G24 Privacy Policy

---

Content

• Overview

• Data Security

• What data is processed when you use G24 car parks?

• What data do we collect?

• How do we collect data?

• What if you provide sensitive data within an appeal or correspondence?

• How will we process your data and why do we process it?

• What data is processed when you submit a commercial enquiry?

• What data do we process?

• Who do we share data with?

• What data is processed when you pay a parking charge online?

• How long will we keep your data for?

• Body Worn Cameras

• What are your rights as a data subject?

• How can you contact the Information Commissioner’s Office?

• How can you contact G24 if you have a privacy related query?

Overview

We are G24 Limited, a car park management company. When collecting the data specified in this privacy policy, we are the Data Controller. This policy has been produced in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Human Rights Act 1998 (HRA 1998). Any changes to this policy will be posted on this webpage. This policy was last updated on 24 March 2025.

This Policy explains:

• Why we process personal data;

• What personal data we collect and process;

• When and why we will share personal data;

• How long we will keep personal data for.

This policy also explains your rights as a data subject, including information about the right to access the information we hold about you. In certain circumstances, you also have the right to object to the processing of your data, to request that processing be restricted, or to request that we rectify or erase the data we hold about you. Further information is provided below. Under data protection law, if you request that we action any of these rights, we must verify your identity before providing information to you. We must also provide you with an explanation if we do not agree with your request.

Data Security

We look after your personal data by having security that is appropriate for its nature and the harm that might result from a breach of security. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site, any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. Those with whom we share data are also required to process your data in-line with contractual safeguards and data protection law requirements.

With regard to each of your visits to our site, we may automatically collect technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; information about your visit, including the full Uniform Resource Locators (URL) click-stream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number. The information which we collect and store during normal use of the site is used to monitor and analyse how parts of the site are used.

Any payment transactions carried out by us or by our chosen third-party provider of payment processing services will be encrypted using Secured Sockets Layer technology. Where we have given you (or where you have chosen) a password that enables you to access certain parts of the site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

What data is processed when you use G24 car parks?

What data do we collect?

When you use a G24 car park, we collect and process data comprising images of vehicles using the car park and/or the Vehicle Registration Mark (VRM).

If the contractual parking terms and conditions are breached, a parking charge will be issued. The data we process when issuing a parking charge includes the recipient

’s name and address, images of the vehicle, its details and movement whilst using the car park and the Vehicle Registration Mark (VRM). If you submit an appeal in relation to a parking charge, or otherwise correspond with us, including on the phone, you may provide us with additional personal data, the data we process

may include: the VRM; your name, address, email and phone number, a parking charge or other reference number, IP address, the capacity in which you are appealing (e.g. keeper, driver, hirer, other), and any other information you provide within any correspondence, phone call or appeal, including any documentation you share with us. If you correspond with us by post, we may use third parties to scan and categorise the mail and place it onto our systems, to return your documents and to bank payments. If you attend a G24 car park, your VRM will be captured via our ANPR Cameras. If there is any evidence previously submitted (by our landowner or retail or other unit customers) of criminal or anti-social behaviour linked to the VRM then our commercial partners may be notified by us of your arrival at the car park serving their premises. The information submitted by our retail etc. clients may include images and VRM and, if appropriate, further information concerning the linked criminal or anti-social behaviours.

How do we collect data?

Images of vehicles and VRMs are collected via ANPR cameras and/or attendants on-site. Where in operation, VRM data may also be collected and processed via the payment and/or terminals systems.

If you have received a parking charge and you are the registered keeper of the vehicle, as held by the relevant vehicle licensing agency, then your data has been provided by the Driver and Vehicle Licencing Agency (DVLA) or international equivalent.

If you are not the registered keeper of the vehicle, then your data has been provided by:

• A third party who has confirmed that you were responsible for the vehicle on that date;

• A third party who has confirmed that you were driving the vehicle on that date; or

• A third party who has confirmed that the vehicle was on hire or leased to you on that date.

If you no longer live at the address held by the DVLA, then your data has been provided by:

• A third party now living at the property who has confirmed that you no longer live at that address and has supplied a forwarding address; or

• A third-party credit reference agency.

