Privacy Notice
How we collect, use, protect and retain personal information.
1. Who we are
PL8 Factory is a trading name of Waxpack Limited, a company registered in England and Wales under company number 09382977.
Unit 121, Ellingham Industrial CentreEllingham Way
Ashford, Kent
TN23 6LZ
Email: da*@********co.uk
Telephone: 01233 557 649
For UK data-protection purposes, Waxpack Limited is the controller of the personal information described in this notice.
2. Information we collect
Depending on how you use our website or workshop, we may collect:
- your name, billing address, delivery address, email address and telephone number;
- account login and communication preferences;
- order, payment-status, refund and transaction information;
- vehicle registration numbers and plate specifications;
- proof of identity and proof of entitlement to use a registration number;
- messages, complaints, reviews and other correspondence;
- website usage, device, browser, IP address and cookie-consent information; and
- fraud-prevention and security information.
Payment-card details are normally collected directly by the selected payment provider. We do not intentionally store complete card numbers or card security codes on our own systems.
3. Why we use your information
| Purpose | Typical information | UK GDPR lawful basis |
|---|---|---|
| Quote, accept and fulfil an order | Contact, order, vehicle and delivery details | Contract |
| Verify identity and entitlement and keep supplier records | Identity, entitlement and sale records | Legal obligation; contract |
| Take payment and prevent fraud | Transaction, device and security information | Contract; legitimate interests; legal obligation |
| Provide support and handle complaints | Order history and correspondence | Contract; legal obligation; legitimate interests |
| Operate and secure the website | Device, log, cookie and security information | Legitimate interests; legal obligation |
| Send optional marketing | Name, email, telephone and preferences | Consent, or legitimate interests where legally permitted |
| Measure and improve the website | Analytics and interaction information | Consent for non-essential cookies or similar technologies |
Where we rely on legitimate interests, those interests include running and securing the business, preventing fraud, improving customer service and establishing or defending legal claims. We consider whether those interests are overridden by your rights.
4. Identity and entitlement documents
Registered number plate suppliers must check that a customer is who they claim to be and is entitled to use the requested registration. Uploaded documents may contain a photograph, date of birth, address, signature, document number and vehicle information.
Images uploaded during an online order are used for preliminary screening only. For a road-legal plate, we inspect acceptable original documents before manufacture, dispatch or handover.
We use those documents only to:
- verify identity and entitlement;
- decide whether we may lawfully manufacture the plate;
- create the supplier records required by law; and
- investigate suspected fraud or respond to an authorised request.
Do not upload more information than requested. You may obscure unrelated financial transaction details on a bank statement, provided your name, address, issuer and document date remain clear.
5. Who receives personal information
We may share information only where necessary with:
- website, hosting, ecommerce, security and customer-support providers;
- payment providers such as Stripe, PayPal or Klarna, depending on your choice;
- delivery and fulfilment providers;
- professional advisers, insurers and auditors;
- DVLA, DVSA, the police, Trading Standards or another authorised public body where required or permitted by law; and
- a purchaser or successor if the business is reorganised or sold, subject to appropriate safeguards.
We do not sell identity-document data.
6. International transfers
Some technology providers may process information outside the United Kingdom. Where this happens, we require an appropriate transfer mechanism and safeguards, such as UK adequacy regulations or approved contractual terms.
7. How long we keep information
| Record | Proposed retention period |
|---|---|
| Registered number plate supplier sale record | Three years from the sale, unless a longer period is lawfully required |
| Orders, invoices, refunds and accounting records | Normally six years after the relevant financial year or transaction |
| Raw identity and entitlement document images | Deleted after verification and creation of the required supplier record, normally within 30 days after the order is completed, rejected or refunded, unless temporarily required for a legal claim or authorised investigation |
| Customer-service and complaint records | Normally up to six years after the matter closes, depending on risk |
| Marketing preferences | Until consent is withdrawn or the record is no longer required; suppression records may be kept to respect an opt-out |
| Cookie and analytics information | According to the live cookie table and consent settings |
8. Security
We use proportionate technical and organisational measures to protect personal information, including access controls, secure transmission, staff restrictions, backups and supplier due diligence. No internet service is completely secure, so please contact us promptly if you believe information has been compromised.
9. Your rights
Subject to legal conditions and exemptions, you may ask us to:
- provide access to your personal information;
- correct inaccurate or incomplete information;
- erase information;
- restrict or object to processing;
- provide certain information in a portable format; or
- withdraw consent at any time where processing is based on consent.
Contact da*@********co.uk. We may need to confirm your identity before acting on a request.
10. Data-protection complaints and updates
You can raise a data-protection complaint by emailing da*@********co.uk, telephoning 01233 557 649, writing to our address, or speaking to us in person. Please explain what happened, identify the information or order involved, and tell us what outcome you are seeking.
We will acknowledge a data-protection complaint within 30 days of receiving it. Without undue delay, we will make appropriate enquiries, keep you informed where the investigation remains open, and tell you the outcome. We may request proportionate evidence of identity or authority where necessary, but will not request more information than we need.
You also have the right to complain to the Information Commissioner’s Office.
We may update this notice. Material changes will be highlighted where appropriate, and the current version and date will remain available here.
