Privacy notice

1. Who is responsible

The business that runs TheRealReg is the data controller for TheRealReg (therealreg.co.uk). Questions about your data can be sent through our contact page.

2. What we hold

• Your account: your email address, a one-way hash of your password (never the password itself), when the account was created, and when you confirmed your email address.
• What you do on TheRealReg: the registrations you look up, the cars you watch and which changes you want to hear about, your saved searches and their matches, your alert email settings, the reports you unlock, and the alert emails we send you.
• Payments: what you bought, when, for how much, and whether it was paid, declined or refunded. Card details are handled by our payment provider and are never held by us. Until real payments start, payments on the site are test payments that move no money.
• Messages: anything you send us through the contact page, with the name and email address you give.
• Technical information: if you look up cars without an account, we count your lookups against the free limit using a one-way hash of your internet address, from which the address cannot be recovered. Our servers keep short-lived logs of requests for security and to fix problems.

3. Information about cars

The cars, adverts and prices we show come from UK car dealers' own websites. We record what each dealer publishes about a car for sale (its price, mileage, registration, description and other details) and how that changes over time. We only read the pages each website's robots.txt allows. We add the MOT history the DVSA publishes for each registration.

While a dealer is selling a car, these details are about the car and the dealer. Once a private owner buys it, the registration can relate to that person, so we treat the history we keep for each registration with the same care as personal information. We keep it because checking a car's past before buying it is what TheRealReg is for (our legitimate interests, and those of the people who use it). We never collect the names or contact details of a car's owners, and we don't try to find out who owns a car.

We keep this history for as long as it is useful for checking cars. We may also use it, combined and without registrations, to produce statistics about the used car market. If you own a car and want to ask about what we show for it, or object to it, contact us through our contact page.

4. Why we use it, and the legal basis

• To provide the service you asked for (our contract with you): signing you in, keeping your watchlist and saved searches, sending the alerts you turned on, taking payment and giving you the reports you bought.
• To run and protect TheRealReg (our legitimate interests): applying the free-use limits, preventing misuse, keeping the service secure and understanding how it is used so we can improve it.
• To meet our legal duties: keeping records of payments for as long as tax and accounting law requires.

We do not send marketing emails and we do not sell or share your information for advertising.

5. Who we share it with

We use other companies to run TheRealReg, and they handle your information only on our instructions: the company that hosts our servers, which for TheRealReg are in the United Kingdom; a cloud storage service (Google Drive), where encrypted copies of our backups are kept and which may store them outside the United Kingdom under the safeguards UK law requires; an email service, to send the emails you ask for; and, once real payments start, a payment provider, which handles your card details under its own privacy notice. We may also share information where the law requires it.

6. How long we keep it

We keep your account information while you have an account. When you delete your account, we remove your email address and password straight away, along with your watchlist, saved searches, lookups, alert settings and messages. Records of payments are kept for as long as the law requires, without your email address attached. Server logs are kept for a short period and then deleted. Our encrypted backups are kept for up to 12 months, so deleted information stays in them until they expire; they are only used to restore the service.

7. Your rights

You can:

• see your data: download everything we hold about you from your account page;
• correct it: change your email address or password from your account page;
• delete it: delete your account from your account page, or ask us to;
• stop alert emails: from your account page, your watchlist and saved searches, or the link in any alert email;
• object to or restrict how we use your data, and ask for it in a portable form, by contacting us through our contact page.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would rather hear from you first, so we can put things right.

8. Cookies

TheRealReg uses one cookie, to keep you signed in, and stores your light or dark theme choice in your browser. There are no analytics or advertising cookies. Our cookie notice has the detail.

9. Changes

If this notice changes, the date at the top changes with it, and we will tell you about any change that matters to how your information is used.