Website Privacy Notice
Provider: RSMT Limited trading as Driver Codes
Version: v1.2 — October 2nd 2026
Audience: Visitors to the driver.codes website
Published location: driver.codes/legal/website-privacy
This notice explains how RSMT Limited (trading as Driver Codes) handles your personal data when you visit the driver.codes website.
It does not cover:
- using the Driver Codes mobile app for personal driving information — see the Consumer App Privacy Notice;
- being invited by a company to complete a driving licence check — see the Driver Checks Privacy Notice;
- using the business customer portal at app.driver.codes — covered by the customer's own arrangements with us and, in respect of administrator personal data, the relevant Data Processing Addendum.
If you're not sure which notice applies, contact us at privacy@driver.codes and we'll point you to the right one.
1. Who we are
RSMT Limited (trading as Driver Codes), company number 11744436, registered at 19A Queens Road, Hale, WA15 9HF. We are the data controller for the processing described in this notice. We are registered with the Information Commission (formerly the Information Commissioner's Office) under number ZA788385.
We have not formally appointed a Data Protection Officer (the statutory threshold under UK GDPR is kept under review). The internal lead for data protection matters is the Owner of RSMT Limited, contactable via privacy@driver.codes.
2. What we collect when you visit driver.codes
Information you give us through forms — when you fill in a contact form, request a demo, sign up to a newsletter, or send us an email through a website link. Typically this is your name, work email, business name, role, and the message you write.
Information collected automatically — your IP address, browser and device information, the pages you visit, and how you got to the site (referrer). This is gathered through standard web logging and (where you have given cookie consent) analytics tooling.
Information from cookies and similar technologies — see section 6 below.
We do not collect driving licence numbers, National Insurance numbers or driver record information through this website. Those flows happen inside the Driver Codes mobile app or the business customer portal at app.driver.codes, and are covered by the notices linked at the top of this page. The only vehicle data the website handles is the registration number you enter for a vehicle lookup, described below.
Vehicle lookups and the Driver Codes plugin for ChatGPT
When you look up a vehicle on our vehicle check page, or ask ChatGPT or Codex to check a vehicle using the Driver Codes plugin, we receive the vehicle registration number and standard technical request data (IP address, user agent, and time of the request). Through the plugin, the request comes from OpenAI's servers, so we do not receive your name, email address, ChatGPT account details, or the rest of your conversation, and the plugin needs no sign-in. A registration number can be personal data where it can be linked to the vehicle's keeper, so we treat it as such. We use it only to return the vehicle's tax, MOT, and MOT history details, and to operate and secure the service (Article 6(1)(f) legitimate interests).
To answer the lookup, we send the registration number to the DVLA Vehicle Enquiry Service and the DVSA MOT History service, and process it on our hosting provider, Amazon Web Services. The result goes back to you on the page or, through the plugin, to OpenAI for display in your conversation. OpenAI's handling of your conversation is covered by OpenAI's privacy policy. We do not keep a record of the vehicles you look up beyond our web server logs, which are deleted within 12 months, and we never use lookups for marketing or profiling. You can disable or uninstall the plugin at any time in your ChatGPT or Codex settings, delete the conversation in ChatGPT, or contact privacy@driver.codes to exercise your rights under section 8.
3. Why we use your information and our lawful bases
| Purpose | Lawful basis under Article 6 UK GDPR |
|---|---|
| Respond to your enquiry, demo request, or other message you send through the site | Article 6(1)(b) where you are taking steps to enter into a contract; Article 6(1)(f) legitimate interests where you are an existing customer or contact |
| Send you commercial marketing or newsletters where you have opted in | Article 6(1)(a) consent (which you can withdraw at any time) |
| Send you transactional or account-related messages once you sign up | Article 6(1)(b) contract |
| Operate, secure, and improve the website | Article 6(1)(f) legitimate interests |
| Cookies and analytics that aren't strictly necessary | Article 6(1)(a) consent (collected through the cookie banner) |
| Comply with legal or regulatory obligations | Article 6(1)(c) legal obligation |
| Establish, exercise or defend legal claims | Article 6(1)(f) legitimate interests |
We do not sell your personal data, and we do not share it with anyone for the purpose of their direct marketing.
