PRIVACY POLICY
LAST UPDATED: 14 JULY 2026
PlateFlow is a trademark and trading name of 56SV Ltd, registered in England and Wales (Company No. 17323675). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
This policy explains what personal data we collect, why, and what your rights are. We've written it the way we write everything — plainly. If anything is unclear, email hello@plateflow.uk.
1. Who we are, and the two hats we wear
PlateFlow is business software for the UK number-plate trade. Under UK GDPR we act in two capacities, and it matters which one applies to which data:
- We are the controller for data about you and your business: your account (name, email, sign-in records), your business profile, your support tickets, and our marketing to the trade.
- We are a processor for the data you put into PlateFlow about your customers — purchaser names and addresses in your Register of Number Plate Suppliers (RIO) records, trade-account contacts, job and invoice details. For that data, you are the controller and we process it only to run the service for you.
2. What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Account details (name, email) | Sign-in (we email you a one-time code — no passwords), notifications, support | Contract |
| Business details (name, address, VAT number, bank details you choose to add) | Invoicing, connections between businesses, your tax exports | Contract |
| Activity records (orders, jobs, price changes, sign-ins) | Running the service; an audit trail of who did what, which protects you | Contract / legitimate interests |
| Support tickets and messages | Answering you; improving the product | Contract / legitimate interests |
| Marketing contact details of registered number-plate suppliers (business name, business email), sourced from the DVLA public register via Freedom of Information | Telling the trade PlateFlow exists — business-to-business marketing with a working unsubscribe in every email | Legitimate interests (see §3) |
| Data you enter about your customers (RIO purchaser records, garage contacts, vehicle registrations) | Processed on your instructions to run your shop | You are the controller; your basis for the statutory supply record is legal obligation (the Register of Number Plate Suppliers regime); ours is the contract with you |
About plate-supply (RNPS) records specifically: PlateFlow stores document reference numbers, never photographs or scans of identity documents. That data is used only for the statutory supply record — never for marketing. Access is limited to the shop that created it (and us, as their processor, to run the service); it's encrypted in transit and backed up encrypted; and every access-relevant change is logged in the audit trail.
3. Marketing, and where our list came from
Our prospect list is drawn from the DVLA's public register of number plate suppliers, obtained under the Freedom of Information Act. These are business contact details, and we contact them about a business service — which UK PECR permits for corporate subscribers under legitimate interests. Every marketing email says where we got your details, and carries a one-click unsubscribe. Opt-outs are honoured immediately, permanently, and survive any re-import of the list. We never sell or share the list.
4. Who we share data with
Nobody, except the processors we need to run the service:
- Resend (email delivery, USA) — receives recipient name/email and message content. Transfers are covered by the UK Extension to the EU–US Data Privacy Framework / standard contractual clauses.
- Our hosting provider (UK/EU virtual server) — stores the database and backups.
- DVLA APIs — when you look up a vehicle by registration mark, that registration is sent to the DVLA's Vehicle Enquiry Service.
We'll disclose data where the law requires it — for example, DVLA or police requests relating to statutory plate-supply records.
5. How long we keep things
| Data | Retention |
|---|---|
| Your account and business data | Life of the account, then deleted within 90 days of closure — except where statute requires longer |
| RIO (plate supply) records | These are statutory records, kept for three years from the sale as the Register of Number Plate Suppliers regime requires, then securely deleted unless another documented legal reason requires longer. They are exportable to you at any time — including at account closure and even if your account is suspended — and are available to the police, DVLA, DVSA and Trading Standards as the law provides |
| Invoices, VAT records | Six years, per HMRC requirements |
| Sign-in codes | Minutes — codes expire after 10 minutes and the emails carrying them are purged from our sending log within the hour |
| Marketing opt-outs | Kept indefinitely — that's how we make sure we never email you again |
| Audit trail | Six years |
6. Cookies
One essential session cookie to keep you signed in, and a CSRF token to keep forms safe. No advertising cookies, no analytics trackers, no consent banner needed — there's nothing to consent to.
7. Security
Data is encrypted in transit (HTTPS); API credentials are encrypted at rest; sign-in uses one-time emailed codes rather than passwords, so there is no password database to steal; every material action is recorded in an immutable audit trail. No system is perfect — if we ever suffer a breach that risks your rights, we'll notify you and the ICO as UK GDPR requires.
8. Your rights
You can ask us for a copy of your personal data, ask us to correct it, delete it (where no statutory retention applies), restrict or object to processing, and port it. Email hello@plateflow.uk — we respond within one month. If your request concerns data a plate shop holds about you as their customer (for example a RIO record), we'll route you to them, since they're the controller — but we'll help them respond.
Not happy with how we've handled something? You can complain to the Information Commissioner's Office at ico.org.uk — though we'd appreciate the chance to fix it first.
9. Changes
If this policy changes materially we'll say so in the app and by email. The date at the top is always current.
10. Contact
56SV Ltd (trading as PlateFlow)
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
hello@plateflow.uk