Privacy Policy

Last updated: 19 October 2026

This policy explains how Bonafied Cars Ltd handles your data when you use our websites and the Open Score Check service. We've written it in plain English. If anything is unclear, send us a message.

What this policy covers

This policy applies to:

• bonafied.co.uk — our main site and landing page
• osc.bonafied.co.uk — the Open Score Check service where you submit a plate and receive a score
• bonafied.uk — the permanent result page URLs that score cards link to

It also covers people selling a car whose public eBay listing we read (see Cars listed for sale on eBay).

Who we are

Bonafied Cars Ltd is a private limited company registered in Scotland, company number SC883330. Our registered office is 12 Broomhill Crescent, Stonehaven, AB39 3UZ.

We're the data controller for any personal data we hold about you. We're registered with the Information Commissioner's Office (ICO) under reference ZC141856.

We are not required to appoint a Data Protection Officer under UK GDPR Article 37. Data protection queries should be sent through our contact form.

What we don't collect

You don't need to register, log in, or give us any personal information to run an Open Score Check. We never collect or process keeper details, and the DVLA does not share keeper information with us.

What we collect, and why

Vehicle registration numbers

When you submit a registration number we send it to the DVSA (for MOT history) and the DVLA (for vehicle data). We never receive keeper details, so we can't tell who owns a car. A registration number can still count as personal data where someone else could link it to a person, so we don't link it to anyone, and our downloadable score cards show only part of it.

Each completed score check is stored as a record indefinitely. This is because each score check generates a permanent result URL that must continue to resolve as long as the score card is referenced anywhere. The record holds the registration number, the vehicle and MOT data, and the score. If, as a seller, you confirm the statement we show before you download a score card, we also store the time, your IP address, your country and your browser details with that record, as evidence of the confirmation.

The vehicle “fingerprint” on score cards

Score cards displayed in seller listings show partial plate, make, model, colour, year, last MOT date and mileage. This combination intentionally identifies the vehicle, so a buyer can verify that the listing in front of them matches the score card. It does not identify the seller or keeper. The seller controls when and where to display the score card.

IP addresses

We log your IP address briefly to rate-limit free score checks (a small number per IP per 24 hours, to keep the service running for everyone). IP records are kept for a rolling 24-hour window and then deleted automatically.

If you use the camera or photo upload to read a registration, we record your IP address with that request in our audit log, to limit abuse of a service we pay for each time it's used, and delete it after 90 days. The photo itself is sent to Microsoft's Azure service to read the plate and is not stored by us.

Email addresses

If you sign up to our mailing list we store your email address in Mailchimp with double opt-in confirmation. You can unsubscribe at any time using the link in any email. We don't use mailing list emails for any other purpose.

Messages sent through the contact form

If you send a message using the form on our contact page, we store the name, email address and message you provide. We use them for one thing: reading and replying to what you sent. We don't add you to the mailing list, we don't use your message for marketing, and we don't share it with anyone.

We deliberately do not store your IP address or browser details alongside your message. Your IP is used momentarily to rate-limit the form against abuse, and is never written down with what you wrote.

Score check audit data

For each score check we record: the registration submitted, timestamp, score, tier, score breakdown by criterion, and the scoring engine version. We use this to monitor service quality, debug problems, and handle any complaints. Retained for 6 years.

Cars listed for sale on eBay

To find good used cars, we read public eBay listings for cars sold privately, through eBay's developer API. We use them to score the cars and to choose some to feature on our website and on social media.

From each listing we keep: the title, the description, the price, when it was listed and when it ends, the link to it on eBay, the seller's eBay username, the town and county the car is listed in and the partial postcode eBay shows, and links to the listing's photos. We read the registration number from the photos or the listing text, so we can look up the car's MOT history, and to do that we may send a listing photo to Microsoft's Azure service. We delete the seller's username, the listing description and the partial postcode 12 months after the listing ends. We keep the car's score record, as for every score check.

We use the seller's username for one thing: telling private sellers from traders, by counting how many different cars the same seller has listed. We never name sellers, and we never publish or store their contact details.

Cars we feature may be shown with the seller's own photos, which can show the number plate. Our score cards show only part of the plate, and on our social media images we cover it. Each featured car links to its score page on bonafied.uk, which shows the registration number in full, as every score page does.

Our lawful basis is legitimate interests: helping buyers understand a car's public MOT record. If you're selling a car and want it removed from our website, send us the registration or the listing link through our contact form and we'll remove it within 5 working days.

Cookies

We use cookies in three categories:

• Essential cookies (always on). Set by our infrastructure provider, Cloudflare, to deliver the site reliably and protect against attacks. Without these, the site won't work.
• Analytics cookies (only with your consent). We use Google Analytics 4 to understand how the site is used. IP addresses are anonymised. We don't use these for cross-site tracking or advertising.
• Marketing cookies (only with your consent). We use the Meta Pixel to measure how our adverts perform when we run them on Facebook or Instagram, and to help Meta show our adverts to similar people. Declining means no Meta data is sent.

You can change your cookie preferences any time by clicking “Change cookie preferences” in the site footer.