If you submit an appeal or otherwise correspond with us, the data processed by us will be as provided by you within that appeal or correspondence. Where someone appeals or corresponds with us on your behalf with your authority, then the data processed will be as provided within the documentation we receive from them.

Our ANPR cameras will monitor entry and exit times of your VRM. If any evidence has been provided to us of criminal or anti-social behaviour linked to your VRM, then a notification may be sent to our relevant commercial partners when you enter a car park serving their premises. Any evidence of criminal or anti-social behaviour will be provided by our commercial partners, and this is subject to restricted parameters to ensure it is limited to only what is necessary for the prevention and detection of crime.

What if you provide sensitive data within an appeal or correspondence?

Depending upon the nature and content of your appeal or correspondence, the information or documentation provided may be classed as “special category” personal data and will therefore be considered to be more sensitive. Examples include: personal identity numbers, financial account information, information about an individual’s racial or ethnic origin, sexual orientation, political opinions, religious, philosophical or other similar beliefs, or information about an individual’s physical or mental health.

The information on the reverse of the correspondence issued by us explains that we and our processors will process any special category data provided based upon your explicit disclosure of that information.

When submitting an appeal via the website, you will also be specifically asked to provide your consent to the processing of any “special category” personal data you explicitly disclose as part of an appeal.

We will continue to process any “special category” personal data provided by you, as specified above, unless we are notified that your consent to processing has been withdrawn.

You are free to change your mind at any time and withdraw your consent. The consequence might be that we will no longer be able to consider your circumstances in full when reviewing an appeal and when considering whether further action is appropriate should a parking charge remain open.

If you wish to withdraw your consent, please contact us using the details provided below.

How will we process your data and why do we process it?

When using G24 car parks, personal data is collected and processed for the purposes of:

• Ensuring you comply with the parking terms and conditions, as displayed on signage throughout each car park, and to enforce those terms and conditions where necessary.

• Issuing a parking charge where the parking terms and conditions have been breached.

• Progressing any issued parking charge to closure or payment, which includes receipt of, reviewing and responding to appeals (both internal and with the Independent Appeals Service) and seeking payment of the parking charge amount. Recovery may include collections undertaken via the use of debt collection agents and/or legal action (where required) and / or verification of your address.

• Providing car park management services, including the prevention and detection of crime, and data analytics.

• Ensuring that anti-social/criminal behaviour is monitored and to provide our commercial partners with the opportunity to protect their retail spaces.

Our lawful bases for processing data are Performance of a Contract and Legitimate Interests.

If you are the driver of a vehicle using a G24 car park, your data is collected and processed as necessary for the performance of the parking contract. This includes ensuring you comply with the parking terms and conditions, as displayed on signage throughout each car park, and to enforce those terms and conditions where necessary.

We and our third-party processors will also process data in pursuit of our, the landowners, and the public’s legitimate interests including:

• The enforcement of breaches of the parking terms and conditions where the recipient of the parking charge was not the driver of the vehicle. Enforcement of breaches of the parking terms and conditions ensures a better overall parking experience for all users of the facilities.

• The provision of an effective appeals service, which is provided in line with the Private Parking Sector Single Code of Practice. Where the parking charge was issued in England and Wales, this includes an opportunity for all motorists to lodge an appeal with the Independent Appeals Service should their appeal to us be rejected. Progressing the parking charges we issue, either to closure or payment, supports the parking services we offer.

• The provision of an effective car park management service to improve the customer experience:

o Displaying images of vehicles on payment machines and/or terminals to assist car park users to identify their entry time and select the appropriate tariff payment.

o Sharing information with the landowner where they have agreed to provide parking permits to certain individuals (e.g. staff parking permits), or where a payment account for specified vehicles has been agreed; and

o Where necessary, to assist with the administration of the parking enforcement operation on site.

• Carrying out data analytics, including reporting on vehicle turnover, vehicle type and repeat visits.

• Providing data to the police and other security organisations to assist with the prevention and detection of crime (as appropriate).

• As part of the audit processes undertaken by the DVLA and International Parking Community.

• The safety of publicly accessible spaces and the effective deterrence of anti-social behaviour.

• To ensure the safety of staff of our commercial partners. Data may be processed at a destination outside the European Economic Area but we have implemented and ensured the safeguards required by data protection law.

Who do we share data with?

