Data Processing Agreement

Last updated: May 2026 · COLLINGHAMCO LTD · Company No. 15540675

Note: This Data Processing Agreement (DPA) applies to trade partners, API users, and business customers who use VRMCheck services as part of a commercial relationship. Individual consumers should refer to our Privacy Policy.

1. Parties

Data Processor: COLLINGHAMCO LTD, Company No. 15540675, registered in England and Wales ("VRMCheck", "we", "us").

Data Controller: The business or organisation entering into a commercial agreement with VRMCheck ("you", "Partner", "Controller").

2. Subject Matter

This DPA governs the processing of personal data by VRMCheck on behalf of the Controller in connection with the provision of vehicle data check and history report services via the VRMCheck platform or API.

3. Nature & Purpose of Processing

VRMCheck processes data on the Controller's behalf for the following purposes:

  • Vehicle registration mark (VRM) lookups against DVSA, DVLA, and licensed data sources
  • Generating vehicle history reports including MOT history, tax status, and vehicle details
  • Delivering reports to end-users on behalf of the Controller

4. Types of Personal Data

Data processed may include:

  • Vehicle Registration Marks (VRMs) — not personal data per se, but may identify individuals indirectly
  • End-user email addresses (where provided for report delivery)
  • IP addresses and device information (server logs)

5. Obligations of the Processor (VRMCheck)

VRMCheck agrees to:

  • Process personal data only on documented instructions from the Controller
  • Ensure persons authorised to process personal data are bound by confidentiality
  • Implement appropriate technical and organisational security measures
  • Assist the Controller in responding to data subject rights requests
  • Delete or return all personal data upon termination of the agreement
  • Notify the Controller of any personal data breach within 72 hours of becoming aware

6. Sub-Processors

VRMCheck uses the following approved sub-processors:

Sub-ProcessorPurposeLocation
DVSA (Gov.uk)MOT history dataUK
DVLA (Gov.uk)Vehicle registration dataUK
Vehicle Data GlobalVehicle data & valuationsUK/EU
Base44 / WixPlatform & data hostingEU

7. Security Measures

VRMCheck implements the following technical and organisational security measures:

  • TLS/SSL encryption for all data in transit
  • Access controls and authentication for all systems
  • Regular security reviews and vulnerability assessments
  • UK GDPR-compliant data storage within the UK/EU

8. ICO Registration

COLLINGHAMCO LTD is registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018. Our ICO registration confirms our commitment to lawful data processing under UK GDPR.

9. Governing Law

This DPA is governed by the laws of England and Wales and the UK GDPR as retained in UK law by the European Union (Withdrawal) Act 2018.

10. Contact

To request a signed DPA or for data protection enquiries, contact: hello@vrmcheck.uk