How we use your data

We use the data we collect to:

• Provide the Open Score Check service: look up vehicle history, score it, and render the result page
• Maintain the permanent result URLs that score cards link to
• Prevent abuse via rate limiting
• Send mailing list emails (only if you've signed up)
• Improve the service, diagnose issues, and handle complaints
• Measure marketing effectiveness (only if you've consented to marketing cookies)

Our legal basis for processing

Under UK GDPR we need a lawful basis for each thing we do with your data:

• Delivering the Open Score Check — legitimate interest. You've actively requested the service.
• Rate limiting via IP address — legitimate interest. Without it, the service can be abused.
• Audit logs and service quality — legitimate interest. Necessary to operate the service reliably.
• Mailing list emails — consent. You opt in, you can opt out.
• Messages sent through the contact form — legitimate interest. You've chosen to contact us and we need your details to reply.
• Reading public eBay listings and featuring cars: legitimate interest. Helping buyers understand a car's public MOT record.
• Reading a registration from a photo you upload: legitimate interest. You've asked us to read it, and the IP record limits abuse.
• Analytics cookies — consent. PECR requires this.
• Marketing cookies (Meta Pixel) — consent. PECR and UK GDPR require this.
• Affiliate click tracking — consent. Triggered when you click the link.

Where we rely on legitimate interest, we've assessed that our interest doesn't override your rights and freedoms. You can object to processing based on legitimate interest at any time (see “Your rights” below).

Who we share data with

We share data only as needed to operate the service:

• DVSA to retrieve MOT history (registration number only)
• DVLA to retrieve vehicle data (registration number only)
• Cloudflare for hosting, content delivery and security
• Microsoft (Azure, UK South region) to read a registration from a photo you upload, or from a listing photo
• Mailchimp (Intuit Inc.) for mailing list management, if you've signed up
• Google for analytics, if you've consented to analytics cookies
• Meta Platforms Ireland Ltd for advertising measurement, if you've consented to marketing cookies

We don't sell your data, share it with data brokers, or use it for purposes beyond running and improving the service.

Affiliate links

When you click a link to a partner (for example a history check provider, mechanic booking service, or car insurance comparison site), the partner's affiliate network may set cookies and receive standard tracking parameters in the URL to attribute the referral. For some partners we also include the vehicle's registration number in the link, so the partner's page opens pre-filled for that vehicle — for example a history-check provider, or a garage-booking service such as BookMyGarage, showing the car you just scored, so you don't have to re-type the reg. We never receive keeper details, so the registration doesn't tell a partner who owns the car. We don't pass keeper details or any personal information about you to partners ourselves, but a click identifier is created so we can be paid a commission if you go on to buy. We work with several affiliate networks and some direct partner relationships. What a partner does with the registration, cookies and tracking parameters is governed by the partner's own privacy policy.

You can decline affiliate cookies by declining the cookie banner, or simply by not clicking affiliate links.

International data transfers

Some of our service providers are based outside the UK. When personal data is transferred outside the UK we rely on the following safeguards:

• Cloudflare (US) — UK extension to the EU-US Data Privacy Framework
• Mailchimp / Intuit (US) — UK extension to the EU-US Data Privacy Framework
• Google (US) — UK extension to the EU-US Data Privacy Framework
• Meta Platforms (Ireland / US) — UK extension to the EU-US Data Privacy Framework

How long we keep data

• Score check records (registration number, vehicle data, score, breakdown) — indefinitely. Each record powers a permanent result URL.
• DVSA and DVLA responses: the MOT history the DVSA returns is kept with the score check record, so the result page can be shown again as it was scored, and so are the DVLA vehicle details we use. Neither contains keeper details.
• Score card download confirmations (time, IP address, country, browser): kept with the score check record.
• eBay listing details: the seller's username, the listing description and the partial postcode are deleted 12 months after the listing ends; the rest is kept with the car's record (see Cars listed for sale on eBay).
• IP addresses for rate limiting — rolling 24-hour window, then deleted.
• IP addresses recorded with photo uploads: 90 days, then deleted.
• Email addresses on the mailing list — until you unsubscribe.
• Messages sent through the contact form — 12 months from the date you send them, then deleted. Ask sooner and we'll delete it sooner.
• Audit logs — 6 years, aligned to statutory time limits for contract and consumer claims.
• Cookie consent records — 12 months, then we re-ask.

Your rights under UK GDPR

You have the right to:

• Access any personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your personal data (“right to be forgotten”)
• Restrict processing in certain circumstances
• Data portability: receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, where processing is based on consent

A note on erasure. A score check record holds a registration number and vehicle data, not your name or contact details. If you think a record relates to you, for example because you're selling the car on eBay or you confirmed a score card download, contact us and we'll look at it, including removing a featured car from our website. The right to erasure also applies to your email address (if you've signed up to the mailing list), which we'll delete on request, and to anything else we hold about you personally.

To exercise any of these rights, send us a message through our contact form. We'll respond within one month, as UK GDPR requires.

Source of vehicle data

MOT history data comes from the DVSA. Vehicle data comes from the DVLA. Both are published under the Open Government Licence v3.0, which permits commercial use with attribution. We attribute on every public-facing page.

Children

The service isn't directed at children under 16, and we don't knowingly collect data from under-16s. If you believe a child has provided data to us, contact us and we'll delete it.

Security

We use HTTPS site-wide, store API keys in secret managers (never in source code), rate-limit our public endpoints, and apply the OWASP Top 10 as a minimum standard. No system is perfect. If we discover a breach affecting your personal data, we'll notify you promptly and follow our obligations under UK GDPR.

Complaints

If you have concerns about how we handle your data, contact us first through our contact form. If you remain unhappy you have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top tells you when it was last changed. Material changes will be communicated via a site banner or by email (if you've signed up to the mailing list).

Contact

Questions about this policy, or about data we hold on you? Use our contact form and it will reach us.