Your data and your rights
What is stored when you check in, who holds it, how long it is kept, and how to ask about it.
When you check in for a hire, you share some personal information. This page explains plainly what is stored, who holds it, how long it is kept, and how to ask about it. The full detail is in the privacy notice.
Who holds your information
Two organisations are involved, with different roles:
- The hire firm you are dealing with is the controller of your booking data. They decide why your information is collected and they hold the record of your hire. They are your first point of contact for anything about your data.
- KeyProof Ltd is the processor. KeyProof runs the check-in and stores the record on the firm's behalf and on the firm's instructions. KeyProof does not decide to use your booking data for its own purposes.
What is collected
Depending on the checks the firm uses, your check-in can include:
- Your name, date of birth, home address, mobile number, and optional email.
- Your driving-licence details, via the DVLA check code you provide.
- An e-signed copy of the firm's rental agreement.
- The condition photos of the vehicle.
Your ID and selfie go through Stripe Identity
Your photo ID and live selfie are handled by Stripe Identity, a regulated verification provider. This matters: KeyProof does not receive or store your raw ID images or your selfie. KeyProof keeps only the Stripe Identity session reference and the pass or fail result. The firm sees the result, not your documents.
A facial image is sensitive, biometric data, so the identity check runs under your explicit consent, given at the moment you verify. Your DVLA check code is checked against the DVLA's own service.
How long it is kept
Retention runs on scheduled code, not on a promise to remember:
- Your DVLA check code is erased from KeyProof's systems 30 days after signing (the code itself expires at the DVLA sooner).
- The booking record, including the condition photos and your signature, is deleted in full 24 months after the hire closes. It is kept that long because it is evidence the firm may need, for example if a dispute or a fine arises after the hire.
Your rights
You have the usual rights over your personal data: to see what is held, to have mistakes corrected, and to ask for it to be deleted, among others.
Because the hire firm is the controller of your booking record, start with them: contact the firm you hired from. KeyProof, as the processor, supports the firm in responding to your request. For anything KeyProof holds as controller in its own right, or if you are not sure who to ask, the privacy notice explains how to get in touch.
In short
Your ID images never sit with KeyProof, your licence code is gone within a month, and your booking record is deleted two years after the hire ends. The firm you hired from is the one who decides how your data is used, and the one to ask first.