Privacy Policy

This Privacy Policy explains how Road Lux Ltd, trading as RoadLux Vehicle Check (check.roadlux.uk), collects, uses, stores, shares and protects personal data when you visit our website, create an account, run a free vehicle check, purchase a vehicle report, contact us, or otherwise interact with our services (together, the "Service").

This policy applies to visitors, registered users, customers, and anyone who submits information to us through the Service, including via forms, email, or telephone. It does not apply to third-party websites that we may link to, even where those links appear within our Service.

We are committed to processing personal data lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Please read this policy carefully alongside our Terms of Service and Cookie Policy.

The data controller responsible for your personal data is Road Lux Ltd, a company registered in England and Wales under company number 08837891, VAT registration number 406558981, with its registered office at Kamp House, 124 Middleton Road, Morden, England, SM4 6RW.

Contact details

• Email: info@roadlux.uk
• Postal address: Kamp House, 124 Middleton Road, Morden, England, SM4 6RW
• Company number: 08837891
• VAT number: 406558981

If you have any questions about this policy or how we handle your personal data, please contact us using the details above and we will respond as soon as reasonably possible.

In this policy, "personal data" means any information relating to an identified or identifiable living individual. "Processing" means anything done with personal data, including collection, storage, use, disclosure and deletion. "Controller" means the entity that determines the purposes and means of processing. "Processor" means an entity that processes personal data on the controller's behalf and instructions.

• "VRM" means vehicle registration mark, i.e. a number plate.
• "DVSA" means the Driver and Vehicle Standards Agency.
• "DVLA" means the Driver and Vehicle Licensing Agency.
• "We", "us" and "our" refer to Road Lux Ltd.
• "You" refers to the individual using or interacting with our Service.

We collect and process several categories of personal data depending on how you use the Service. We aim to collect only what is necessary for the purposes described in this policy.

Account data

• Name and email address used to register or sign in.
• Hashed password credentials (we never store passwords in plain text).
• Account preferences, saved vehicles, and settings.

Registration search (VRM) data

• Vehicle registration numbers you enter to run a check.
• Search timestamps, search history associated with your account, and results returned.

Purchase and report data

• Order references, product purchased, price paid, and date of purchase.
• The vehicle report generated for you and any download or access history.
• Payment metadata received from Stripe, such as the last four digits of a card, card brand, billing name and email, and transaction status. We never receive, transmit or store full card numbers, CVV/CVC security codes, or card PINs.

Device, log and security data

• IP address, browser type and version, operating system and device identifiers.
• Referring URLs, pages visited, timestamps, and approximate location derived from IP.
• Security and abuse-prevention logs, including rate-limit and fraud-signal data.

Contact and enquiry data

• Name, email address, and any information you provide via our contact form, email or phone.

Marketing and cookie preference data

• Your marketing consent status and the date and time it was given or withdrawn.
• Cookie consent choices, stored via cookies and similar technologies described in our Cookie Policy.

We collect personal data in the following ways:

• Directly from you, when you register, run a check, make a purchase, or contact us.
• Automatically, through cookies, log files and similar tracking technologies as you use the Service.
• From third parties, such as Stripe (payment confirmation data) and our vehicle data suppliers (results relating to the VRM you searched).

Under Article 6 of the UK GDPR, we must have a valid lawful basis for each purpose for which we process personal data. The table below sets out our principal purposes and the corresponding lawful basis.

Where we rely on legitimate interests, we have considered and balanced our interests against your rights and freedoms and concluded that the processing is necessary and proportionate. You may object to processing based on legitimate interests at any time; see the "Your rights" section below.

A vehicle registration mark (VRM) alone is generally not personal data. However, when a VRM is combined with other information—such as an account holder's identity, purchase history, or IP address logged alongside a search—it can become personal data because it may be capable of identifying, or being linked to, an individual.

We therefore treat search history, saved vehicles, and report purchase records associated with your account as personal data and apply the protections described in this policy to them, even though the underlying vehicle record itself relates to a vehicle rather than a person.

To generate vehicle history reports, we obtain data from official government sources, including DVSA MOT history data services, and from licensed commercial vehicle data providers who compile records such as mileage history, write-off and salvage markers, outstanding finance, stolen vehicle markers, and plate change history.

These suppliers act as independent controllers or processors of the vehicle data they provide, depending on the nature of the data and their own terms. We select suppliers that hold appropriate licences and data protection safeguards, and we only request data reasonably necessary to compile the report you have requested.

All card payments made through the Service are processed by Stripe, Inc. and its affiliates ("Stripe"), a PCI-DSS Level 1 certified payment processor. When you make a purchase, your card details are entered directly into Stripe's secure payment fields and transmitted to Stripe over an encrypted connection.

We do not receive, transmit, process or store full card numbers, CVV/CVC security codes, or card PINs on our own systems. We receive limited payment metadata from Stripe—such as a transaction identifier, payment status, card brand, and the last four digits of the card—which we use to reconcile orders and provide customer support.

Stripe's own processing of your payment data is governed by Stripe's privacy policy, available at stripe.com/gb/privacy. Stripe acts as an independent controller for certain purposes, such as fraud prevention across its network of merchants.

We engage carefully selected third-party service providers ("processors") to help us operate the Service. Each processor is bound by a data processing agreement requiring them to protect personal data and to process it only on our documented instructions.

• Cloud hosting and infrastructure providers, for storing and serving the Service.
• Database providers, for secure storage of account, order and report data.
• Email delivery providers, for transactional emails (receipts, report links) and, where consented, marketing emails.
• Stripe, for payment processing as described above.
• Analytics providers, for aggregated usage statistics and service improvement.
• Customer support tooling providers, for managing enquiries.

