Privacy Policy

1. Who we are

Chequered Past is a trading name of Headmere Limited, a company registered in England and Wales (company number 17227133). Our registered office is at 66 Paul Street, London, EC2A 4NA. We operate the website chequeredpast.uk, which offers a free registration check and the vehicle history check for cars registered in the United Kingdom.

We are the data controller for the information described in this policy. We are registered with the UK Information Commissioner's Office (ICO) under registration number 00013811807.

Contact: hello@chequeredpast.uk

2. What data we collect

We deliberately collect the minimum data needed to run a free check and deliver a vehicle history check to you. Specifically:

• Your email address: so we can show and email you a free check result, deliver your vehicle history check, respond to support queries, and send you our ongoing emails where you have asked for them or have not refused them.
• The vehicle registration mark (VRN): required for the vehicle history check and the free check. The VRN is used to query our licensed vehicle-data provider and UK government registers about the specific vehicle you are considering (see §5).
• A VIN, if you choose to enter one: compared with the VIN on the official record during your check, then deleted. It is never stored or logged, and we never show you the VIN on the record.
• Order metadata generated automatically: a public order reference, a timestamp, and the status of your order.
• Email-subscription details: optional. If you tick a box asking for our ongoing emails, we record your email address, when you agreed, which offer and page you agreed on, the wording you agreed to, and the make, model line and generation of the car you checked.

We do not collect your name, postal address, phone number, date of birth, payment card details, or any other personal identifier except when you ask us to find an inspector (see Inspection requests below). Payments are handled entirely by Stripe (see §5): we never see or store your card data.

A note on the VRN

Free checks

To see a free check result you give us your email address. We use it to show you the result and to email you a copy.

Unless you tick the box refusing them, we also send occasional car buying advice and offers on our vehicle history check. We rely on the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations 2003: you gave us your address while looking at our products, we only email you about similar products, you can refuse at the point you give it, and every email carries a way to stop.

We record your address, when you gave it, the page you were on, the wording you were shown, whether you refused, and the make, model line and generation of the car you checked. We do not keep the registration with your email address. Our usage log holds the registration you entered for 12 months, then deletes it. If a check fails, the registration is included in an internal alert to us so we can find out what went wrong. We keep this email record until you ask us to delete it, and if you refuse or unsubscribe we keep it only so that we do not email you.

Email subscriptions and earlier coverage requests

If you tick a box asking for our ongoing emails, we rely on your consent. We send car-buying advice and occasional Chequered Past emails about the kind of car you checked, and every email has an unsubscribe link. A subscription is a standing permission, so we hold it until you ask us to delete it. If you unsubscribe, we keep your address only as a record not to email you again. We do not delete it on a schedule, and we do not treat silence as a withdrawal. We store the make, model line and generation of the car you checked with your address, never the registration.

We used to offer a coverage checker, which let you ask to be told when a car became covered. We no longer offer it. Requests already made are kept for up to 12 months from the date they were made, then deleted. You can ask us to delete yours sooner at any time.

Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

Inspection requests

If you ask us to find an inspector, we pass the details you give us to up to three independent inspectors so they can quote for the work. We only do this with your consent, and we keep the request for 12 months.

3. Why we collect it and legal basis

Under the UK GDPR we must have a lawful basis for processing personal data. The bases we rely on are:

• Performance of a contract (UK GDPR Art. 6(1)(b)): Processing your email address, your submitted VRN, and any VIN you enter is necessary to produce and deliver the vehicle history check you have paid for.
• Legitimate interests (Art. 6(1)(f)): Retaining order records for a limited period to handle refund requests, support queries, and fraud prevention. Also: querying our licensed vehicle-data provider and government registers about the VRN you submit, so that the check can include accurate model-derivative specification, provenance, finance, write-off, mileage, MOT and recall data. The legitimate interest is yours, as a prospective buyer conducting due diligence on a vehicle that is being or is intended to be marketed or offered for sale. We have considered the interests of the registered keeper of the queried vehicle and concluded that this processing does not override those interests, in light of the safeguards described in §10 and §11.
• Legal obligation (Art. 6(1)(c)): Retaining payment and transaction records for the period required by UK tax law (currently 7 years for VAT and corporation tax purposes).
• Consent (Art. 6(1)(a)): If you subscribe to our emails (see §2), we process your email address and the vehicle details you provided on the basis of your consent. We likewise rely on your explicit consent for our optional analytics and session replay (see §6), which run only if you accept them via our cookie banner.

