Privacy Policy (2026)

Last updated: 9 September 2026. Version: PMUK-2026-09-09.

1. Who is responsible for your information

Civil Disputes UK Ltd, trading as Parking Mate UK, is the controller of personal information used to provide our parking dispute service. Our company number is 16577339 and our registered address is 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE.

For privacy questions, rights requests or complaints, email info@parkingmateuk.com or write to that address, marked Privacy. This notice covers our website, web assistant, WhatsApp service and customer-support correspondence. The Terms and Conditions explain the service, your authorisation and cancellation rights.

2. Information we collect and where it comes from

Identity and contact information: your name, email address, telephone or messaging number, postal address and your relationship to the vehicle or case.
Case information: notice and vehicle registration numbers, issuer, location, dates, deadlines, correspondence history, your account of events and the stage of the dispute.
Documents and messages: notices, photographs, signage evidence, receipts, letters, decisions, court or tribunal documents, chat messages and attachments you send us.
Service records: assessments, prepared documents, instructions, authorisations, submission acknowledgements, follow-up actions, support requests and outcomes supplied to us.
Payment records: the service purchased, amount, payment reference, payment status, refunds and checkout confirmations. Stripe processes card details; we do not need your full card number or security code in our messages or case documents.
Technical information: website and request logs, IP address, browser or device information and session identifiers used to operate, protect and troubleshoot the service.

Most information comes from you or someone you have authorised. We may also receive relevant information from the parking operator, authority, tribunal, payment provider or other recipient involved in the instructed case. Where relevant, we use public sources such as published parking rules, court or tribunal decisions and issuer information to assess the dispute. We do not obtain unrestricted access to your private email or social-media account simply because you contact us.

3. Why we use information and our lawful bases

Assessment and delivery of the service: we use the information needed to assess your request, identify the notice and possible grounds, prepare documents, carry out authorised submissions, handle included correspondence and communicate next steps. The lawful basis is taking steps at your request before a contract, or performing our contract with you. If you do not provide the information necessary for the requested action, we may be unable to assess or progress it.

Payments and administration: we use order and payment information to process purchases and refunds and manage our contract. We retain records necessary to comply with accounting, tax and other legal obligations under the legal-obligation basis.

Security, service reliability and disputes: we use proportionate logs and case records to prevent misuse, investigate errors or complaints, recover interrupted work and establish or defend legal claims. The lawful basis is our legitimate interests in operating a reliable service, protecting customers and resolving disputes, balanced against your rights. Where disclosure or retention is required by law, we rely on that legal obligation instead.

Optional publicity or marketing: where consent is required, we ask for it separately. Instructing an appeal, paying for the service or receiving a case update is not consent to publish your identity or send unrelated promotional messages. You can withdraw consent without affecting the lawfulness of earlier processing or the service already provided.

4. Sensitive information and other people's data

Some evidence may reveal health, disability or other special-category information. Send only what is relevant and obscure unrelated details. Where such information is necessary to establish, exercise or defend a legal claim, we use the applicable legal-claims condition as well as the relevant lawful basis above. Where that condition does not apply, we need another valid condition, such as your explicit consent, before using it. Supplying a document is not blanket consent to unrelated uses.

Avoid sending unrelated identification documents, payment-card details or private information about passengers, witnesses or other people. If their information is relevant, tell them you are providing it where appropriate. Contact us if you need to correct or remove unnecessary material from a submission.

5. AI and automated processing

The Parking Ticket Appeal OS uses automated workflows and AI services to read uploaded documents, extract relevant facts and dates, identify the case stage and possible appeal grounds, prepare case-specific documents, route messages and support tracking and follow-up. Relevant document text, images and case context may be processed by the AI and document-processing providers used for those tasks.

AI output can be incomplete or incorrect. Tell us about an incorrect fact, classification, document or suggested next step. You can ask for a person to review the assessment or proposed action by contacting customer support; you do not need access to our internal systems to do this.

An automated assessment is not a tribunal or court decision. The operator, authority, tribunal or court decides the dispute. Submission authority and any action reserved to you are governed by your instructions and our Terms. Where applicable data protection law gives you rights concerning a significant solely automated decision, you can ask for human intervention, express your view and challenge the decision through the same contact route.

6. Who receives information

We share the information needed for the relevant purpose with:

Cloud hosting, storage, security, workflow, document-processing and AI service providers that help us operate the service.
Stripe for payment processing, refunds, transaction checks and checkout records.
Email and messaging providers. Using WhatsApp involves WhatsApp and Meta; using Facebook or Instagram involves the relevant Meta service. Those platforms also process information under their own privacy notices and account settings. You can use our web assistant instead of a social-media channel.
The parking operator, council, Transport for London, relevant appeal body or other recipient where disclosure is needed for the case action you authorise. Where you must file court or TEC documents yourself, we supply the documents and instructions to you rather than treating our preparation service as authority to file them.
Professional advisers, regulators, law-enforcement bodies or other parties where necessary for a legal obligation, security investigation or legal claim.

