UK ESA Register

Privacy

UK ESA Register is the data controller for everything described here. The short version: we collect what we need to make your documents, and nothing else.

What we don’t collect: health information

This is the most important paragraph on the page. We ask you no questions about your health, your diagnosis, your disability, your treatment, or your reasons for wanting a pet. We hold no such data about anyone, so there is none to lose, leak or hand over.

That is a deliberate design decision, not an oversight. A registration is a keepsake and needs no medical basis, and the right our Landlord Pet Request Kit uses belongs to every tenant in England regardless of health. Neither product has any reason to ask, so neither asks.

It follows that we hold no special category data under Article 9 of the UK GDPR, and no consumer health data of any kind.

What we do collect

  • To make a registration: your name, email address, optionally your town or city, and your pet’s name, type, breed, date of birth and photo.
  • To write a pet request letter: the tenancy details you enter — the property address and postcode, your landlord or agent’s name and address, and what you tell us about your pet, its care, your renting history and any references.
  • To post a framed certificate, if you order one: the delivery name and address you give us. It goes to our UK print partner with the artwork, and nowhere else.
  • To take payment: an order record. Paddle takes the payment and we never receive your card number.
  • To keep the site working: ordinary server logs, which include IP addresses and are kept briefly.

Why we are allowed to hold it

Because we need it to perform the contract you entered into when you bought (UK GDPR Article 6(1)(b)), and for our legitimate interests in keeping the service running securely and meeting our accounting obligations (Article 6(1)(c) and (f)).

The verification page never exposes you

Anyone with a registration number can look it up. They will see the pet’s name, type and breed, the photo, your town if you gave one, the issue date and whether the registration is active. Your name, your email address and your address are never returned by the lookup, and the page is not indexed by search engines.

Who processes data on our behalf

  • Paddle — payments. Paddle is the merchant of record, so for the payment itself it is a controller in its own right and its privacy notice applies to that step.
  • Supabase — database and file storage, hosted in the UK/EU region.
  • Vercel — website hosting.
  • A UK print partner — printing, framing and posting certificates, for customers who order one. They receive the artwork and the delivery name and address, nothing else.
  • Resend — sending your documents by email.
  • Anthropic — writing two descriptive paragraphs of your pet request letter. Only the details of your pet and its care are sent; your name, email address, postcode and your landlord’s details are not.

Each acts under contract and only on our instructions. Where a provider processes data outside the UK, that transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards.

We also administer the service ourselves from outside the UK. Your data stays in the UK/EU region where it is stored; we reach it remotely, from Israel, which the UK recognises as providing an adequate level of data protection.

We do not sell your data

We do not sell personal data and we do not share it with data brokers. If we ever run advertising that involves sending hashed identifiers to an ad platform, we will say so here plainly first — and we will say the true thing about it, which is that hashing is not anonymity.

How long we keep it

Registrations last for the life of your pet and do not expire, so we keep the registration record and its documents until you ask us to delete them. Order records are kept for six years because tax law requires it. Abandoned checkouts that were never paid for are deleted after 30 days.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable format. Email hello@ukesaregister.co.uk and we will respond within one month, free of charge.

Deleting a registration means its verification page stops working, which is usually not what people want — tell us if you would rather it stayed live.

If you want to complain about how we have handled your data, email hello@ukesaregister.co.uk with “complaint” in the subject line. We will acknowledge it within 30 days and tell you the outcome, and what we did about it, without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk at any time, though we would rather you gave us the chance to put it right first.

Children

Our service is for adults. We do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

Cookies

We use only what the site needs to work, which is why there is no cookie banner in your way. If we ever add analytics or advertising cookies, you will be asked first and the default will be off.

Version 2026-09-02. We record which version applied to your order, and we email you before anything material changes. Changes are never retrospective.