4. How long we keep it

We retain your email address, submitted VRN, and order records for 12 months from your last order or interaction, after which the email address and VRN are automatically scrubbed from our database.

Your vehicle history check is delivered as a web page hosted on our servers (see §5a, Railway). It is accessible only via a unique link, containing an access token, shown on screen and included in your receipt email: the link is not publicly indexable or searchable. The check remains available at that link for 12 months from when it was produced, after which it is automatically deleted. When you open the link, your browser exchanges standard web traffic information with our servers (such as IP address and browser type) over HTTPS, in the ordinary course of loading any web page.

Products we no longer offer. Car advert reports, two-car comparisons, Full report orders and our earlier paid report were each kept for 12 months from when they were produced, and that schedule continues until the last of them is deleted. PDF copies of earlier paid reports are held on Google Drive (see §5a) until then.

Payment and transaction records (held by Stripe and reflected in our accounting records) are retained for 7 years after the end of the accounting period in which the transaction occurred, in line with HMRC requirements under the Companies Act 2006 and applicable VAT regulations.

We do not retain the underlying vehicle data returned to us by our licensed provider beyond the runtime of each check. See §10 for the data-architecture safeguards that implement this.

If you explicitly request deletion of your data sooner, we will do so within 30 days, except for records we are legally required to retain. Email hello@chequeredpast.uk with your order reference to request deletion at any time (see §8).

5. Third parties we share data with

We share the minimum necessary data with the following service providers and external sources. We distinguish between data processors (companies that act on our instructions), licensed data providers (commercial sources that supply vehicle data to us under licence), and independent data sources (government registers we query about your vehicle).

5a. Data processors

Each processor below acts on our behalf under a written agreement (or equivalent terms in their service contract) that complies with Article 28 of the UK GDPR.

Stripe (payments)

Stripe Payments UK Ltd processes your payment. When you pay, you provide your card details directly to Stripe: we never see them. Stripe also collects your email address at checkout, which is shared back to us so we can deliver your vehicle history check. Data is processed in the UK and the United States. Stripe's privacy policy.

Resend (email delivery)

Resend (resend.com, operated by Resend, Inc.) is the email delivery service we use for every email we send you: your receipt and the link to your check, any support messages, our review invitation, and, where you have ticked a box asking for them, the emails you subscribed to. Resend processes your email address and the email body. What that body contains depends on which email it is: an order email carries your order reference and a link to your check; a subscription email carries neither, names only the make, model line and generation of the car you checked, and carries a one-click unsubscribe link. Data is processed in the United States. Resend's privacy policy.

Trustpilot (review invitations)

Trustpilot A/S, Denmark, receives a copy of the review invitation email we send you three days after your vehicle history check is delivered. That copy is how Trustpilot issues its own invitation for you to review us. It carries your email address, the wording of the invitation and your unsubscribe link. It carries nothing about your vehicle and nothing from what we sent you.

Google (Drive, file storage)

PDF copies of reports from our earlier paid product, which we no longer offer, are stored on Google Drive (Google Ireland Ltd) until they are deleted (see §4). Google does not receive your email address. Data is processed in the European Economic Area, with onward processing in the United States under Google's standard contractual safeguards. Google's privacy policy.

Railway (hosting)

Our application, database, and the hosted HTML version of your check are hosted on Railway (Railway Corp.). Railway stores the operational data described in §2 and the rendered HTML of each check (accessed via the unique link in your delivery email; see §4) on secure infrastructure. Data is processed in the United States. Railway's privacy policy.

5b. Licensed vehicle-data providers

To produce a vehicle history check, we query licensed commercial providers of UK vehicle data. We send only the VRN you submitted; we do not send your email address or any other personal information about you. Each provider acts as a separate data controller in respect of its own vehicle-data database.