In order to enforce the parking contract where a breach has been identified and to support the legitimate interests explained above, we may share data with the following organisations:

• Vehicle licensing agencies, such as the DVLA or an international equivalent. This includes sharing data to obtain the contact name and address details of a vehicle’s registered keeper, as well as sharing for audit purposes.

• The police or other security organisations for the safety and security of car park users, and in order to prevent and detect crime.

• Vehicle hire and lease companies where they confirm that a vehicle was on hire or leased on the date that that vehicle was captured parked in breach of the parking terms and conditions.

• Other organisations such as the International Parking Community (IPC), the Independent Appeals Service (IAS) for parking events in England and Wales, Euro Parking Collection plc, landowners, managing agents, tenants, our press office or agency (where related to media/press query), and any authorised sub-contractors, such as mail service providers, business process outsourcers, credit reference agencies, collection agents, legal advisors, IT service providers, and payment service providers.

What data is processed when you submit a PR or media enquiry?

This privacy statement applies to all personal data submitted when you complete the online form.

What data do we process?

When you submit a media request, we will collect and process all the data you provide.

The data we process may include:

• Your name

• Your organisation/company name

• Your email

• Your phone number

• The details of your message



How will we process your data and why do we do it?

Personal data is collected and processed for the purpose of reviewing and responding to your enquiry.

We will process your data for the above purpose on the basis of your consent, which will be confirmed by your completion of the online form and when you tick the relevant box prior to submission.

You are free to change your mind at any time and withdraw your consent. The consequence might be that we will no longer be able to assist with your enquiry.

If you wish to withdraw your consent, please contact us using the details provided below.

Who do we share data with?

This privacy statement applies to all personal data which is submitted:

1. When you complete the online “Contact Us” form

2. When you request a case study

3. When you request a G24 brochure

What data do we process?

When you submit a commercial enquiry, we will collect and process all the data you provide.

The data we process may include:

• Your name

• Your organisation/company name

• Car park location, including town and postcode

• Your email

• Your phone number

• The details of your message

How will we process your data and why do we do it?

Personal data is collected and processed for the purposes of:

• Reviewing and responding to your enquiry

• Providing you with a brochure and/or case study via email, where requested

• Adding you to our mailing list for future relevant marketing communications

We will process your data for the purposes specified above on the basis of your consent, which will be confirmed by your completion of the online form and where you tick the relevant box before submission. You are free to change your mind at any time and withdraw your consent. The consequence might be that we will no longer be able to assist with your enquiry. If you wish to withdraw your consent for G24 to process your data, including from future marketing correspondence, please email: dataprotection@g24.co.uk with the subject line: ‘Withdraw consent’. Who do we share data with?

We may share data to support the purposes outlined above. Data may be shared with relevant personnel within G24 as well as with our press office.

What data is processed when you pay a parking charge online?

The data processed when you make payment of a parking charge online may include a VRM, a parking charge reference, email address, card number, expiry date and security code. The parking charge reference will be used for the purpose of locating the relevant parking charge to enable the payment processor to populate the payment screen with the outstanding amount payable.

Personal data may be processed on the grounds of legitimate interests to allow payments to be made and may also be processed due to it being necessary for us to process the same under a contract between you and G24.

When you pay your parking charge, you will be redirected to a separately hosted web page of the payment processor and any personal data that you supply, via the payment processor, will be collected and processed by the payment processor only for making payment. All credit/debit card payments are securely handled by the payment processors and are never stored on the G24 website. You will provide your payment card number, expiry date and security code to the payment processor. We will not be permitted access to this information, save for the status of the payment and the payment amount e.g. “paid”, “£70”, the parking charge reference, the last four numbers of the payment card and the expiry date of the payment card, to enable us to allocate the payment made to your account.

The payment processor facilitates payment card transactions that are carried out when redirected from the G24 website. The payment processor provides a payment facility only, via its own independent site. Accordingly, the payment transaction is solely between you and us, with the payment processor acting as the payment facilitator. All payments are processed in line with PCI compliance and your card details are not held or accessible by G24.

How long will we keep your data for?

There are certain reasons why we keep hold of some of your data. How long we keep your data for depends upon the type of data we hold and the purpose(s) for which it was collected and processed. We may hold some of your data with third parties, but where we do we ensure these third parties are also only keep the data only for as long as necessary and adhere to our retention and deletion policies.