Recipients such as Stripe, Meta, operators, authorities and tribunals may act as independent controllers for their own functions. Their privacy notices explain those functions. We do not sell your personal information.

7. Processing outside the UK

Cloud, AI, payment and communications services can involve processing or access outside the UK. This service should not be understood as a promise that all information stays in the UK.

Where we make a restricted international transfer, UK data protection law requires an applicable adequacy arrangement, appropriate safeguards such as a UK International Data Transfer Agreement or UK Addendum, or a valid legal exception. You can contact us for information about the recipient, destination and safeguard applicable to your information, and a copy of the relevant safeguard where available. The provider's own privacy notice also explains transfers for processing it controls independently.

8. How long we keep information

Different records have different purposes; completing a chat does not necessarily close the underlying appeal. Retention is determined as follows:

Temporary assessment and intake records: temporary copies used to collect and transfer a case can be removed after the case has been verified in the durable case record. Some verified temporary session records are eligible for cleanup after 7 days; inactive intake records without a payment or recovery dependency can be eligible after 30 days. These are temporary-store rules, not a promise that all case documents, messages, backups or payment records are erased at those points.
Active case records and evidence: kept while needed to perform the purchased service, handle included follow-up and resolve outstanding case actions. The relevant notice, procedural deadlines, appeal stage and whether a response or application remains open determine that period.
Closed cases, authorisations and complaints: the relevant record may be retained where needed to deal with a complaint, demonstrate what was instructed or supplied, or establish or defend a legal claim. The applicable claim time limits, any actual dispute and any preservation obligation determine continued retention; unnecessary duplicate or unrelated material does not need to remain for the same period.
Orders, payments and refunds: retained for the period required by applicable tax and accounting record-keeping obligations and any unresolved payment dispute.
Security logs and backups: retained according to their troubleshooting, security and recovery purpose. A deletion from an active system may not immediately remove a recovery copy or a record a separate provider must lawfully retain.

You can ask what is retained for your case and request deletion or restriction. If we need to keep a record, we will explain the reason and the applicable retention criteria. We do not describe an unresolved paid case as abandoned merely because its initial chat is old.

9. Security and access

We use access controls and technical measures intended to protect the service and restrict case information to the people and systems that need it. No internet service can promise absolute security. Do not send passwords, full card details or unnecessary sensitive information, and tell us promptly if you suspect unauthorised access to your case.

We may ask for enough information to verify your identity or authority before sharing a case record or acting on a privacy request. Customer support and case updates are available through the web assistant, WhatsApp and email; customers do not need access to our internal administration systems.

10. Cookies, session storage and third-party services

Our web assistant uses browser session storage to keep the conversation associated with the same browser session. Necessary security, session and payment technologies help operate the website and checkout. Blocking these may interrupt the service. Stripe and any messaging service you choose also operate their own technologies and privacy controls.

Non-essential advertising or tracking technologies require the applicable consent or another valid legal exception before use. Browser controls alone are not a substitute for obtaining consent where it is required. For technologies relying on an applicable statistical exception, the required information and a simple means to object must be provided. This notice is not consent to introduce new advertising trackers.

11. Case studies, reviews and social posts

A confirmed cancellation or customer review is not automatic permission to publish the underlying messages, documents or identity. We may use genuinely anonymised outcomes that no longer identify a person to describe how the service works. Removing a name alone is not sufficient if a reference, registration, image or distinctive circumstances still identify someone.

Before using identifiable case details, personal images or private correspondence in publicity, we seek separate permission specifying the material and intended use. Declining does not affect your service. Public material may be copied by others; tell us if you want to withdraw permission for future use. We will explain what can be removed from channels we control.

12. Your rights and complaints

Depending on the processing and lawful basis, you can request access, correction, deletion, restriction or a portable copy of information you supplied. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where we rely on it. Some rights have lawful exceptions, for example where information must be retained for a legal obligation or claim.

Contact info@parkingmateuk.com to exercise a right or complain about our handling of information. We normally respond to rights requests within one month. If a lawful extension or exception applies, we explain it. We do not normally charge for exercising these rights.

You can also complain to the Information Commissioner's Office, the UK data protection regulator. Contacting us first can help resolve a problem, but it does not remove your right to contact the ICO.

13. Changes to this notice

We update this notice when our service or data practices change and identify the date above. Where a change requires further information or a new consent, publishing an updated notice alone is not a substitute for providing that information or obtaining consent.