Vehicle Data Global Limited (VDGL)

VDGL (Princess House, Princess Way, Swansea, SA1 3LW; company number 16053104) is a UK-based licensed reseller of UK vehicle data, operating under DVLA's bulk data licensing framework. We query VDGL with your VRN to retrieve:

• Model-derivative specification, model derivative, and indicative valuation;
• MOT history (test dates, results, mileage at each test, advisories, and failure reasons);
• Provenance and risk data: outstanding finance records, insurance write-off categorisation (MIAFTR), stolen markers (PNC), structured mileage anomalies, keeper-change history, plate-change history, V5C reissue history, and cherished-transfer markers;
• Outstanding safety recall data.

The data VDGL supplies is sourced under licence from DVLA, Experian Limited, and other industry providers. We have no direct contractual relationship with DVLA, Experian Limited, or any other upstream provider: our relationship is with VDGL under their published licence terms, which include DVLA Schedule 4 flow-down obligations relating to the use and disclosure of DVLA-sourced data.

Data is processed in the United Kingdom. VDGL's privacy notice.

One Auto API Limited (One Auto)

When you buy the vehicle history check, we send the registration to One Auto API Limited, a company registered in England and Wales, to retrieve the manufacturer's build record for that car: the equipment it left the factory with and its build date. One Auto receives the registration and nothing else, not your email address.

One Auto's privacy policy.

From time to time we may switch to an equivalent licensed provider where this improves the accuracy or coverage of our checks. Any such change will be reflected in an updated version of this policy.

5c. UK government registers we query directly

In addition to the licensed providers above, we query these UK government services directly:

DVLA: Vehicle Enquiry Service (VES)

The Driver and Vehicle Licensing Agency (DVLA) operates the Vehicle Enquiry Service. We use this for basic vehicle identity (make, model, year of manufacture, fuel type, colour, MOT and tax status, CO₂ emissions, type approval, and export markers) on every free check and vehicle history check. About the DVLA Vehicle Enquiry Service.

DVSA: MOT History

The Driver and Vehicle Standards Agency (DVSA) operates the MOT history service. We query it with the VRN to show the car's MOT history and whether it has an outstanding safety recall. DVSA processes queries in line with its own privacy notice.

DVLA processes VRN queries in line with its own published privacy notice. We do not control how DVLA processes the data we send it or how long it retains query logs.

5d. International transfers

Some of the processors above are based in, or transfer data to, countries outside the UK. The countries involved are:

• United States (Stripe, Resend, Railway, and Google's onward processing): the UK Government has issued an adequacy decision for the EU-US Data Privacy Framework (the UK Extension), and where a processor is certified under that framework, transfers rely on it. Where not, transfers are made under the UK Addendum to the EU Standard Contractual Clauses.
• European Economic Area (Google (Ireland), Trustpilot (Denmark)): the UK considers the EEA adequate; no additional safeguards are required.
• United Kingdom (Stripe UK, VDGL, One Auto, DVLA, and DVSA): no international transfer.

6. Cookies and analytics

Strictly necessary cookies

When you pay through Stripe Checkout, Stripe sets cookies necessary for the payment flow (e.g. fraud prevention). These cookies are set by Stripe on the Stripe domain and are not under our control. They are strictly necessary for the payment function and do not require separate consent.

We set one first-party cookie, pci_consent, to remember your cookie choice so we don't ask again. Because it exists solely to honour your preference, it is a strictly necessary cookie and does not require consent. Stripe sets strictly necessary cookies during checkout. Analytics cookies are described below and are set only with your consent.

Analytics

We use Google Analytics (GA4) to understand, in aggregate, how visitors use our site so we can improve it. These analytics cookies are set only after you accept them via our cookie banner. If you decline, no analytics cookies are set and no analytics data is collected about your visit. We use Google Consent Mode, which defaults these cookies to "denied" until you choose, and you can change or withdraw your choice at any time using the Cookie settings link or by clearing cookies in your browser. The lawful basis for this processing is your consent (UK GDPR Article 6(1)(a); PECR regulation 6). Google processes this data as described in Google's Privacy Policy. We do not use it for advertising or share it with advertisers.