We will store your personal data for no longer than necessary to support the purposes explained above.

We retain the personal data we hold about you for up to 6 years from collection in order to respond to any concerns or claims that may arise in that time. This may be extended if related correspondence or claims are on-going, or where a county court judgment has been issued in G24’s favour and remains outstanding.

If you ask us to restrict the way we process your data, or no longer want to receive marketing information from us, we will retain relevant data on suppression lists. This means that we will keep just enough data about you available to ensure that we continue to comply with your reasonable request.

Body Worn Cameras

At some of the car parks we manage, G24 use body worn cameras (BWC) to protect our Customer Service Attendants from situations where they are vulnerable to abuse and to also serve as a deterrent against threatening behaviour, assault or criminal activity. The ability to use BWCs also assists in de-escalating aggressive behaviours.

Visual and audio data can be collected by the BWC, and the legal basis for our use of this data is our legitimate interests. Our Customer Service Attendants will inform individuals that they are going to be filmed prior to activation of the BWC, unless the situation means it is not possible. Continuous recording is not permitted. Use of a BWC shall be in accordance with the law and our own internal company policies.

BWC footage may be shared with law enforcement agencies, prosecution agencies, legal representatives and third parties where appropriate and it is lawful to do so. The data will not be transferred outside of the UK. The sharing of BWC data may constitute processing of criminal offence data and G24 rely on Paragraph 10 of Schedule 1 of the Data Protection Act 2018 to prevent and detect unlawful acts against staff employed by G24.

The recorded footage is uploaded from the device after use, when it is then stored in an encrypted format on a secure server.

Any recorded footage will be retained for 30 days, before automatic deletion. Should the footage be required for evidential purposes, it will be retained until the conclusion of any proceedings in relation to the incident that resulted in a physical or verbal assault or threats of the same on one of our Customer Service Attendants.

For your legal rights in respect of such data, please see the section below, “What are your rights as a data subject?”.

What are your rights as a data subject?

Data protection law gives you the following rights. For further information, including to make a request or ask a question about your rights, please contact our Privacy Team using the details provided below.

We will review each request we receive. Under data protection law we do not have to agree with your request but if we refuse your request, we will still contact you within one month to explain why.

To access personal data.

This is commonly known as a "data subject access request" and enables you to receive a copy of the personal data we hold about you. We are required to verify your identity before passing you information and We may contact you upon receipt of your request to clarify your request. We will be unable to process your request until we have all required information.

To request that personal data is corrected if it is inaccurate.

This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

To ask that personal data be erased.

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. The right to erasure is also known as “the right to be forgotten”. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

To object to the processing of personal data.

In certain circumstances, individuals have the right to object to the processing of personal data. Any such objection must be based on your particular situation, where you want to object to processing as you feel it impacts your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. We will review each request we receive and if we refuse your request, We will inform you of the reason why We have not taken action.

To request that the processing of personal data be restricted.

This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• if you want us to establish the data's accuracy;

• where our use of the data is unlawful but you do not want us to erase it;

• where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

• you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

To request to move, copy or transfer personal data to you or to a third party.

The right to data portability allows individuals to move, copy or transfer personal data easily from one IT environment to another. This right will only apply in certain circumstances.

To be informed about the processing of personal data.

Individuals have the right to be informed about the collection and use of personal data. This information is contained within this privacy policy and within the signage located on all sites managed by us.

Rights relating to automated decision making, including profiling

Individuals have the right to be given information about such processing, request human intervention or challenge a decision. This right will only apply in certain circumstances.

How can you contact the Information Commissioner’s Office?

How can you contact G24 if you have a privacy related query? If you have any questions about our privacy policy, how we use your data or your data rights, you can contact us by emailing dataprotection@g24.co.uk.

Your query will be submitted directly to our Privacy Team.

If you submit an enquiry to us, we will process the data provided for the purpose of reviewing and responding to your enquiry. If you no longer want us to process the data provided, please contact us using the above email address and include the message ‘Withdraw consent’.

Alternatively, you can write to us with your privacy related query at:

Privacy Team

G24 Limited, PO BOX 117, Blyth, NE24 9EJ