Privacy Policy
How UK Traffic Updates handles your personal data — what we collect, why, who we share it with, and your rights under UK GDPR.
1. Who we are
UK Traffic Updates is a UK-based traffic data and incident reporting service operated by Vera Sambo, trading as UK Traffic Updates ("we", "us", "our"). We provide road safety information, paid incident reports, breakdown listings, and related driver tools at uktrafficupdates.uk.
For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for personal data collected through this website.
2. What data we collect
2.1 Information you give us
- Payment information — when you buy a paid report, listing, or API access. Card details are never stored on our servers; payment is processed by Stripe (see section 5).
- Contact details — name, email, phone number when you complete a contact form, request a callback, submit a solicitor lead, send a media enquiry, or email us directly.
- Solicitor lead form data — including details of any traffic incident, injuries, vehicle damage, and the contact information you provide. This may include special category data (health information). See section 11.
- Evidence submissions — links to dashcam footage, photos, or videos you choose to share, plus any incident reference number you quote.
- Driver reports — the road, the location you describe, GPS coordinates if you allow them, what you saw, and any photo you add. A display name and social handle are optional. We do not ask reporters for an email address, a phone number, or an account — see section 12.
- Account details — if and when account creation is offered, your login email and a hashed password.
- Business listings — for breakdown providers and advertisers: business name, contact info, postcode, opening hours, and any logos or descriptions you submit.
2.2 Information we collect automatically
- Server logs — IP address, user agent (browser), pages visited, timestamps. Used for security, abuse prevention, and basic site analytics.
- Cookies — see section 6.
- Approximate location — derived from IP address, used to show relevant nearby incidents. We do not use precise GPS unless you explicitly grant browser location permission for a specific feature.
2.3 Information from public sources
- National Highways & Transport for London (TfL) traffic incident feeds — public data published under the Open Government Licence v3.0. This contains no personal data about end users.
- DfT STATS19 — historical UK police collision data published as open government data. Contains no individually identifying information about parties involved.
- Open-Meteo — historical weather data tied to GPS coordinates of incidents.
- DVSA / DVLA — vehicle MOT and tax status, queried when you use our MOT & Tax Checker tool. Queries are made to government APIs using the registration plate you enter; we do not store registration lookups beyond your active session.
3. Why we collect it
We use your personal data to:
- Process payments and deliver the paid reports, listings, or API access you've purchased.
- Send you the report you've ordered (by email and via download link).
- Pass solicitor lead enquiries to vetted partner law firms (with your consent — see section 11).
- Respond to enquiries, support requests, and refund requests.
- Detect and prevent abuse, fraud, payment chargebacks, and platform misuse.
- Improve the website using aggregated, non-identifying analytics.
- Comply with our legal obligations (tax, accounting, regulator requests).
4. Lawful basis for processing
Under UK GDPR Article 6, we process personal data on the following lawful bases:
| Activity | Lawful basis |
|---|---|
| Processing payments & delivering paid reports | Contract (Art. 6(1)(b)) |
| Responding to enquiries you've sent us | Legitimate interest (Art. 6(1)(f)) |
| Server logs & security monitoring | Legitimate interest (Art. 6(1)(f)) |
| Analytics & non-essential cookies | Consent (Art. 6(1)(a)) |
| Solicitor lead processing (incl. health data) | Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) |
| HMRC tax records, fraud prevention | Legal obligation (Art. 6(1)(c)) |
5. Who we share data with
5.1 Payment processing
Stripe Payments Europe Ltd (Ireland) processes all card payments. Card details are entered directly into Stripe's secure checkout and never reach our servers. Stripe's privacy policy: stripe.com/privacy.
5.2 Solicitor partners
If you submit the solicitor lead form, your enquiry (including the personal injury and incident details you provide) is forwarded to our partner law firm for assessment. We act as an introducer only — we are not a law firm and do not provide legal advice. The solicitor firm becomes the data controller for your enquiry from that point. You may withdraw consent at any time before the solicitor contacts you by emailing us.
5.3 Hosting and infrastructure
- NameHero — our hosting provider (USA). All data is encrypted in transit (HTTPS) and at rest.
- Cloudflare (if used) — for DDoS protection and content delivery.
5.4 Analytics
- Google Analytics (Google LLC) — anonymised website usage data. IP anonymisation enabled. Loads only after cookie consent.
- Microsoft Bing (Microsoft Corporation) — search engine indexing data. Loads only after cookie consent.
5.5 Other recipients
- HMRC — for tax compliance and statutory record-keeping.
- Law enforcement / regulators — only where legally required (e.g. court order, ICO request).
- Professional advisors — accountants and legal advisors under confidentiality.
We do not sell your personal data to third parties. We do not share your data for advertising profiling.
6. Cookies & tracking
Cookies are small files stored in your browser. We use these categories:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Session management (login, cart) | Essential | Session |
| cookie_consent | Records your cookie preferences | Essential | 12 months |
| _ga, _ga_* | Google Analytics — anonymised usage tracking | Analytics (consent required) | 2 years |
| _uetsid, _uetvid | Microsoft Bing analytics | Analytics (consent required) | 30 days / 13 months |
Essential cookies are always enabled. Non-essential (analytics) cookies only fire after you give consent via our cookie banner. You can withdraw consent at any time by clearing your browser cookies for this domain or using your browser's "Do Not Track" settings.
7. International data transfers
Some of our service providers operate outside the UK and EEA:
- Stripe — UK / EU operations, with US backup processing under Standard Contractual Clauses (SCCs).
- Google (Analytics) — global infrastructure with SCCs in place. Data is anonymised before transfer.
