Privacy Policy

What We Collect

When you place an order, we collect:

• Your name, email address, phone number and delivery address
• A photo or scan of your V5C vehicle registration document (front and back), which you upload as part of the application
• The vehicle details on your V5C: registration, make and model, VIN, date of first registration, fuel type, engine size, CO₂ figure and Euro emissions standard
• A record that you accepted our Terms & Conditions, including the date and time and the IP address you ordered from — we keep this as evidence of the agreement
• Payment confirmation details from our payment processor, Stripe (we do not see or store your card details — Stripe handles this directly)

If you enter your email on the order page, we record it straight away, even if you don't finish your order (see "Order reminders" below). If you upload your V5C using the QR code on your phone, we record the upload as part of your order session.

Why We Use It

• To provide the service you've paid for — completing and submitting your Crit'Air application to the French government, sending you order updates and your confirmation, and delivering your certificate and sticker. Legal basis: contract.
• To keep records we're legally required to keep, such as receipts for tax and accounting. Legal basis: legal obligation.
• To send you one reminder if you start an order but don't finish it, and occasionally to ask whether you'd leave a review. Legal basis: legitimate interests — and you can opt out at any time.
• To understand how visitors use our site through analytics and advertising cookies — only if you accept them. Legal basis: consent.

Reading Your V5C Automatically

When you upload your V5C, we use an AI service (Claude, provided by Anthropic) to read the document and fill in your details and vehicle information on the order form, so you don't have to type them in. We check the extracted details ourselves before submitting your application. Anthropic processes the image only to return the details to us; under its terms for business customers, it does not use your data to train its models.

Order Reminders

If you enter your email on our order page but don't complete your order, we'll send you one reminder email about it. We tell you this when you enter your email, every reminder has a one-click unsubscribe link, and we never send more than one. Your email is removed from our reminder list as soon as you order, unsubscribe, or after 14 days.

Who We Share It With

To complete your application, we share your details and V5C document with the French government's official Crit'Air system, since they are the body who issues the certificate and sticker — this step is unavoidable and is the actual purpose of our service.

We use the following service providers to run our business. Each processes your data only on our behalf and for the purpose shown:

• Cloudinary — receives and stores your uploaded V5C images
• Anthropic — reads your V5C to fill in the order form (see above)
• Stripe — processes your payment and holds the order details attached to it
• Resend — sends our emails to you (order acknowledgement, confirmation, and the one reminder)
• Trustpilot — receives your name, email address and order reference a few weeks after your order, so it can send you one invitation to review our service (you can unsubscribe from Trustpilot's emails at any time)
• Vercel — hosts our website and briefly stores order data needed to run it (see "How Long We Keep It")
• Google — Gmail for order communication, Google Drive for our order records, and Google Analytics and Google Ads to understand how visitors use our site (only if you accept cookies)

We do not sell your personal data to anyone, and we do not share it for marketing purposes with third parties.

Where Your Data Is Stored

Once we've processed your order, we keep a copy of your V5C and order details in a restricted, access-controlled Google Drive folder, alongside the receipt for your Crit'Air purchase. Only we can access it.

Some of our service providers are based in, or process data in, the United States and other countries outside the UK and EU. Where that happens, your data is protected by the safeguards the law requires, such as standard contractual clauses or an adequacy decision.

How Long We Keep It

• Uploaded V5C images (Cloudinary): deleted automatically after 3 days if you don't complete your order; otherwise deleted automatically 12 months after your order.
• Your V5C and order details in our Google Drive records: deleted 12 months after your sticker is dispatched.
• Receipts and basic order records (name, order reference, date, amount paid): kept for as long as tax and accounting law requires — up to 6 years.
• Order details held for sending your confirmation email: deleted automatically after 60 days.
• Email address on our reminder list: removed when you order, unsubscribe, or after 14 days. If you unsubscribe, we keep a note of your email address so we never send you another reminder.
• Payment records held by Stripe: kept by Stripe as required by financial regulations.

Cookies

We only use analytics and advertising cookies (Google Analytics and Google Ads) if you click "Accept" on our cookie banner. If you click "Reject" or ignore the banner, they stay off, and Google receives only anonymous, cookie-free signals. We remember your choice in your browser so we don't ask you again.

When you pay, Stripe may set its own cookies that are needed to process your payment securely and prevent fraud.

Your Rights

Under data protection law (UK GDPR and EU GDPR), you have the right to:

• Ask what personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data (unless we have a legal reason to keep it, such as tax records)
• Ask us to provide your data in a portable format
• Object to how we use your data, including our order reminder
• Withdraw your consent to cookies at any time, by clearing your browser's site data for our website

To exercise any of these rights, email support@europermits.co.uk. We'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or to the Spanish Data Protection Agency (AEPD) at aepd.es.

Security

We take reasonable steps to protect your data, including restricted access to our file storage and two-factor authentication on the accounts where your data is held. No method of storing or transmitting data is 100% secure, but we work to keep your information as safe as possible.

Changes to This Policy

We may update this policy from time to time. The date at the top shows when it was last changed.