Privacy and cookies policy

Last updated 19 October 2026

1. Controller

JAGAT IT UK LTD (registered in England and Wales, company number 17474995), trading as Deal Check, is the controller of personal data processed through dealcheck.projectlists.co.uk. Contact for any privacy matter: support@jagatitlimited.com.

This policy explains what we collect, why, our lawful bases under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and your rights.

2. Data we collect

• Vehicle details you enter: the advert link, and optionally the registration number and postcode. A registration number may be personal data when linked to a keeper; we use it only to produce your Report.
• Order details: your email address, the amount paid, Stripe session and payment references and the Report we generate.
• Payment data: processed by Stripe; we receive limited details (such as card brand, last four digits and billing country) but never your full card number.
• Technical data: IP address, browser and device type, pages visited and timestamps, used for security, rate limiting and, if you consent, analytics.
• Messages you send us.

3. Why we use it and our lawful bases

• To produce and deliver your Report, email your private link and receipt, and provide refunds: performance of a contract (Article 6(1)(b)).
• To retrieve vehicle and market data from our suppliers: performance of a contract.
• To keep accounting and tax records: legal obligation (Article 6(1)(c)).
• To prevent fraud and abuse, secure the site and handle complaints: legitimate interests (Article 6(1)(f)).
• Analytics cookies to understand site use: consent (Article 6(1)(a)), which you can withdraw at any time.

4. Who we share it with

• One Auto API Ltd and its data partners (including Marketcheck and Cazana), who receive the advert domain, registration and postcode needed to return vehicle and market data.
• Stripe Payments UK Ltd (payments and fraud checks), acting as an independent controller for payment data.
• Resend (transactional email delivery).
• Hostinger (our UK server host in Manchester) and Cloudflare (DNS and security).
• Google (Google Analytics), only if you accept analytics cookies.
• Professional advisers, and authorities where the law requires.

We do not sell your personal data or use it for third-party marketing.

5. International transfers

Some suppliers (for example Stripe, Resend, Cloudflare and Google) may process data outside the UK, including in the United States. Where they do, transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Reports and order records: 12 months from purchase so your link keeps working, then deleted or anonymised.
• Accounting records: 6 years from the end of the financial year, as UK law requires.
• Security logs: up to 30 days.
• Support emails: up to 2 years.

7. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. We do not make decisions with legal effects about you solely by automated means.

To exercise a right, email support@jagatitlimited.com. We reply within one month. If you are unhappy, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

8. Cookies

Strictly necessary: none are needed to browse or buy; Stripe sets its own cookies on its checkout pages for security and fraud prevention.

Analytics: if enabled, Google Analytics 4 sets _ga and _ga_* cookies (up to 2 years) to count visits and understand how pages are used. Under the Privacy and Electronic Communications Regulations 2003 these are only set if you click Accept on our cookie banner. You can change your choice at any time via “Cookie settings” in the footer. You can block or delete cookies in your browser settings at any time.

Full details: Cookie policy.

9. Security

We use HTTPS throughout, store data on access-controlled servers, keep secrets out of our code, and limit access to staff who need it. Report links are long random tokens; keep yours private.

10. Children

The service is not intended for anyone under 18 and we do not knowingly collect children's data.

11. Changes

We may update this policy. The date at the top shows the latest version.