We also use Microsoft Clarity on parts of our site, currently our home page, the free check page, where you enter a registration, and our Porsche pre-purchase inspection page. Clarity records how visitors interact with those pages, including mouse movement, scrolling and clicks, and reconstructs those interactions as a session replay we can watch back to see where the pages confuse or obstruct people. Form input is masked: the content you type into fields, including your email address and registration number, is not captured. Clarity operates under the same consent controls as our other analytics. It loads only after you accept via our cookie banner, and if you decline it does not load at all. The lawful basis for this processing is your consent (UK GDPR Article 6(1)(a); PECR regulation 6). Microsoft processes this data as described in the Microsoft Privacy Statement.

7. Automated decision-making

The vehicle history check is produced by automated software without manual human review of each individual check. Each finding is given a status, such as Clear, Recorded or Not checked, produced automatically from:

• The vehicle data returned by VDGL for the VRN you provided (derivative-level specification, derivative, valuation);
• The provenance data returned by VDGL (outstanding finance, write-off status, stolen markers, mileage anomalies, keeper- and plate-change history);
• The MOT test history returned by DVSA, or by VDGL if DVSA's service does not answer, and whether the car has an outstanding recall;
• Vehicle identity data returned by DVLA VES;
• The manufacturer's build record returned by One Auto for the VRN;

Article 22 of the UK GDPR gives you the right not to be subject to a decision based solely on automated processing where that decision produces legal effects or similarly significant effects for you. Our processing falls outside the strict scope of Article 22 because:

• The statuses are presented as part of an informational check, not a binding decision about you;
• The decision the check informs (whether to view, negotiate on, or buy a vehicle) is made by you, not by us;
• The analysis concerns a vehicle, not the data subject; the data subject is the buyer commissioning the check, and the check contains analysis they have commissioned for their own use.

We mention this here in the interest of transparency, so you understand both what the automated processing does and what it does not do:

If you would like an explanation of how a specific element of your check was determined, contact us at hello@chequeredpast.uk quoting your order reference.

8. Your rights

Regardless of where you live, you can contact us at any time to exercise the following rights over the data we hold about you:

• Right of access: request a copy of the data we hold about you.
• Right to rectification: ask us to correct data that is inaccurate.
• Right to erasure: ask us to delete your data. We will do so within 30 days unless we have a legal obligation to retain it (for example HMRC tax records, see §4).
• Right to object / restrict processing: ask us to pause or stop certain uses of your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Rights regarding automated decisions: see §7.

To exercise any of these rights, email hello@chequeredpast.uk. We will respond within 30 days (one calendar month).

9. Jurisdiction-specific rights

UK United Kingdom

This policy is governed by UK data protection law, including the UK GDPR and the Data Protection Act 2018. If you believe we have mishandled your personal data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. We would, however, appreciate the chance to address your concern first: please contact us before escalating.

10. Security and data-architecture safeguards

We take reasonable technical and organisational measures to protect your data:

• All data is transmitted over HTTPS (TLS).
• Our database is not publicly accessible and is hosted on managed infrastructure with restricted access.
• Access to administrative systems is restricted to the company's sole director (the only person with access) and protected by two-factor authentication.
• API credentials for VDGL, DVLA, DVSA, One Auto, Stripe and Resend are stored as environment variables in the hosting environment and are never exposed to the browser.
• Payment card data is never stored by us: it is handled entirely by Stripe.