We maintain an internal record of our processors and review them periodically. Details of specific sub-processors are available on request by emailing info@roadlux.uk.

We may share personal data with:

• Our processors listed above, strictly for the purposes of providing the Service.
• DVSA and licensed commercial vehicle data suppliers, to obtain the data underlying a check or report.
• Professional advisers, such as accountants, auditors and lawyers, where necessary for their engagement.
• A buyer or successor entity in the event of a merger, acquisition, restructuring, or sale of some or all of our business or assets, subject to appropriate confidentiality protections.

We do not sell personal data to third parties, and we do not share vehicle search or report content with other users of the Service.

We may disclose personal data where required to do so by law, regulation, court order, or a valid request from a public or government authority, including law enforcement agencies, tax authorities such as HMRC, or regulators such as the Information Commissioner's Office (ICO).

We may also disclose personal data where necessary to establish, exercise or defend legal claims, to prevent fraud, or to protect the rights, property or safety of Road Lux Ltd, our users, or the public.

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction, including:

• Encryption of data in transit using TLS/HTTPS across the Service.
• Access controls and role-based permissions restricting internal access to personal data.
• Row-level database security policies limiting data visibility to the relevant account.
• Server-side storage of secrets and API keys, never exposed to the browser.
• Regular review of third-party processors' security practices.
• Monitoring and logging to detect and respond to suspicious activity.

While we take security seriously and apply industry-standard safeguards, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

To protect our Service, our customers, and our vehicle data suppliers from misuse, we monitor for patterns consistent with fraud or abuse, such as automated scraping, excessive free searches from a single source, chargeback abuse, or attempts to bypass payment. This may involve processing IP addresses, device fingerprints, and request patterns.

Where fraud indicators are identified, we may restrict access to the Service, decline transactions, or share relevant information with Stripe, our suppliers, or law enforcement as necessary. This processing is based on our legitimate interests in maintaining a secure and trustworthy Service.

The Service does not use automated decision-making that produces legal effects concerning you, or similarly significantly affects you, without human involvement. Some limited automated processing is used for fraud and rate-limit checks (for example, automatically flagging unusually rapid repeated searches), but such flags are reviewed before any material action is taken, and you may contact us to query or challenge any decision affecting your access to the Service.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements.

Where we no longer need personal data for these purposes, we securely delete or anonymise it.

Some of our processors may store or process personal data outside the United Kingdom, for example in the European Economic Area or the United States. Where this occurs, we ensure an adequate level of protection is in place, using one or more of the following safeguards:

• Transfers to countries covered by UK adequacy regulations.
• The UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Other appropriate safeguards recognised under the UK GDPR, such as the processor's own certified compliance programme.

You can request further information about the safeguards used for a specific transfer by contacting us at info@roadlux.uk.

Subject to certain conditions and exemptions, you have the following rights in relation to your personal data:

Right of access

You can ask us to confirm what personal data we hold about you and to provide a copy of it.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

You can ask us to delete your personal data where there is no good reason for us to continue processing it, subject to legal retention obligations.

Right to restrict processing

You can ask us to suspend the processing of your personal data in certain circumstances, for example while a rectification request is being verified.

Right to data portability

You can ask us to transfer certain personal data you have provided to us, in a structured, commonly used and machine-readable format, to you or a third party.

Right to object

You can object to our processing of your personal data based on legitimate interests, including profiling, and to processing for direct marketing purposes at any time.

Right to withdraw consent

Where processing is based on your consent (such as marketing emails), you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights

To exercise any of these rights, email us at info@roadlux.uk with details of your request. We may need to verify your identity before responding. We will respond within one month, extendable by a further two months for complex or numerous requests, in which case we will explain why the extension is necessary.

We only send you marketing communications, such as MOT reminders, product updates, rewards and offers, where you have given consent (for example, at checkout or via your account settings), or where permitted under the "soft opt-in" rules of PECR for existing customers regarding similar products or services.

You can opt out of marketing at any time by clicking the unsubscribe link included in every marketing email, or by updating your preferences in your account settings, or by emailing info@roadlux.uk. Opting out of marketing does not affect transactional emails, such as order confirmations, receipts, or report delivery, which are necessary for us to provide the Service.

We use cookies and similar technologies to operate the Service, remember your preferences, keep you signed in, process payments, and understand how the Service is used. Some cookies are strictly necessary and cannot be disabled; others (such as analytics and marketing cookies) are only set with your consent.

For full details of the cookies we use, their purpose, duration, and how to manage your preferences, please see our Cookie Policy.

The Service is intended for use by individuals aged 18 or over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@roadlux.uk so that we can delete it.

The Service may contain links to third-party websites, such as vehicle finance checkers, insurers, or DVSA/DVLA government services. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any third-party website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the updated policy on this page and revise the "last updated" date. Where changes are material, we will take reasonable steps to notify you, such as by email or a notice on the Service.

We encourage you to review this policy periodically to stay informed about how we protect your personal data.

We hope we can resolve any concerns you have about our handling of your personal data. Please contact us in the first instance at info@roadlux.uk and we will do our best to address your concern promptly and fairly.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at any time:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you have any questions, requests or concerns about this Privacy Policy or our data practices, please contact:

• Road Lux Ltd
• Kamp House, 124 Middleton Road, Morden, England, SM4 6RW
• Company number: 08837891
• VAT number: 406558981
• Email: info@roadlux.uk