Privacy Policy

This policy explains what personal data Parkntel (“we”, “us”) collects when you use the Parkntel app or website, why we collect it, and the rights you have over it under UK GDPR and the Data Protection Act 2018.

Who we are

Parkntel is the data controller for the personal data described in this policy. You can reach our Data Protection contact at privacy@parkntel.com.

What we collect

• Account data — name, email, phone number, and a password (stored as a salted hash, never in plain text).
• Identity and vehicle verification — the minimum needed to confirm you are who you say you are and that a vehicle is registered to you, processed via a verification provider and never stored by us as raw ID documents.
• Obstruction reports — photos, location, and timestamps you submit when reporting a blocked bay.
• Messages — content you exchange with another driver through the app to resolve a report.
• Device and usage data — device identifiers for push notifications, and basic diagnostic/analytics data.

Why we process it, and our lawful basis

UK GDPR requires us to have a specific lawful basis for each thing we do with your data. Ours are:

• Contract — running the core service: creating your account, matching an obstruction report to the responsible driver, and carrying messages between you. Without this processing there is no service to provide.
• Legal obligation — keeping security and financial records for the periods the law requires, and responding to lawful requests from authorities.
• Legitimate interests — verifying identity and vehicle ownership, moderating abuse, and keeping the platform secure. We rely on this because a reporting system that anyone could join anonymously would be trivially abused, and the drivers on both sides of a report have a strong interest in that not happening. You can object to processing on this basis.
• Consent — product updates and marketing email, and biometric sign-in. You can withdraw consent at any time without affecting anything you did before you withdrew it.

Number plates and other drivers' data

When you report an obstruction you give us the registration of a vehicle that isn't yours. A registration is personal data about its keeper, so we handle it carefully: we use it only to identify the Parkntel account it belongs to, we never show you the other driver's name, address, phone number, or email, and if the plate matches no Parkntel account we do not attempt to look the keeper up through DVLA or any other source. If you are reported, you are told a report exists and can respond through the app — you are not identified to the reporting driver beyond what the app itself displays.

Biometric sign-in

If you turn on Face ID or fingerprint sign-in, your device creates a passkey (a WebAuthn credential) and keeps the biometric data locked inside its own secure hardware. Your face and fingerprint never leave your device and never reach Parkntel — all we receive is a public key and a signature proving your device unlocked successfully. Turning the feature off removes that credential.

How long we keep it

Retention periods are set per data category and enforced automatically by a scheduled job, not by anyone remembering to delete things. The full schedule — every category, its period, and whether the data is deleted or anonymised at the end of it — is published at Data Retention Schedule. You can request earlier deletion at any time (see “Your rights” below).

Who we share it with

We share data with the specific service providers needed to run Parkntel, each bound by a data processing agreement and none of them permitted to use your data for their own marketing. They are named individually at Sub-processors. We do not sell personal data, and we do not share it with advertisers, insurers, employers, or debt-recovery firms.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure (“the right to be forgotten”)
• Restrict or object to certain processing
• Receive your data in a portable format
• Complain to the UK Information Commissioner's Office (ICO) if you believe we've mishandled your data

To exercise any of these, email privacy@parkntel.com — we respond within 30 days as required by law.

You can also complain to us first — email the address above and we will treat it as a formal complaint, respond within 30 days, and tell you how to escalate to the ICO if you're not satisfied. You do not have to come to us before going to the ICO.

Cookies and local storage

We use only strictly necessary storage — the things that keep you signed in and the app working. There are no advertising trackers, no analytics cookies, and no third-party pixels, which is why you have not been shown a cookie consent banner: under PECR, consent is required for non-essential storage, and we don't use any. The full list of what we store is at Cookies and Local Storage.

Where your data is held

Your data is stored on servers in the UK and the European Economic Area. Where a sub-processor operates outside that area, the transfer is covered by the UK International Data Transfer Addendum or an adequacy decision — the Sub-processors page records which applies to each one.

Security incidents

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high. Every administrative action taken on your data is recorded in an audit log we cannot quietly edit.

Changes to this policy

We'll update this page if how we handle your data changes, and for material changes we'll notify active users directly. Each version carries a version number, and the version you agreed to at signup is recorded against your account.