4. Sharing your information
We share information only with parties that need it to help us run the website or our business, including:
- hosting and infrastructure providers that operate the website and our email systems;
- the DVLA and DVSA, which receive the registration number when you run a vehicle lookup on the website or through the ChatGPT plugin;
- email and marketing tooling providers where you have opted in to receive marketing;
- analytics providers where you have given cookie consent;
- professional advisers — accountants, lawyers, insurers — under appropriate confidentiality;
- regulators, courts, and law enforcement where disclosure is required by law or reasonably necessary to protect our rights or the safety of others;
- a successor entity if the business is sold, merged, or reorganised; we'll give notice where appropriate.
5. Where your data is stored
We host the website and process website-collected data in the United Kingdom, primarily through Amazon Web Services in the London region (eu-west-2). Some marketing and analytics tools we use may process limited data outside the UK; where that happens, we rely on the UK International Data Transfer Agreement (UK IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under UK data protection law, supported by a documented Transfer Risk Assessment. Specific locations are identified in the Sub-processor List.
6. Cookies and similar technologies
The website uses the following categories of cookies and similar technologies:
- Strictly necessary — for session management, security, and core site functionality. These do not require your consent under PECR.
- Functional — to remember your preferences and improve usability. Set only with your consent.
- Analytics — to understand site usage and improve the experience. Set only with your consent.
- Marketing — to measure campaign effectiveness and, where you've opted in, to deliver relevant messages. Set only with your consent.
You can accept, reject, or change your preferences through the cookie banner on the site, and through your browser settings. A full list of the specific cookies used, their providers, purposes and lifetimes is published in our Cookie Notice.
If you reject non-essential cookies, parts of the site will still work but some functionality (such as embedded videos or live chat) may be limited.
7. How long we keep your information
| Category | Retention period |
|---|---|
| Contact form, demo request, and similar enquiries | Up to 24 months from the most recent contact, then deleted unless you have become a customer or asked us to keep your information longer |
| Marketing list and preferences | Until you withdraw consent or after 24 months of inactivity, then moved to a suppression list to honour your opt-out |
| Newsletter subscribers | Until unsubscribe |
| Web server logs, including vehicle registration numbers looked up on the website or through the ChatGPT plugin | Up to 12 months |
| Analytics data | In line with the retention configured in our analytics tooling, typically 14 to 26 months |
| Information related to disputes or legal claims | For as long as needed to deal with the matter |
8. Your rights
You have the right to:
- request access to your personal data;
- ask for inaccurate information to be corrected;
- ask for deletion or restriction of processing, where the conditions are met;
- object to processing based on legitimate interests, where you have particular reasons relating to your situation;
- receive a portable copy of certain information (data portability), where the conditions apply;
- withdraw consent at any time where processing is based on your consent (this doesn't affect processing already done before withdrawal);
- not be subject to solely automated decisions producing legal or similarly significant effects.
To exercise a right, contact privacy@driver.codes. We will respond within one calendar month of receiving a valid request, and will let you know if we need an extension in complex cases.
We do not make solely automated decisions about you that produce legal or similarly significant effects through this website.
9. Marketing
We send marketing only where you have opted in, or where the "soft opt-in" rules of the Privacy and Electronic Communications Regulations 2003 apply. Every marketing email contains an unsubscribe link, and you can also manage your preferences by emailing privacy@driver.codes.
10. Security
We take reasonable technical and organisational measures to protect your information — including encryption in transit, role-based access, and continuous security monitoring. Full details of our security measures are available to our enterprise customers on request under non-disclosure.
No system is completely secure, but we work to keep risks low and respond quickly when something needs attention.
11. Other websites
The site contains links to other websites we don't control. We aren't responsible for their privacy practices and recommend reviewing their notices when you visit.
12. Children
The website is not directed at children. We don't knowingly collect personal data from children under 13. If you think we've collected information from a child under 13, please contact us at privacy@driver.codes and we'll delete it.
13. Changes to this notice
We may update this notice from time to time. The current version, with its version date, is always at /legal/website-privacy. Material changes will be notified in advance by website banner or email where appropriate.
14. Complaints
If you think we've handled your data incorrectly, please contact us first at privacy@driver.codes. We'll acknowledge your complaint promptly and aim to provide a substantive response within one calendar month.
If you're not satisfied with our response, you can complain to the Information Commission, the UK's data protection regulator. Their website is ico.org.uk.
15. Contact
Privacy: privacy@driver.codes
General: hello@driver.codes
RSMT Limited: 19A Queens Road, Hale, WA15 9HF
Company number: 11744436
Information Commission registration: ZA788385