- Microsoft (Bing) — global infrastructure with SCCs in place.
- NameHero — US-based hosting; we use SCCs for any personal data stored.
All international transfers rely on UK-approved transfer mechanisms (UK IDTA, SCCs, or adequacy decisions).
8. How long we keep data
| Data type | Retention period |
|---|---|
| Payment & invoice records | 7 years (HMRC requirement) |
| Generated incident reports (paid) | 7 years from purchase, or until you request deletion |
| Solicitor lead enquiries | 2 years from submission, then deleted unless an active claim exists |
| Contact form submissions | 2 years |
| Server access logs | 90 days |
| Cookie consent records | 12 months |
| Account data (when accounts launch) | Until account deletion + 30-day grace period |
| Driver reports | Kept as a record of what happened on that road |
| Report photos | 21 days after the report clears |
| Reporter profiles (name, handle, standing) | Deleted after 24 months with no report |
| Blocked reporters | Kept — a block that expires is not a block |
9. How we protect data
- HTTPS encryption (TLS 1.2+) on all pages.
- Card data never touches our servers — handled exclusively by Stripe (PCI-DSS Level 1 certified).
- Database access restricted to server-level authentication.
- Passwords (when accounts launch) hashed using bcrypt or equivalent.
- Regular backups, kept encrypted.
- Admin panel restricted to authenticated staff users.
No system is 100% secure. If a personal data breach occurs that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.
10. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access (Art. 15) — request a copy of the data we hold about you.
- Right to rectification (Art. 16) — correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
- Right to restrict processing (Art. 18) — pause processing while a dispute is resolved.
- Right to data portability (Art. 20) — receive your data in a portable format (e.g. CSV or JSON).
- Right to object (Art. 21) — object to processing based on legitimate interest.
- Right to withdraw consent — at any time, for any consent-based processing (e.g. analytics, solicitor leads).
- Right not to be subject to automated decisions (Art. 22) — we do not use solely automated decision-making.
To exercise any of these rights, contact us using the details in section 15. We will respond within one calendar month. There is no charge for reasonable requests.
11. Solicitor lead data — special note
By submitting the solicitor lead form, you give your explicit consent for us to:
- Process the personal and incident data you provide.
- Forward the enquiry to our vetted partner law firm for case assessment.
- Allow that law firm to contact you using the details you provided.
You can withdraw consent any time before the solicitor contacts you by emailing us. After the solicitor begins acting on your behalf, the law firm becomes the data controller for your matter and their own privacy policy will apply.
UK Traffic Updates is not a law firm. We act solely as an introducer. We do not provide legal advice and we do not receive any data back from the solicitor about the outcome of your case.
12. Driver reports
Anyone can report an incident at /traffic/reports/. This section covers what happens to that report. There is a fuller version at what happens to your report.
12.1 What we collect
- Where it is — the road, the location you describe, and GPS coordinates from your phone if you allow it. The coordinates place the pin on the map and are used for nothing else.
- What happened — type, direction, severity, and whatever you tap or type.
- A photo, if you add one.
- A display name, if you give one. Left blank, the report says Anonymous.
- A social handle, only if you want to be credited.
12.2 What is public
A published report shows the road, the location, the type, the time, your description and your display name — that is the point of it. Your GPS coordinates place a pin; they are not shown as numbers and are attached to the incident, not to you. Two reports from the same person carry no visible link between them.
12.3 What is kept behind the scenes
- A hashed IP address — not the address itself, a one-way hash we cannot reverse. It exists so somebody deliberately posting nonsense can be blocked, and for nothing else. Staff only.
- A random id in your browser — remembers your name between reports and tracks your standing on the leaderboard. Not linked to your identity; clearing your browser data clears it.
12.4 What you allow us to do with it
You keep ownership of your report. You grant us a worldwide, royalty-free, perpetual licence to use, publish, adapt and share it — including with traffic services, navigation providers and the emergency services — so it can reach other drivers.
A report is only worth filing if it can travel. If a lorry driver two junctions back sees it through a satnav rather than our website, the report did its job. The licence covers the report — the road, the incident, what you saw. It gives nobody the right to identify you.
12.5 Comments on reports
Anything posted in the chat under a report is public, and the same hashed IP is stored for the same reason. Some messages are folded behind a "may be upsetting" warning rather than published straight out — a description of an injury at the scene, for instance — and are readable in one tap. Nothing is hidden because we disagree with it, and a removed message is removed by a person and can be put back. We may edit a message to take out something that cannot stay, such as a phone number; when that happens the message says so and says why.
12.6 Having a report removed
Email privacy@uktrafficupdates.uk with the road and roughly when, and we will find it. We remove your name, your handle and your description. The road, the time and the fact that something happened there remain, because other drivers relied on that at the time and it forms part of the record of that road — but nothing in it will point to you.
13. Children
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has submitted personal data through our website, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time to reflect new platform features, legal changes, or service-provider updates. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be highlighted in a banner on the homepage for at least 14 days.
We recommend reviewing this policy periodically. Continued use of the website after changes constitutes acceptance of the updated policy.
15. Contact & complaints
15.1 Contact us
For any privacy-related question, data request, or complaint:
- Email: privacy@uktrafficupdates.uk
- General contact: /contact/
- Postal address: To be confirmed — registration pending
15.2 Complain to the ICO
If you're unhappy with how we've handled your data, you have the right to complain to the UK's data protection regulator:
- Information Commissioner's Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Phone: 0303 123 1113
- Website: ico.org.uk
We'd appreciate the chance to address your concerns first, but you can complain to the ICO at any time.
UK Traffic Updates · uktrafficupdates.uk · Last updated 18 July 2026