Privacy statement

The RDW’s open data, and therefore KentekenFeed, contains no names or addresses of vehicle owners or keepers.

We do not record which registrations a customer looks up. Per request we keep only the time, the kind of request and the API key used, to count and bill usage. Answers are kept briefly in a cache per registration, without a link to any customer.

• Account details: your name, email address and a one-way encrypted version (hash) of your password.
• Company details: company name, address, country and VAT number, for invoices.
• Payment details: payments run through Stripe. We only see the kind of payment method and the last four digits, never the full card number.
• Usage data: per API request the time, the kind of request and the key, and per hour the number of requests per key. Of a key we keep only a hash, never the key itself.
• Security data: for actions in your account, such as signing in, creating a key or changing your subscription, the IP address and browser.
• Contact: what you write to us when you email a question.

• To perform the agreement: your account, your API keys, counting your usage, invoices and payments.
• Because the law requires it: we keep our accounts, including invoices, for 7 years (Dutch tax retention duty).
• For our legitimate interests: to secure the service, to prevent and investigate misuse, and to fix outages.
• To keep you informed: about your account, your subscription and important changes to the service or the terms.

We do not sell data, send newsletters without your consent or build profiles of you.

We only share data with parties we need to provide the service:

• Stripe processes payments and subscriptions. Stripe may process data outside the European Economic Area; appropriate safeguards apply, such as the European Commission’s standard contractual clauses.
• Hosting and email services that run the servers and send the portal’s emails, under a data processing agreement.

Otherwise we only share data when the law requires us to.

• Account and company details: as long as your account exists. After that we delete them, except what we must keep for our accounts.
• Invoices and the usage they are based on: 7 years, because of the tax retention duty.
• The number of requests per hour: 90 days.
• Security data: as long as your account exists, and at most 12 months after that.

We protect data with appropriate technical and organisational measures. Connections are encrypted, passwords and API keys are only stored as hashes, and our staff sign in with two-factor authentication.

You have the right to access your data, have it corrected or deleted, restrict its processing, object, and receive your data in a common format.

Much of that you can do yourself in the portal, under Settings: change your details, download all your data as a JSON file and close your account. When an account is closed, we delete its users and company details and keep only invoices and the usage they are based on, for the tax retention duty. For anything else, email the email address at the bottom of this page. We reply within a month.

If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

The website sets no cookies. The portal only uses cookies needed to sign in. See our cookie statement.

We update this statement when our processing changes. The date at the top shows when that last happened. We tell you about important changes by email.