10.1 Data-architecture safeguards

In addition to the general security measures above, we operate four specific data-architecture safeguards in connection with the licensed vehicle data we obtain from VDGL. These safeguards exist to honour our obligations under VDGL's licence terms (which incorporate DVLA Schedule 4 and Schedule 5 flow-down requirements and VDGL's Provenance Data Reseller Terms) and to protect the registered keepers of vehicles our customers query:

1. Strict per-check data fetching. Every vehicle history check triggers fresh, live queries to VDGL for the VRN in question. We do not maintain a persistent cache of VDGL responses for serving future customer lookups. Vehicle data exists only as runtime state during the generation of an individual check.
2. No secondary vehicle database. We do not use the data we receive from VDGL to construct, populate, or maintain any internal database, directory, index, or lookup of vehicles. Historical lookups exist only as check artefacts (the customer's hosted check) and per-check operational logs and diagnostic records sufficient to handle support queries and to maintain the quality of our analysis; they are not queryable as a dataset, and they are deleted in line with the retention periods in §4.
3. No VIN exposure to customers. Where VDGL returns a Vehicle Identification Number (VIN) to our pipeline, the VIN is used only as an internal key for matching vehicle records returned by our licensed data provider. No VIN (full, partial, or otherwise) is shown in the vehicle history check delivered to the customer, in any visible field, hidden field, metadata, or source code. This safeguard reflects DVLA Schedule 5 §3.1(a), under which the full VIN must not be disclosed to consumers; and Schedule 5 §4.2–§4.3, under which even a partial VIN can uniquely identify a vehicle where fewer than 500 of a given type are first-registered in a year: a threshold which applies to many low-volume cars. If you enter a VIN, we compare it with the official record and delete it once your check is done. We never show the record's VIN.
4. Finished checks only. The data we receive is presented to the customer as a finished check, in plain words and labelled findings. The vehicle history check does not expose raw structured DVLA records, raw engine numbers, raw industry record identifiers, or any data field in a form that could be machine-extracted and used to harvest data, impersonate the vehicle, or otherwise misuse the licensed data.

These safeguards are encoded in our product architecture and are enforceable against our own staff and systems. They reflect compliance commitments made to our licensed data provider and, ultimately, to the UK Government's framework for the licensing of DVLA-sourced data.

10.2 Incident notification

No system is perfectly secure. If we become aware of a data breach that affects your personal data and is likely to result in a risk to your rights, we will notify you and the ICO within 72 hours, in line with UK GDPR requirements.

11. Vehicle data and the registered keeper

When you submit a VRN, we obtain data about a specific vehicle. UK data protection law treats some of this data as personal data of the vehicle's registered keeper, because the keeper can be identified by combining the VRN with other information (held, for example, by DVLA). The licensed provider we use (VDGL) returns technical information about the vehicle (specification, finance status, write-off status, mileage history, MOT history, keeper-change history, plate-change history) without disclosing the keeper's name, address, or contact details to us.

Because we cannot link the technical vehicle data we hold to a specific identifiable keeper, the transparency obligations in Article 14 of the UK GDPR are limited in scope (per Article 11(2)). Nonetheless, we are committed to publishing the information in this policy so that any registered keeper who becomes aware that a check has been commissioned on their vehicle can understand what data was processed, why, and on what legal basis (see §3 and §5).

11.1 The customer as the end recipient of analytical output

The vehicle history check is structured so that the customer, the buyer who has commissioned the check, receives a finished check as the data's terminus. The customer:

• Does not have any query access, API access, or programmatic interface to our underlying vehicle data;
• Does not receive raw structured DVLA records, raw engine numbers, raw VINs (see §10.1, safeguard 3), or any other data field in a form that enables onward distribution as data;
• Receives a single, fixed check, as a hosted page, applicable to the specific vehicle referenced in it.

This product structure is deliberate. It means the customer is the end recipient of analytical output, not an intermediary in the supply chain of DVLA-sourced data, and not subject to the onward-distribution obligations that would apply to a commercial reseller of vehicle data. The customer's own use of the check is governed by our Terms of Service, in particular the purpose-limitation and no-redistribution clauses (Terms §8.1 and §8.2).

If you are the registered keeper of a vehicle and you believe a check has been commissioned about it, you can contact us at hello@chequeredpast.uk to discuss your rights. Note that we may be unable to confirm whether a specific VRN has been queried without sufficient information to verify your identity as the keeper, and we may be unable to disclose customer identities without a legal basis to do so.

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Substantive changes (for example, enabling analytics, adding a new processor, or adding a new category of data) will be notified to existing customers by email where reasonably possible. Continued use of the service after a change constitutes acceptance of the updated policy.

13. Contact