We keep the Parking Services Privacy Notice under review. It was last reviewed and updated in April 2022.
If you have any questions about this Privacy Notice contact the council’s Data Protection Officer.
View the privacy and transparency information for all of the City of York Council (CYC).
Personal data
We are the data controller for the purposes of data protection legislation for all personal data provided, that is either required from Parking Services or that the customer may provide to the Parking Services, including, but not limited to:
- appeals against a Penalty Charge Notice (PCN) where the customer may submit a statement or additional evidence in support of their appeal
- permit holder information
- use of the Parking Services website and car parks
We take reasonable steps to keep your details up to date and accurate.
We look after your personal data by having security that is appropriate for its nature and balanced against the harm that might result from a breach of our security.
Once we've received your personal data, we'll use strict procedures and security features to prevent unauthorised access as far as is reasonably practical.
Unfortunately, the transmission of information via the internet is not completely secure. Although we'll do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website or suppliers using any transmission mechanism, any transmission of data (information) is therefore at your own risk.
See further details about how we define personal data and non-personal data.
Collecting personal data
You consent to the City of York Council’s Parking Services collecting and processing the personal data (including any sensitive personal data) that you provide.
We won't ask you for any more information than that which we need, and we don't keep your personal data for any longer than we need to.
Collecting personal data for parking services
In order to provide parking services, it's necessary for Parking Services to collect and use personal data about you. The personal data collected and used will vary and depend on the nature of the service used.
Examples of the parking services for which personal data may be collected include:
- parking enforcement
- parking appeals
- blue badge misuse
- parking dispensations
- car park season tickets
- resident permits
- card payments for parking
- correspondence
This information may include:
- details about you such as address, phone number, email address
- details of your vehicle, such as vehicle registration number, vehicle make and model
- location of vehicle
- civil parking offence details
- formal parking enforcement notices and Police and Criminal Evidence (PACE) interview forms
- vehicle ownership checks via the Driver and Vehicle ;Licencing Agency (DVLA)
- images of you if the enforcement officer has activated their body worn video camera
- your credit/debit card details if you have paid for a service by card
- contact we've had with you, such as any correspondence
Collecting personal data for PCN appeals
When you make an appeal against the issue of a PCN, you accept we'll collect and process personal data you supply via the Parking Services website, phone call, email or post.
For an appeal such information may include:
- the PCN reference number
- the vehicle registration
- your relevant association (driver, registered keeper, hirer/leasee or other)
- your name
- postal address
- email address
- telephone number
- the details of the appeal and any uploaded evidence
These details will be used for the purpose of progressing your PCN to cancellation or payment and may be accessed for the purpose of compliance auditing.
Depending on the nature of your appeal, the information you may give may be classified as sensitive personal data. For example, if you give information relating to a medical condition you may have.
We'll only use or disclose this personal data to third parties as part of your appeal and we won't use it for any other purpose.
Collecting personal data when using our website
With regard to each of your visits to our website we may automatically collect technical information normally referred to as Cookies.
This data will include, but is not limited to:
- the Internet Protocol (IP) address used to connect your computer to the Internet
- your login information (to our website)
- browser type and version
- time zone setting
- browser plug-in types and versions
- operating system and platform
Further details will include information about your visit, including:
- the full Uniform Resource Locators (URL) clickstream to, through, and from our site (including date and time)
- your viewing history on our website
- page response times
- download errors
- length of visits to certain pages
- page interaction information (such as scrolling, clicks, and mouse-overs)
- methods used to browse away from the page
- any phone number used to call our customer service number
The information which we collect and store during normal use of the site is used to monitor and analyse how parts of the site are used. Such use doesn't result in any personally identifiable data being collected or stored.
Using personal data
We will use any personal data collected through the issuing of:
- a parking ticket including Pay and Display or Pay on Exit ticket
- an annual residential or business permit, or other parking permit
- a PCN for the enforcement of parking contraventions and other associated enforcement purposes
We may use your personal data to:
- create customer accounts
- carry out parking enforcement activities
- deal with your challenges and queries in respect of PCNs
- process applications and issue parking dispensations
- process applications and issue car park season tickets
- process applications and issue resident permits
- take payments for season tickets, resident permits and PCNs
- take payments for parking sessions
- investigate and prosecute (if applicable) cases of Blue Badge misuse
- investigate reports of abandoned and untaxed vehicles and their removal
By using parking services and by submitting information, you confirm that you, or the person on whose behalf you are submitting that information, consent to the use of that information as set out in this Privacy Notice and in the City of York Council's corporate Privacy Policy.
