Last updated: May 2026

This Privacy & Cookie Policy explains how Assistance Dog Registry UK ("ADR UK", "we", "our", "us") collects, uses, stores and protects your personal data when you use our website at assistancedogregistry.co.uk and related services.

We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy tells you what data we hold, why we hold it, how long we keep it, and what your rights are.

1. Who We Are (Data Controller)

Assistance Dog Registry UK
Trading as: ADR UK
Website: assistancedogregistry.co.uk
Contact: [email protected]

We are the data controller for personal data processed through this website. Where we engage third-party services to process data on our behalf (e.g. payment processors, hosting providers), those parties act as data processors under our instruction.

2. What Personal Data We Collect and Why

2a. Registration Data

When you register an assistance dog with ADR UK, we collect:

• Handler information: full name, email address, telephone number, home address, date of birth (age verification only)
• Dog information: dog name, breed, date of birth, service category (e.g. guide dog, hearing dog, psychiatric assistance dog)
• Photographs: handler photo, dog photo — used on your verification card
• Health & disability information (Special Category Data) — completely optional: you may choose to include a medical condition or disability (e.g. epilepsy, PTSD, visual impairment) to help first responders in an emergency. This field is entirely voluntary — we do not require it, and your registration is fully valid without it. If provided, it is stored securely and never shown publicly
• Emergency contact information: name and telephone number of a nominated contact
• Subscription & payment data: plan type, billing cycle. Card details are never stored by us — they are processed directly by Stripe (PCI-DSS compliant) under their own privacy policy

Lawful basis: Performance of a contract (Article 6(1)(b) UK GDPR) — you request a registration service and we must process this data to deliver it. For health/disability information (Special Category data), the lawful basis is explicit consent (Article 9(2)(a)) given at point of registration, and/or substantial public interest (Article 9(2)(g)) as processed under Schedule 1 Part 2 of the Data Protection Act 2018 in connection with the exercise of legal rights under the Equality Act 2010.

2b. Verification Card (Public Profile)

When a registered dog's QR code is scanned, a limited verification card is displayed publicly. This card shows only:

• Dog name, breed, service category
• Handler's first name only
• Handler and dog photographs
• Registration status (Registered / Expired / Suspended)
• Equality Act 2010 access rights information

Emergency contact details, medical information, home address and full handler name are not publicly visible. They are accessible only behind a confirmation barrier designed for genuine emergency use by first responders. These fields do not appear in search engine results — all dog profile pages carry a noindex, nofollow instruction to search engines.

Lawful basis: Legitimate interests (Article 6(1)(f)) — enabling third parties (businesses, venues, emergency services) to verify a handler's right of access under the Equality Act 2010 is the core purpose of the service and is reasonably expected by registrants. This interest has been balanced against data minimisation principles: only the minimum data necessary for verification is displayed.

2c. Website Usage Data

We collect standard server logs (IP address, browser type, pages visited, timestamps) for security monitoring and to diagnose technical issues. This data is retained for 30 days and is not linked to your registration data.

Lawful basis: Legitimate interests (Article 6(1)(f)) — maintaining the security and integrity of the service.

2d. Marketing Communications

If you opt in, we may contact you with service updates, renewal reminders, and information about new features. We use Mailchimp for email marketing, acting as a data processor on our behalf.

Lawful basis: Consent (Article 6(1)(a)) — you can withdraw consent at any time using the unsubscribe link in any email, or by contacting us directly.

3. Special Category Data

Health and disability information is special category data under UK GDPR (Article 9). We treat it with the highest level of protection:

• It is never displayed publicly on verification cards
• It is accessible only behind an explicit confirmation step designed for emergency use
• Access is not logged — the confirmation step is a client-side soft barrier; we do not record when or by whom it is accessed
• It is stored encrypted at rest within our database
• It is retained only for the duration of your active registration, plus a maximum of 12 months after expiry for you to reinstate your registration

You may request deletion of special category data at any time — see Section 7 (Your Rights).

4. How Long We Keep Your Data

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share data only with the following processors who are bound by data processing agreements:

• Stripe — payment processing (PCI-DSS certified). Data: billing name, email, transaction amount
• IONOS / 1&1 — web hosting and server infrastructure. Data: all data stored on our servers is within their data centres (UK/EU)
• Mailchimp (Intuit) — email marketing. Data: name, email address, subscription status. Mailchimp stores data in the USA under Standard Contractual Clauses
• Cloudflare — DNS, CDN, and DDoS protection. Data: IP addresses processed in transit only; no personal registration data is shared

We may disclose personal data to law enforcement or regulatory authorities if legally required to do so.

6. International Data Transfers

Your data is primarily stored within the United Kingdom and European Economic Area. Where we use processors based outside the UK/EEA (Mailchimp — USA), we ensure an appropriate transfer mechanism is in place, specifically Standard Contractual Clauses (SCCs) approved under UK GDPR.

7. Your Rights Under UK GDPR

You have the following rights over your personal data. To exercise any right, email us at [email protected] with proof of identity. We will respond within one calendar month.

• Right of access — request a copy of all personal data we hold about you (Subject Access Request)
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — request deletion of your data. Note: we may retain certain data where required by law (e.g. financial records for 7 years)
• Right to restriction — request that we limit processing of your data while a dispute is resolved
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent (e.g. marketing, health data), you may withdraw at any time without affecting the lawfulness of prior processing
• Rights related to automated decision-making — we do not use automated decision-making or profiling that produces legal or similarly significant effects

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):

🌐 ico.org.uk/make-a-complaint
📞 0303 123 1113

8. Cookies

We use cookies to operate the website and, with your consent, to analyse usage. Cookies set by this site include:

• Strictly necessary: WordPress login session cookies, security tokens. These cannot be disabled as they are essential to the service
• Functional: Remember-me preference, language/display settings
• Analytics (with consent): We may use anonymised analytics to understand how pages are used. No personal registration data is shared with analytics providers
• Payment: Stripe sets cookies required for fraud detection on checkout pages

You can manage or withdraw cookie consent at any time via the cookie banner on this site, or by clearing cookies in your browser settings.

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS encryption in transit (HTTPS) across the entire site
• Encryption at rest for special category (health) data
• Access controls limiting staff access to personal data to those with a legitimate need
• Dog profile pages: nothing from your profile page appears in search engines. Every profile page carries noindex, nofollow directives and an X-Robots-Tag HTTP header, ensuring Google, Bing, and all major search engines are blocked from indexing your data
• Regular security reviews and dependency updates

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33–34.

10. Children's Data

Our registration service is intended for individuals aged 18 and over. We do not knowingly collect personal data from children under 13. If a registration is submitted for a handler under 18, a parent or guardian must provide consent. If you believe we have inadvertently collected data relating to a child, please contact us immediately.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be notified to registered users by email at least 14 days before taking effect. The current version will always be available at this URL. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

For any data protection enquiries, Subject Access Requests, or to exercise any of your rights:

📧 [email protected]
🌐 assistancedogregistry.co.uk/contact

We aim to respond to all privacy-related enquiries within 5 working days, and to formal Subject Access Requests within one calendar month (extendable by a further two months for complex requests, with notice).