Privacy information

Information used for a check

For a check, you enter a number plate, city and travel date. We use these details to retrieve vehicle characteristics and calculate an indication of the local rules. A number plate may identify a person when combined with other information.

Your number plate is sent to our server to retrieve the vehicle details needed for the check. The site uses the selected city and travel date to assess local rules; those choices are not sent to the vehicle-data service. The plate is not shown in the website address. Vehicle details may include the make, vehicle category and type, fuel, emission class, first registration date, bodywork and, where relevant, taxi, export or weight information. We do not request the registered keeper’s name or address.

Services that host the website or provide map tiles may also receive information about your connection, such as your IP address, browser type and request time. This helps provide the website and map and protect them from misuse.

Who receives information

• Cloudflare: hosts the website and Worker and receives website traffic and connection metadata, including IP address. The controller confirms this account is used on behalf of Oesta Gevelwerken VOF. Cloudflare’s DPA applies where it processes personal data as a processor and forms part of the applicable self-service agreement; no separate DPA signature is assumed. Cloudflare describes metadata processing in the US and Europe and references SCCs and the EU-U.S. Data Privacy Framework for relevant transfers. The production Worker configuration explicitly disables Workers observability; the controller confirms Workers observability and Logpush are not used and request bodies/number plates are not logged. Cloudflare documents Workers Logs retention of 3 days on Free and 7 days on Paid when logging is active. Those periods do not establish retention for all Cloudflare network/security processing. Specific edge/security/NEL settings and retention, and retention by other providers, remain unconfirmed. Cloudflare DPA, sub-processor list, Workers Logs and retention, and Cloudflare information about GDPR and transfers
• RDW public vehicle-data service (opendata.rdw.nl): our server sends the normalized number plate in a JSON POST to retrieve the required public vehicle fields. The application does not include the browser IP address; the service sees the Worker connection. Naming this recipient is for privacy transparency only; it is not source credit, a recommendation, partnership, endorsement, or a statement that EmissieCheck is an official service.
• OpenStreetMap Foundation (OSMF) and Fastly: the browser requests map tiles directly; IP address, browser information, referring website and requested map area may be visible. No number plate is sent. OSMF describes itself as an independent controller and does not provide a processor agreement for this use. Tiles are delivered through Fastly; the cache location depends on routing and may vary. OSMF names servers in the UK, Ireland and the Netherlands, but does not guarantee a location for each tile request. Its privacy policy describes general usage records and states 180 days for detailed Piwik usage information; this is not an established retention period for tile requests. No separate tile/CDN period is published. OSMF Privacy Policy, OSMF tile-request information, and tile usage policy.
• NDW: our server retrieves public zone boundaries. The request contains no number plate, city or travel date; only zone data are reused in Cloudflare’s edge cache for up to 15 minutes. NDW/Cloudflare request logs and retention for this API have not been established. The government catalogue marks the dataset and GeoJSON service CC0 1.0. Government catalogue for emission zones.

Storage and retention

The application does not write number plates to its own database or explicit application log. A plate query is processed temporarily in Worker memory; API responses use the Cache-Control: no-store header. Only public NDW zone data are reused in Cloudflare’s edge cache for up to 900 seconds. The result remains visible in your browser until you change the input or leave the page; your browser may retain or restore content according to its own settings. The website sets no automatic deletion period.

We configure Workers Logs off for the production Worker. The controller confirms Workers observability and Logpush are not used and request bodies/number plates are not logged. Cloudflare documents Workers Logs retention of 3 days on Free and 7 days on Paid when enabled; these are provider retention periods, not terms for all Cloudflare processing. Specific settings or retention for edge/security/NEL processing and number-plate, NDW or map-tile requests by other providers remain unconfirmed; no term is inferred for them.

The application loads no analytics or advertising trackers. This does not change the network processing performed by hosting, map and data services.

Responsibility and legal basis

Controller and operator: Oesta Gevelwerken VOF; EmissieCheck.nl is the service name. Privacy contact: info@meestr.net. For the requested number-plate check, Oesta relies on its legitimate interests (Article 6(1)(f) GDPR) in providing the specific vehicle indication the user requested. The plate is necessary for that specific check; the user initiates it and can reasonably expect temporary use. The plate is not stored, profiled or used for another purpose. For website security and abuse prevention, Oesta separately relies on legitimate interests (Article 6(1)(f) GDPR), limited to necessary technical connection data; request bodies/plates are not logged and advertising tracking is not used. Oesta does not rely on Article 6(1)(b) because a clear contractual relationship with the user has not been established. No separate personal-data legal basis is asserted here for map display or public zone-data provision; map providers may receive connection data under their own roles and terms. Other recipients’ roles, retention and safeguards for international transfers outside the European Economic Area (EEA) remain subject to separate assessment. This notice is not legal advice.

Your rights and contact

Where applicable, you may request access, correction, erasure or restriction, object to processing and request data portability. You may also lodge a complaint with the Dutch Data Protection Authority. Privacy rights and complaints to the Dutch DPA.

For privacy questions and requests, use the contact address on the Company details page. Include only what is necessary; do not email identity documents, bank details or other sensitive documents.

The check provides an informational result. It does not make an official decision about you or grant access, a permit or an exemption. Contact the competent authority about such decisions.

Information last checked: 15 October 2026. This notice is not legal advice and does not replace guidance from the Dutch Data Protection Authority or a qualified privacy professional.