DATA PROTECTION AND PRIVACY NOTICE

1. Who is responsible for your information

ESA Registry UK is the data controller for personal information collected through the ESA Registry UK website and UK registration, renewal, replacement, Store, travel-letter and support services.

Privacy enquiries and requests can be sent to support@esaorguk.com or submitted through our contact page.

2. Information we may collect

Depending on the service you use, we may collect:

• your name, email address, telephone number, date of birth and registration number;
• postal and delivery addresses;
• information about your Emotional Support Animal, including its name, breed, date of birth, sex and photograph;
• medical or health evidence submitted to support registration eligibility;
• registration, renewal, replacement, Store and travel-letter request details;
• order totals, postage choices, PayPal order or capture references and payment status;
• messages and information supplied through our contact and support services; and
• technical, security, error and payment-failure information generated when our services are used.

3. Why we use personal information

We use personal information to:

• verify eligibility and process ESA registrations and renewals;
• maintain membership and registration records;
• produce identification cards, certificates, certification letters and member documents;
• process replacement and Store orders and arrange delivery;
• prepare requested member-support and travel letters;
• take payments and maintain transaction records;
• respond to enquiries and provide customer support;
• detect failed transactions, misuse, fraud and security problems;
• operate, protect and improve our website and services; and
• meet accounting, legal, regulatory and record-keeping obligations.

4. Lawful bases

We process ordinary personal information where it is necessary to take steps at your request, provide the service or product you have requested, perform our contract with you, comply with legal obligations, or pursue legitimate interests such as administering memberships, providing support, preventing fraud and protecting our systems.

Where consent is the appropriate basis, it may be withdrawn at any time. Withdrawal does not affect processing already carried out lawfully before consent was withdrawn.

5. Medical and health evidence

Medical and health information is special-category personal data. Where you submit this evidence, it is used only to review and verify registration eligibility. We rely on your explicit consent for this limited processing in addition to the applicable lawful basis under Article 6 of the UK GDPR.

Medical evidence is reviewed only by authorised personnel who require access for verification. After verification has been completed, the uploaded medical evidence is manually and securely deleted from the working systems used for the review. ESA Registry UK does not intentionally retain the medical document as part of the continuing registration record.

The registration record may show that evidence was reviewed and eligibility was verified, but it should not contain the medical document itself.

6. Payments

Payments are processed through PayPal, including PayPal-supported debit or credit-card payment options. ESA Registry UK receives transaction references, order status, payment status and the amount paid. We do not intentionally receive or store your complete payment-card number or card-security code.

PayPal processes personal information under its own privacy terms and security arrangements.

7. Email and service providers

We use service providers where necessary to operate our website, databases, email delivery, payment processing, document production, hosting, security and delivery services. These providers may process limited personal information on our behalf or as independent controllers for their own regulated services.

We disclose information only where necessary to provide the requested service, meet a legal obligation, protect our rights or systems, or where you have authorised the disclosure. We do not sell customer medical information.

8. Website analytics and advertising technologies

Some pages use Google Tag Manager, Google Analytics or Google advertising tags to understand website use and measure advertising performance. These technologies may collect information about the device, browser, pages visited and interactions with the website.

Google may process this information under its own privacy terms. Browser controls and available Google privacy or advertising controls may be used to restrict these technologies.

9. International processing

Some service providers, including payment and analytics providers, may process personal information outside the United Kingdom. Where a restricted international transfer applies, the transfer must be supported by an applicable adequacy regulation or appropriate contractual and organisational safeguards.

10. How long information is kept

• Medical evidence: manually deleted after the eligibility-verification process has been completed.
• Registration and membership records: retained while required to administer the registration, provide member services, verify documents and handle related enquiries or disputes.
• Order and payment records: retained for administration, fraud prevention, accounting, tax, legal and dispute-handling purposes.
• Contact and support messages: retained for as long as reasonably required to answer the enquiry, maintain an appropriate service record and deal with follow-up matters.
• Operational and security logs: retained only for as long as reasonably necessary to diagnose faults, investigate payment failures, protect systems and maintain service security.

Information may be retained for longer where required by law, for the establishment or defence of legal claims, or where deletion has been temporarily suspended for a documented reason.

11. Security

We use proportionate technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration, disclosure or destruction. Access is restricted according to operational need. No online system can be guaranteed to be completely secure, but suspected incidents are investigated and handled in accordance with applicable legal requirements.

12. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have rights to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request erasure of information where the legal conditions apply;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• raise a concern about how your information is handled.

These rights are not absolute and may be limited by legal, accounting, fraud-prevention or record-keeping obligations. We may need to confirm your identity before completing a request.

13. Children and young people

Where a registration or enquiry concerns a person under 18, a parent, guardian or appropriately authorised adult should normally submit or supervise the request. We aim to collect only the information required to provide the requested service.

14. Automated decisions

ESA Registry UK does not use the information submitted for registration to make solely automated decisions that produce legal or similarly significant effects. Eligibility evidence is subject to review rather than being decided solely by an automated system.

15. Complaints

Please contact us first at support@esaorguk.com so we can investigate your concern.

You also have the right to complain to the Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

16. Changes to this notice

We review this notice when our services, providers or data-handling practices change. The review date shown above identifies the current published version.