Our legal basis for using personal data
We rely upon the following laws to process your personal data:
- The Civil Enforcement of Parking Contraventions (England) General Regulations 2007
- The Traffic Management Act 2004
- Road Traffic Act 1991
Sharing personal data
Personal data (including, where relevant, sensitive personal data) will be provided to:
- Parking Services teams, including the parking enforcement, objections and appeals and parking permits teams, for the purposes set out in this Privacy Notice under all sections
- City of York Council’s Customer Services, when acting on behalf of Parking Services, including the customer reception and Business Support
- City of York Council’s fraud team, Veritau
- the Payment Processor for processing any online payments, if provided in relation to a paid parking session or a PCN
- the DVLA, for the purpose of audit of our car park management service and enquires to them when for the purposes of issuing and dealing with a PCN
- the Traffic Enforcement Centre (TEC)
- the Traffic Penalty Tribunal (TPT) for the purpose of assessing your appeal
- print and physical postal service providers for the purpose of responding to your appeal by post
- email service providers for the purpose of responding to your appeal by email
- credit reference agents for the purpose of ensuring we are writing to you at your most recent correspondence address, if you have not replied to other correspondence
- City of York Council bailiff suppliers
- collection agents for the purpose of enforcing an overdue payment or parking contract
- Commercial Services Tadcaster Ltd for abandoned and untaxed vehicle investigation and collection
- solicitors for the purpose of enforcing a parking contract or responding to a legal query
- any other duly authorised sub-contractors
These are all duly authorised and licensed by the ICO as processors of that data for the purposes intended.
The data you provide may be disclosed to other enforcement agencies for enforcing parking contraventions or to agents of the Council during the course of debt collection.
It may also be disclosed to other departments within the Council or external parties for related enforcement purposes or as required by law:
- The Civil Enforcement of Parking Contraventions (England) General Regulations 2007
- The Traffic Management Act 2004
- Road Traffic Act 1991
Personal data supplied to us is subject to confidentiality as defined in Data Protection legislation and won't be disclosed otherwise without your prior consent, unless we are otherwise instructed to do so by a request for information by government organisations in which case the release of information shall be fully audited and compliant to the requirement as stipulated in Data Protection legislation.
Sharing data under Data Protection legislation
We may be required or permitted, under data protection legislation, to disclose your personal data without your explicit consent, for example if we have a legal obligation to do so, such as for:
- law enforcement
- fraud investigations
- regulation and licensing
- criminal prosecutions
- court proceedings
We must protect public funds and may use personal data and data-matching techniques to detect and prevent fraud, collect taxes and ensure public money is targeted and spent in the most appropriate and cost-effective way. To do this, your personal data may be shared with other bodies responsible for auditing or administering public funds, including the Department for Work and Pensions, HM Revenue and Customs, the Police and other local authorities.
Retaining personal data
How long we keep your personal data depends on the Parking Services service or product.
Retaining personal data for Penalty Charge Notices
All relevant data as mentioned in this Privacy Notice will be kept while the PCN case is still live. Once the PCN case is closed the data will be erased.
For PCN cases, please bear in mind that we may hold your records after your appeal has been considered as we are required to have an effective audit trail and to comply with regulatory and legislative requirements.
Retaining personal data for parking permits
All relevant data as mention in this Privacy Notice will be kept for as long as the permit is active and for any permits that have a renewal process to save the customer time when reapplying for a permit.
Retaining personal data for abandoned and untaxed vehicle reports
Personal data provided to us by the member of the public to report such vehicles will be logged and passed to our supplier (Commercial Services Tadcaster Ltd) aiding the report to be followed up.
Details will remain on our system while the report is still live and for the purposes of DVLA audits only.
At the end of the retention period, we may pass any relevant information to the City Archives where it is required or appropriate to do so.
Further processing of personal data
If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we'll provide you with a new notice.
The new notice will:
- explain this new use before we start the processing
- set out the relevant purposes and processing conditions
Where and whenever necessary, we'll seek your consent to the new processing, if we start to use your personal data for a purpose not mentioned in this Privacy Notice.
Personal data in online payments
When you click on a payment selection on the website you accept you will be redirected to the separately hosted secure web page of the Payment Processor.
Any personal data you supply via the Payment Processor will be collected and processed by the Payment Processor.
For making an Online Payment information may include:
- your PCN reference number
- payment card number
- expiry date
- security code (CVV number)
The PCN reference will be used for the purpose of locating the relevant PCN to enable the Payment Processor to populate the payment screen with the outstanding amount payable. The other details will be used by the Payment Processor to process the transaction.
To help us allocate any payments made we'll be supplied with:
- the PCN reference
- the status of the PCN, for example “paid”
Parking Services will only process personal data you supply whilst making your payment, including your name, postal address and card details via the Payment Processor.
We won't be permitted access to this information, other than the PCN reference and the status of the PCN.
This information is subject to confidentiality and will only be used for this purpose by the Payment Processor.
All online card payments are protected by Secure Socket Layer (SSL) websites with an encryption key length of 128 bits. This matches the security as used by online banking systems and provides the confidence that the transaction is secure.
You should never make a financial transaction unless there is a reference to "https://" in the top left browser window. The lower case ‘s’ denotes a secure connection suitable for financial transactions.
Your payment card details are directly processed by the Payment Processor and are not collected, nor are they accessible, by Parking Services.
The Payment Processor’s online payment management solutions are independently and rigorously security assessed, and is certified by Visa and MasterCard as a Payment Card Industry Data Security Standard (PCI DSS) Level 1 payment processor.
Further information about this payment card security standard can be found at PCI Standards Security Council website.
Your rights relating to personal data
When we collect your personal data we'll tell you how we are going to use it. Where we process your personal data, you have a number of rights under data protection law.
Data Protection legislation gives you the right to access information held about you under the terms as defined as Subject Access Requests.
You can access personal data we hold by writing to:
Parking Services
City of York Council
Station Rise
York
YO1 6GA.
You will need to provide proof of your identity and that you are authorised to receive the information.
See further details of your rights relating to personal data.