Privacy

This is the most important paragraph on the page. We ask you no questions about your health, your diagnosis, your disability, your treatment, or your reasons for wanting a pet. We hold no such data about anyone, so there is none to lose, leak or hand over.

That is a deliberate design decision, not an oversight. A registration is a keepsake and needs no medical basis, and nothing else we sell has any reason to ask either, so none of it asks.

It follows that we hold no special category data under Article 9 of the UK GDPR, and no consumer health data of any kind.

• To make a registration: your name, email address, optionally your town or city, and your pet’s name, type, breed, date of birth and photo.
• To make a Pet Emergency Pack, if you buy one: your email address, one photo of your pet, and what you type for the poster, the card and the sitter sheet: your pet’s name and description, where they were last seen, the phone number or email address you want printed, your vet, the microchip number, an emergency contact’s name and number, and notes about your pet’s care. The photo is kept in the same private storage as a registration photo and is used only to draw your pack. We never ask about your own health; the care notes are about your pet.
• To register another pet after your first: only your new pet’s details and photo. Your name, email address and town are copied from the entry you already have.
• To take payment: an order record. Creem takes the payment and shows us the name and email address it was made with. We never receive your card number.
• To know which adverts and links bring the people who buy: when you give your email address on the first screen of a registration, we also note the website that sent you to us, if there was one (for example google.com), the first page of ours you opened and when, and whether you came from a Google advert, as a yes or no. If you buy, those four go onto your register entry and are deleted with your name and email address; if you do not, they are deleted with your unfinished registration. Nothing else about your visit is kept with them: not your IP address and not where you are. If you have said yes to cookies, we also keep the click code Google adds to the link of one of its adverts, so that a purchase can be reported to Google Ads as coming from that advert. If you said no, or did not answer, it is never kept. It is deleted with the other four.
• To keep the site working: ordinary server logs, which include IP addresses and are kept briefly. We also count requests to the forms on this site so that nobody can flood them. That counter never holds your address: it holds a one-way hash of it, which tells one visitor apart from another and cannot be turned back into an address by us or by anyone else. It is deleted within a day.

If you start a registration and stop. From the moment you enter your email address on the first screen we keep what you have typed so far, with that address, for up to 30 days, so you can come back to it on any device from a link we send you. If you stop before paying we send up to two reminder emails, about an hour and about a day after you stop, and then nothing more. Every reminder has a link that stops them, and the first screen has a box to decline them before any is sent. Once you have paid, or after those 30 days, what you typed is deleted.

Because we need it to perform the contract you entered into when you bought (UK GDPR Article 6(1)(b)), and for our legitimate interests in keeping the service running securely and meeting our accounting obligations (Article 6(1)(c) and (f)). The note of how you found us rests on our legitimate interest in knowing which adverts and links lead to a purchase (Article 6(1)(f)).

Anyone with a registration number can look it up. They will see the pet’s name, type and breed, the photo, your town if you gave one, the issue date and whether the registration is active. Your name, your email address and your address are never returned by the lookup, and the page is not indexed by search engines.

• Creem takes payments. For the payment itself Creem is a controller in its own right, and its own privacy statement applies to that step.
• Supabase stores the database and files, in the UK/EU region.
• Vercel hosts the website and counts its page views for us without cookies (Vercel Web Analytics).
• Google provides analytics and advertising measurement, and only for visitors who agreed to it. Nothing reaches Google from anyone who did not.
• Resend sends your documents by email.

Each acts under contract and only on our instructions. Where a provider processes data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards.

We also administer the service ourselves from outside the UK. Your data stays in the UK/EU region where it is stored; we reach it remotely, from a country the UK recognises as providing an adequate level of data protection.

We do not sell personal data and we do not share it with data brokers. If we ever run advertising that involves sending hashed identifiers to an ad platform, we will say so here plainly first, and we will say the true thing about it, which is that hashing is not anonymity.

If you said yes to cookies and bought after clicking a Google advert, we send Google Ads that advert’s click code, the time of the purchase and what it was worth, so that Google can count the sale. Nothing else is sent with it: not your name and not your email address.

