Privacy Policy
Roadlink FZCO processes the customer's data to carry out the Dart Charge registration, for invoicing and for the secure operation of the system; it does not sell the data and does not use it for marketing.
1. Scope
This policy applies to the use of dartfordtoll.co.uk and of every domain and subdomain (e.g. dartford.evignet24.eu) on which the service is available. It is not a contractual term and does not require acceptance. Amendments have no retroactive effect.
2. Data controller
Roadlink FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates; company registration number: 55893; telephone: +971 58 563 8296. Data protection contact: [email protected].
The controller is established in the United Arab Emirates. Because the service is offered to customers in the European Union and the United Kingdom, the processing of their data is subject to the GDPR (Article 3(2)) and to the UK GDPR.
3. Processors and recipients
| Partner | Activity | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payment processing, fraud prevention | USA / Ireland | EU–US Data Privacy Framework |
| Cloudflare, Inc. | CDN and web security | USA | EU–US Data Privacy Framework |
| Tárhely.Eu Szolgáltató Kft. | Hosting, server operation | Hungary | Contract under Article 28 GDPR |
| Driver and Vehicle Standards Agency (DVSA, MOT history service) | Looking up the make, model and colour from a UK number plate | United Kingdom | European Commission adequacy decision (United Kingdom) |
| Google LLC (Google Ads) | Server-side conversion measurement based on the click identifier (gclid, or gbraid / wbraid on Apple devices) | USA / Ireland | EU–US Data Privacy Framework |
| Operator of the Dart Charge system (National Highways and its appointed contractor) | Receiving payment of the crossing charge | United Kingdom | Independent controller under UK legislation |
The operator of the Dart Charge system is an independent controller of the data transferred to it. There is no joint controllership.
4. Data processed, purposes, legal bases and retention periods
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Email address | Confirmations, communication | Art. 6(1)(b) performance of contract | 5 years |
| Number plate, country of registration, vehicle category, make, model, colour, rental vehicle flag | Carrying out the Dart Charge registration | Art. 6(1)(b) | 5 years |
| Number and time of crossings, total amount, currency | Performing and accounting for the order | Art. 6(1)(b) | 5 years |
| Billing details (name, address, tax number) – only if an invoice is requested | Issuing an invoice | Art. 6(1)(c) legal obligation | 5 years (statutory record-keeping obligation) |
| Payment data (transaction ID, card reference) | Payment processing | Art. 6(1)(b) | 5 years |
| Ticked checkboxes and their timestamps | Proof of contract conclusion | Art. 6(1)(f) legitimate interest | 5 years |
| UK number plate and vehicle data retrieved (number plate lookup log) | Troubleshooting | Art. 6(1)(f) | 30 days |
| Vehicle details found for a UK number plate (make, model, colour, category), stored with a keyed fingerprint of the number plate – not the plate itself | Filling in the same vehicle again without a new lookup | Art. 6(1)(f) | 90 days |
| Keyed fingerprint of the IP address | Abuse prevention (lookup limits) | Art. 6(1)(f) | 24 hours |
| Anonymous session ID, steps visited, device type, source, country estimated from IP; how the order form was used (which fields were clicked, filled in or emptied, which error messages appeared, time spent on each step, outcome and response time of the number plate lookup) – without the values entered | Measuring how the website works | Art. 6(1)(f) | 2 years |
| Google Ads click identifier (gclid, or gbraid / wbraid on Apple devices); for conversion measurement also the time of the “Pay now” click and the amount of our service fee | Conversion measurement | Art. 6(1)(f) | 2 years in our visit measurement; the conversion record sent to Google: 90 days |
| Email address and number plate given for “Notify me by email when the service is available” | Sending one email when the service becomes available | Art. 6(1)(a) consent, withdrawable at any time with the link in the email | Until withdrawn, at most 2 years |
| Customer service correspondence | Complaint handling | Art. 6(1)(b) and (f) | 3 years |
A legitimate interest assessment has been carried out for the processing based on legitimate interest; a summary is available on request.
Providing the data is a condition of concluding the contract; without it the order cannot be performed.
5. Measuring visits
The website uses its own server-side measurement. No cookie or other storage is created on the visitor's device for this purpose. The measurement does not store IP addresses, only the country code derived from the IP address.
To find and fix problems in the order form, we also record how the form is used: which field was clicked, filled in or emptied, which error message appeared, whether “Continue” moved on, how long a step took, the outcome and response time of the number plate lookup, and the last active field when the page was left. The values entered (for example the number plate or the email address) are not recorded; for the country of registration only the country code is stored. This data is deleted after 2 years.
If the visitor arrived from a Google ad, the operator sends the click identifier to Google Ads only server-side, together with the time of the “Pay now” click (or, once payment is available, of the successful order) and the amount of our service fee. No email address, number plate or other personal data is sent. Google does not place any cookie on the visitor's device for this.
6. UK number plate lookup
If the customer enters a UK number plate, the operator may forward it to the UK Driver and Vehicle Standards Agency (DVSA) MOT history service in order to fill in the vehicle's make, model and colour automatically. The customer can change the automatically filled data.
So that the same vehicle does not have to be looked up again, the vehicle details found are kept for 90 days together with a keyed fingerprint of the number plate (the number plate itself is not stored for this purpose); during this time they are filled in from our own records.
7. Automated decision-making
Order processing is largely automated, but no solely automated decision-making or profiling with legal effects within the meaning of Article 22 GDPR takes place. Stripe uses its own fraud prevention system (Stripe Radar).
8. Transfers to third countries
The controller is established in the United Arab Emirates; the website itself is hosted in the European Union (Hungary). Transfers to the United States (Stripe, Cloudflare, Google) take place under the EU–US Data Privacy Framework, and transfers to the United Kingdom (DVSA, Dart Charge) under the European Commission's adequacy decision. Where data is transferred to the controller in the United Arab Emirates, this takes place with the safeguards required by Chapter V of the GDPR.
9. Your rights
Access (Article 15 GDPR)
Rectification (Article 16)
Erasure (Article 17), except for data subject to a statutory retention obligation
Restriction of processing (Article 18)
Data portability (Article 20)
Objection to processing based on legitimate interest (Article 21)
Requests can be sent to [email protected] and are fulfilled within one month at the latest. Where justified, this period may be extended by two months, and we will inform you of this.
10. Remedies
You may lodge a complaint with the data protection supervisory authority of your habitual residence, place of work or place of the alleged infringement; in the United Kingdom this is the Information Commissioner's Office (ICO, ico.org.uk). You may also go to court (Article 79 GDPR) and claim compensation for damage (Article 82).
11. Data security
Data is transmitted over an encrypted (SSL/TLS) connection. Only authorised staff have access to the system, access is logged, and the data is backed up regularly. In the event of a personal data breach we act in accordance with Articles 33–34 GDPR.
12. Data protection officer
Under Article 37 GDPR, Roadlink FZCO is not required to designate a data protection officer.
Effective from: 25 October 2026