Privacy Policy.

1. Who we are

SmartPark 360 is a trading division of Cortex AI Group Ltd (trading as Engineer M8), a company registered in England and Wales. Our registered office is Dumballs Road, Cardiff, CF10 5FE. For the purposes of UK GDPR and the Data Protection Act 2018, we are the Data Controller for personal information processed in relation to our parking services.

We are registered with the Information Commissioner's Office (ICO) and are a member of the British Parking Association's Approved Operator Scheme (AOS Membership No. 84258).

2. What information we collect

Depending on how you interact with us, we may collect the following categories of information:

From motorists using our car parks

• Vehicle Registration Mark (VRM) captured by our ANPR cameras
• Date, time and images of entry and exit from our managed car parks
• Payment information when you pay for parking or a PCN
• Registered keeper details, obtained from the DVLA under the KADOE (Keeper at Date of Event) scheme, where enforcement is required

From permit applicants

When you register for a parking permit, we collect your name, address, telephone number and vehicle registration, together with your site, permit validity and activation-code usage. We use these details to issue and manage your permit and identify permitted vehicles. Authorised SmartPark staff and the operator’s authorised site users can access the details to administer your parking permission. Permit registration does not require a DVLA keeper lookup.

Website enquiries and complaints

Details submitted through our enquiry and complaint forms are saved in our staff portal for review and follow-up. Authorised SmartPark staff can record progress and internal notes. Staff email notifications identify the submission reference and link to the portal; they do not include your form contents. Agreeing to contact about an enquiry does not subscribe you to marketing emails.

From website visitors

• Information you submit via contact, appeal or complaint forms
• Technical information such as IP address, browser type and pages visited
• Cookie data (see section on Cookies)

From clients and business contacts

• Name, job title, business contact details
• Information relating to site operation and service delivery

3. Why we collect this information

We process personal information for the following purposes:

• To operate and manage parking at sites we are contracted to manage
• To enforce parking terms and conditions, including issuing Parking Charge Notices
• To process payments securely via our payment partner (Stripe)
• To handle appeals and complaints in line with BPA AOS Code of Practice
• To communicate with clients about service delivery and support
• To comply with legal and regulatory obligations
• To improve our services and website experience

4. Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Legitimate interests — for ANPR capture, enforcement of parking terms, and managing claims under the Protection of Freedoms Act 2012
• Contract — where we process data to fulfil a contract with a client or customer
• Legal obligation — where processing is required by law or court order
• Consent — where you have specifically consented (e.g. to receive marketing communications)

5. Who we share your data with

We do not sell personal data. We may share information with:

• DVLA — to obtain registered keeper details under the KADOE scheme
• Stripe — our PCI-DSS compliant payment processor
• POPLA — where an appeal is escalated to the independent adjudication service
• Debt recovery agencies — where an unpaid PCN is referred for recovery
• Legal advisers and courts — where enforcement action is required
• Site owners — where operational reporting is contractually required

All third parties are bound by appropriate data processing agreements and UK GDPR obligations.

6. How long we keep your data

We retain personal information only as long as necessary:

• ANPR entry/exit records — up to 12 months for operational purposes, longer where enforcement action is in progress
• PCN records — up to 6 years after closure, in line with the Limitation Act 1980
• Appeal and complaint records — up to 6 years after resolution
• Payment records — up to 7 years for tax and accounting purposes
• Website enquiry forms — up to 24 months if not converted to a client relationship

7. Your rights

Under UK GDPR, you have the following rights:

• The right to be informed about how we use your data
• The right of access — to request a copy of the data we hold about you
• The right to rectification — to correct inaccurate data
• The right to erasure — to request deletion of your data (subject to legal retention requirements)
• The right to restrict processing in certain circumstances
• The right to data portability for data you have provided to us
• The right to object to certain processing, including direct marketing
• Rights related to automated decision-making and profiling

To exercise any of these rights, please contact us using the details below. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

Our website uses a small number of cookies:

• Essential cookies — required for the site to function
• Analytics cookies — help us understand how the site is used (only with your consent)

We do not use advertising or tracking cookies. You can manage cookies via your browser settings.

9. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Data Protection Officer
SmartPark 360
Dumballs Road
Cardiff CF10 5FE

Email: privacy@smartpark360.co.uk
Phone: 02922 971 537

This policy may be updated from time to time. The most current version will always be available on this page.