Not one rule but seven, because the things we hold are not alike and pretending they are would be the easy answer rather than the true one. Every one of them ends. Nothing here is kept because nobody got round to deleting it.

• Your register entry and its two PDFs stay until you ask us to delete them, or until six months after the entry stops being current, whichever comes first. An entry is current for 18 months, and we do not erase it the day that passes: the number printed on your certificate has to keep pointing at something, and a lookup that says “expired” is far more use to whoever is holding the card than one that says nothing at all. Six months later your name, your email address, your town, your pet’s photograph and both PDFs are deleted, and the entry goes on answering with the number, the animal and the dates alone.
• The order record covers what was bought, when, for how much, the payment reference, and the box you ticked at checkout. Kept for six years: tax law requires it, and a refund has to be able to find the sale it belongs to. No card details; Creem holds those.
• Your Pet Emergency Pack is erased a year after we send it: the photo, the PDF, your email address and everything you typed for it. The copy you downloaded is yours and is not affected.
• Checkouts that were never paid for are deleted after 30 days, pet photo included. That covers a Pet Emergency Pack that was never paid for, and its photo.
• A gift carries two people’s names, two email addresses and a message one of them wrote to the other, and the person receiving it never bought anything from us. All of it is erased a year after the code is redeemed, or two years after it is bought if it never is. The code and its status stay, so we can still tell somebody holding one what happened to it.

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable format. Email hello@ukesaregister.co.uk and we will respond within one month, free of charge.

Deleting a registration means its verification page stops working, which is usually not what people want, so tell us if you would rather it stayed live.

We are on the Information Commissioner’s Office register of fee payers as number ZC247163, registered on 13 September 2026. That entry is public, so you can read it without asking us.

If you want to complain about how we have handled your data, email hello@ukesaregister.co.uk with “complaint” in the subject line. We will acknowledge it within 30 days and tell you the outcome, and what we did about it, without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk at any time, though we would rather you gave us the chance to put it right first.

Our service is for adults. We do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

Nothing that identifies you is stored on your device unless you agree to it first. There is no pre-ticked box, saying no is one click in the same row as saying yes, and if you say nothing at all that counts as no.

If you do agree, we load the Google Ads tag, which set cookies and tell Google which pages you visited, which advert brought you here if one did, and that a purchase happened along with what it was worth. We do this to know which adverts pay for themselves. Google is a controller in its own right for what it receives.

The cookies are set on this site’s own address: cookies beginning _gcl_, from the Google Ads tag, which last 90 days. Your browser may delete them sooner.

We rely on your consent for this, as the rules on cookies require before anything is stored (regulation 6 of the Privacy and Electronic Communications Regulations), and as the basis for what is then collected (UK GDPR Article 6(1)(a)). Google may process it in the United States. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, the “UK-US data bridge”, which the UK recognises as giving adequate protection.

You can change your answer at any time with Cookie settings, at the foot of every page. Saying no after saying yes stops the measuring from that moment and deletes the cookies above from your browser. It cannot recall what Google has already received.

If you decline, no tag is loaded, no request is made to Google, and nothing about your visit is stored. Every page works exactly the same.

Whether or not you agree to that, we count how the site is used: which pages are opened, and how far through the forms people get, step by step. This uses no cookie and stores nothing on your device, which is why it does not ask. The count is kept by Vercel Web Analytics and in our own database, and neither holds your name, your email address, anything you typed, or your IP address: a visitor is told apart from another for one day by a code made from the connection together with a secret we hold, which cannot be turned back into an address. We rely on our legitimate interest in knowing whether the site works (UK GDPR Article 6(1)(f)), and we delete our own copy after 90 days.

Separately from that, the site remembers what you have typed into a form so that a refresh does not lose it, in your browser’s session storage, which is cleared when you close the tab. It also remembers your answer to the question above, under ukesa.consent.v1, until you change it. If you agreed to be measured, it keeps the references of the last few orders it reported to Google, under ukesa.purchases.v1, so reloading a confirmation page does not count a sale twice; saying no deletes it. All of this stays in your own browser and is never sent to us. The form and your answer are what the rules call strictly necessary.