Data processing agreement
Effective from 6 November 2026 · version 2026-11
This data processing agreement is made between you as the customer (the controller) and Piklo Systems, CVR 32709192, Tjebberupvej 101, 4300 Holbæk, Denmark (the processor), which runs PlateRunner. The agreement is part of our terms and is entered into when you accept them at sign-up. No signature is needed.
1. Roles
In your context, a number plate can be personal data, for example when you look up a customer’s car. You are the controller for the lookups you make. We only process them as a processor on your behalf, in line with GDPR Art. 28.
2. What we process
- Purpose: looking up number plates and returning technical vehicle data, and sending email about your key and your usage.
- Data: the number plates you look up, and a one-way hash of them that is kept for 30 days for misuse detection. The plate itself is not stored.
- Data subjects: the people whose vehicles you look up.
- Duration: for as long as you use the service.
3. Instructions
We only process the data on your instructions. Your instruction is what you ask for when you call the API: look up a number plate and send back the answer. We do not use the data for any other purpose. If we believe an instruction breaks data protection law, we will tell you.
4. Confidentiality
Only people who need access to run the service have access to the data, and they are bound by confidentiality.
5. Security
- All traffic to the API is encrypted with TLS.
- API keys are only stored as hashes.
- The database contains no data about vehicle owners.
- Number plates are not written to the server’s log files.
6. Sub-processors
You give general authorisation for us to use sub-processors. For lookups and email, they are:
| Sub-processor | Purpose | Country |
|---|---|---|
| netcup | Server that processes lookups | Germany |
| Resend | Sending email (EU region) | EU |
The full list of our providers is in the privacy policy. We will notify you by email before we start using a new sub-processor for lookups, so you can object. We hold sub-processors to the same requirements this agreement places on us.
7. Assistance
We will help you, to a reasonable extent, with answering requests from data subjects and with meeting your obligations on security, impact assessments and breach notification. If we discover a security breach affecting your data, we will notify you without undue delay.
8. Deletion on termination
When the agreement ends, we delete the data we process on your behalf. Hashes of number plates are deleted no later than 30 days after the lookup.
9. Audits
On request, you can receive the information needed to show that we comply with this agreement. Write to kontakt@platerunner.dk.
10. Governing law
This agreement is governed by Danish law and the venue rules in our terms. The Danish text prevails.