrastructure provider.

When a retention period ends, records are deleted or anonymised. Deletion of uploaded verification documents is automatic: a scheduled job removes them from our document store 90 days after upload, without anyone having to act.

7. How we protect it

• The whole website is served over HTTPS.
• Uploaded documents go into a private storage bucket that is not publicly readable and is not listed or linked anywhere on the website, and they are deleted from it automatically 90 days after upload.
• Your order page is protected by a long random token, so your order details cannot be opened by guessing an order reference.
• Order details are emailed to our own business inbox so your order can be made and posted.
• Uploaded documents are never emailed and are never attached to anything. They can only be opened from our private store through a password-protected staff page, by the people who need to check them to fulfil your order.

No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data we hold.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase data, where we are not required to keep it — your uploaded documents are deleted automatically after 90 days, so you do not need to ask us for those;
• restrict or object to certain processing;
• data portability for data you provided to us;
• withdraw consent, where processing is based on consent.

Some of these rights are limited where we have a legal obligation to keep records as a registered number plate supplier. To exercise a right, email info@goanumberplates.co.uk. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or call 0303 123 1113.

9. Cookies and local storage

This website does not use advertising or analytics cookies.

Your browser’s local storage is used to remember the basket you are building and your delivery choice, so that your basket survives a page refresh. That information stays on your device and is only sent to us when you place an order. Clearing your browser data clears it.

Our infrastructure provider may set strictly necessary cookies for security and bot protection.

10. Children

This website is intended for adults placing vehicle-related orders. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy to reflect changes to our business, our suppliers or legal requirements. The current version is always published on this page with its effective date.