Private Plate Auctions
Register to bid

Privacy Policy

Last updated: 28 September 2026

1. Who we are

Private Plate Auctions Limited (PPA Auction, we, us) is the controller of your personal data. We are registered in England and Wales, company no. 17281207, registered office [Registered office address], and registered with the Information Commissioner's Office under number [ICO registration number].

For any privacy question or to exercise your rights, contact us at [privacy email] or write to us at the address above.

2. What we collect

Information you give us

  • Account details: name, email address, phone number, postal address, date of birth, username and password.
  • Identity verification: the ID document and selfie or other checks you complete with our verification partner, and the result of those checks.
  • Payment details: your card and bank details, which are collected and stored by our payment and escrow provider rather than by us. We see only limited information such as the card type, the last four digits and payment status.
  • Registration and vehicle information: the plates you list or buy, Certificate (V778/V750) details, V5C details, vehicle registration numbers and the names of any nominee to appear on a Certificate.
  • Communications: messages, support requests, complaints, reports and any call recordings (we'll tell you at the start of a call if it is recorded).
  • Marketing preferences: whether you want to hear from us about upcoming auctions.

Information we collect automatically

  • Auction activity: your bids, maximum bids, watchlist, listings, results and timestamps.
  • Technical data: IP address, device and browser type, pages visited and login times, collected through cookies and similar technologies (see section 9).

Information from others

  • Results of identity, fraud and sanctions checks from our verification partner.
  • Payment and escrow status from our escrow provider.
  • Confirmation of transfer status from the DVLA, where they share it with us or with the parties.

3. How we use it and our lawful basis

What we do
Lawful basis under UK GDPR
Create and run your account, let you list, bid and receive notifications
Performance of our contract with you
Verify your identity and age, and check for fraud, money laundering and sanctions
Legitimate interests (keeping the marketplace safe) and legal obligation
Take and hold payments in escrow, pay Sellers, charge fees
Performance of contract
Arrange the DVLA transfer, including sharing details between Buyer and Seller
Performance of contract
Keep a full auction and bid record to resolve disputes
Legitimate interests
Answer questions and complaints
Performance of contract and legitimate interests
Send service messages (outbid alerts, auction reminders, payment and transfer updates)
Performance of contract
Send marketing about upcoming auctions
Consent, or for existing customers, legitimate interests with an easy opt-out
Improve the site, understand how it's used, keep it secure
Legitimate interests; consent for non-essential cookies
Keep accounting and tax records, respond to lawful requests
Legal obligation

We do not sell your personal data.

Automated decisions. Our identity and fraud checks use automated tools. If a check means you can't use the service, you can ask for a person to review the decision by contacting [privacy email]. Our plate valuation tool is based on market data about registrations and does not use your personal data.

4. What other users can see

Other users see your username next to your bids and listings, never your real name or contact details. Choose a username that doesn't identify you. When an Auction results in a sale, we share the Buyer's and Seller's names, and the details needed for the DVLA transfer, with the other party so the transfer can be completed.

5. Who we share it with

We only share personal data where necessary, with:

  • The other party to your sale, as described above.
  • [Escrow / payment provider], to take payments, hold funds in escrow and pay Sellers.
  • [Identity verification provider], to verify identity and carry out fraud and sanctions checks.
  • The DVLA, to process registration transfers.
  • Service providers who host and run our site and systems on our instructions, including [hosting provider], [email provider] and [analytics provider].
  • Professional advisers such as lawyers, accountants and insurers.
  • Police, regulators and authorities, where the law requires it or to prevent or detect fraud or crime.
  • A buyer or investor in our business, if we sell, merge or restructure, under confidentiality obligations.

Our service providers may only use your data to provide services to us.

6. International transfers

Some of our providers store or process data outside the UK. Where they do, we make sure it is protected by a UK adequacy decision, the ICO's International Data Transfer Agreement, or equivalent safeguards. Contact us for more detail.

7. How long we keep it

  • Account data: while your account is open, and for up to [2] years after it closes, in case you return or raise a question.
  • Auction, bid, payment and transfer records: 6 years from the end of the tax year of the transaction, to meet accounting obligations and deal with legal claims.
  • Identity verification results: for [5] years after your account closes.
  • Marketing data: until you unsubscribe, after which we keep just enough to make sure we don't contact you again.
  • Support messages: [2] years after the matter is resolved.

When we no longer need data, we delete or anonymise it.

8. Your rights

Under UK data protection law you have the right to:

  • access a copy of the data we hold about you;
  • correct data that is inaccurate or incomplete;
  • erase your data, where we no longer have a lawful reason to keep it;
  • restrict or object to how we use it, including objecting to marketing at any time;
  • data portability, to receive data you gave us in a reusable format;
  • withdraw consent where we rely on it, without affecting what we did before.

Some rights have limits. For example, we can't delete records we are legally required to keep, or data needed for a sale that hasn't completed. To use any of these rights, email [privacy email]. We'll respond within one month and won't normally charge a fee.

9. Cookies

We use essential cookies to keep you logged in, protect your account and run the auctions. With your consent, we also use analytics cookies to understand how the site is used. You can change your choices at any time through the cookie settings link at the bottom of every page. Full details are in our Cookie Policy.

10. Keeping your data secure

Our site uses encrypted HTTPS connections, access to personal data is restricted to people who need it, and card details are handled by our payment provider rather than stored on our systems. No online service is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been accessed.

11. Children

Our service is for people aged 18 and over. We don't knowingly collect data from children and will delete it if we find we have.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, and we will email registered users about significant changes.

13. Complaints

If you have a concern about how we use your data, please contact us first at [privacy email] so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.