Privacy statement

The RDW’s open data, and therefore KentekenFeed, contains no names or addresses of vehicle owners or keepers.

We do not record which registrations a customer looks up. Per request we keep only the time, the kind of request and the API key used, to count and bill usage. Answers are kept briefly in a cache per registration, without a link to any customer.

• Account details: your name, email address and a one-way encrypted version (hash) of your password.
• Company details: company name, address, country and VAT number, for invoices.
• Payment details: payments run through Stripe. We only see the kind of payment method and the last four digits, never the full card number.
• Usage data: per API request the time, the kind of request and the key, and per hour the number of requests per key. Of a key we keep only a hash, never the key itself.
• Security data: for actions in your account, such as signing in, creating a key or changing your subscription, the IP address and browser.
• Contact: when you use the contact form on the website, we process your name, your email address, your company name if you enter it, your message and, for a question about higher volumes, the estimate you send along. You don’t need an account for it, and we don’t link your message to an account. When you ask a question in the portal or by email, we process what you write to us.
• Misuse of the contact form: to keep the form from being misused, we count per IP address how many messages are sent in an hour and in a day. That count expires after a day at most; we don’t keep the IP address with your message.

• To perform the agreement: your account, your API keys, counting your usage, invoices and payments.
• Because the law requires it: we keep our accounts, including invoices, for 7 years (Dutch tax retention duty).
• For our legitimate interests: to secure the service, to prevent and investigate misuse, and to fix outages.
• To keep you informed: about your account, your subscription and important changes to the service or the terms.
• To answer your question: what you send us through the contact form, the portal or email. After a message through the contact form you only get a confirmation and our reply by email: it does not put you on a mailing list. We do this in our legitimate interest in answering questions, or because you ask us to take steps towards a contract.

We do not sell data, send newsletters without your consent or build profiles of you.

We only share data with parties we need to provide the service:

• Stripe processes payments and subscriptions. Stripe may process data outside the European Economic Area; appropriate safeguards apply, such as the European Commission’s standard contractual clauses.
• Hosting and email services that run the servers and send the portal’s emails and our replies to your messages, under a data processing agreement.

Otherwise we only share data when the law requires us to.

• Account and company details: as long as your account exists. After that we delete them, except what we must keep for our accounts.
• Invoices and the usage they are based on: 7 years, because of the tax retention duty.
• The number of requests per hour: 90 days.
• Security data: as long as your account exists, and at most 12 months after that.
• Messages through the contact form on the website: until 12 months after your question has been dealt with. After that we delete the message, with your name and email address.
• Questions you ask in the portal: as long as your account exists.

We protect data with appropriate technical and organisational measures. Connections are encrypted, passwords and API keys are only stored as hashes, and our staff sign in with two-factor authentication.

You have the right to access your data, have it corrected or deleted, restrict its processing, object, and receive your data in a common format.

Much of that you can do yourself in the portal, under Settings: change your details, download all your data as a JSON file and close your account. When an account is closed, we delete its users and company details and keep only invoices and the usage they are based on, for the tax retention duty. For anything else, including having a message you sent through the contact form deleted sooner, contact us at the contact form. We reply within a month.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

The website sets no cookies. The portal only uses cookies needed to sign in. See our cookie statement.

We update this statement when our processing changes. The date at the top shows when that last happened. We tell you about important changes by email.