1. Who we are

This is the privacy notice of Park4Travels Ltd (in this notice, "we", "us" or "Park4Travels"). We are a UK company, registered in England and Wales under company number 16762547. Our registered office is 20 to 22 Wenlock Road, London, N1 7GU.

Park4Travels is the data controller for the personal data described in this notice. The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection. You can reach us at hello@park4travels.co.uk or via the contact form for any data-protection question.

2. What this notice covers

This notice explains what personal data we collect when you use park4travels.co.uk, why we collect it, who we share it with, how long we keep it and what your rights are under the UK GDPR and the Data Protection Act 2018. It applies to anyone visiting our site, making a booking, signing up to our newsletter, contacting us, or applying to list a car park with us.

3. What we collect and why

3.1 When you make a booking

To take and fulfil a parking booking we need: your name, email, phone number, vehicle registration, vehicle make and colour, passenger count, outbound and return flight numbers, terminal information, drop-off and pick-up dates and times, and a record of the listing you booked.

Lawful basis: performance of a contract (UK GDPR Article 6(1)(b)). We cannot fulfil the booking without this information.

3.2 When you pay

Payments are processed by Stripe, our payment service provider. Park4Travels never sees, stores or has access to your full card number, security code or expiry date. Stripe gives us a payment-confirmation token plus minimal details (card brand, last 4 digits, country, payment status) so we can match the payment to your booking and issue refunds where due. Stripe acts as an independent data controller for the payment data; their privacy policy is at stripe.com/gb/privacy.

Lawful basis: performance of a contract.

3.3 When you contact us

If you submit our contact form or email us, we record the content of your message, your name, email and phone number, and any booking reference you provide. We use this only to respond to you and to track service standards.

Lawful basis: legitimate interests (responding to enquiries) and, where the message relates to an existing booking, performance of a contract.

3.4 When you sign up to our newsletter

We collect your email address. We use it to send occasional emails about parking deals and new content. You can unsubscribe at any time using the link in every email or by contacting us. We do not sell your email address.

Lawful basis: consent. You can withdraw consent at any time without affecting any earlier processing.

3.5 When you visit the site

Our servers automatically log your IP address, the pages you view, the URL that referred you to us, your approximate location (country, region) inferred from IP, your browser and device type, and the times of your visits. These logs are kept for 30 days for security and abuse-prevention purposes, then deleted.

Lawful basis: legitimate interests (running a secure and reliable website, diagnosing issues, preventing fraud).

4. Who we share your data with

4.1 The car park operator on your booking

To fulfil your booking we share your name, email, phone, vehicle details, flight numbers and booking reference with the named operator on the listing you selected. The operator uses this information to receive your vehicle on the day, contact you about timing, and process the parking service. Each operator is a separate data controller for the data they receive; their own privacy notice applies once your data is in their hands.

4.2 Service providers we use to run the site

We use the following third-party processors to operate Park4Travels. Each is bound by contract to process personal data only on our instructions, and only for the purpose of providing their service.

  • Stripe — payment processing. Servers in the EU and US.
  • Brevo (formerly Sendinblue) — outbound and inbound email delivery. Servers in the EU (France).
  • Hetzner Cloud — server hosting and data storage. Servers in the EU (Finland).
  • Google Search Console — site indexing diagnostics. Aggregated data only; no individual user identification.

4.3 Legal disclosures

We may disclose personal data where required by law (court order, regulator request, search warrant), or where necessary to protect our rights, prevent fraud or defend a legal claim. We will tell you when this happens unless legally prohibited from doing so.

4.4 Business transfers

If Park4Travels is acquired, merged or restructured, your data may transfer to the successor entity. We will notify you by email and on the site before any such transfer.

5. We do NOT

  • Sell, rent or trade your personal data to anyone.
  • Share your data with advertisers or ad networks.
  • Use your data for profile-based advertising or behavioural targeting.
  • Subscribe to or operate any third-party "trust mark" or "site safety" graphic that involves data sharing.

6. International data transfers

Most of our processing is in the UK and EU. Where data is processed outside the UK (for example, payment data going through Stripe's US infrastructure), we rely on the UK International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses (SCCs), whichever is applicable. These provide enforceable rights and effective legal remedies.

7. How long we keep your data

  • Booking records: 6 years from the booking date, to satisfy UK tax and accounting law (HMRC requires records to be kept for at least 6 years).
  • Contact form submissions: 2 years from the last contact, then deleted.
  • Newsletter subscriptions: until you unsubscribe.
  • Server logs: 30 days, then deleted automatically.
  • Job applications: 12 months from the application date if not hired, then deleted.

Where you ask us to delete your data sooner, we will do so to the extent we are legally permitted (some records, such as tax-relevant booking data, must be retained for the statutory minimum).

8. Your rights under UK GDPR

You have the following rights regarding the personal data we hold about you:

  • Access — ask for a copy of the data we hold about you.
  • Rectification — ask us to correct anything inaccurate or incomplete.
  • Erasure — ask us to delete your data, subject to our legal obligations to retain certain records.
  • Restriction — ask us to pause processing while a query is resolved.
  • Portability — receive a copy of your data in a structured, machine-readable format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent (e.g. newsletter), withdraw it at any time.
  • Complain to the ICO at ico.org.uk if you believe we have mishandled your data. We would prefer the chance to resolve your concern first, but you can complain to the ICO at any time without telling us.

To exercise any of these rights, email hello@park4travels.co.uk with "Privacy request" in the subject line. We will verify your identity, respond within one calendar month, and process the request free of charge in almost all cases.

9. Cookies

We use a small number of essential cookies to make the site work. We do not use advertising or tracking cookies. The cookies we set are:

  • Session cookie — keeps your booking session alive while you move between pages. Deleted when you close your browser.
  • Admin authentication cookie (admin staff only) — keeps a logged-in admin signed in for 7 days.
  • Cookie consent record — remembers whether you have accepted our cookie notice. Lasts 12 months.

Stripe sets its own cookies on the checkout page for fraud prevention and to maintain the payment session. These are necessary for payment to work; if you block them, payment will fail. See Stripe's cookie policy for detail.

You can control cookies via your browser settings (block all, block third-party only, or delete on close). Note that blocking essential cookies will prevent the booking flow from working.

10. Third-party links

Our site links to third-party websites (each operator's official site, Wikipedia for airport reference photos, Stripe for payment, gov.uk and CAA.co.uk for source citations on our blog). We do not control these sites and their privacy practices are governed by their own notices. Following a third-party link is at your own risk.

11. Children

Our service is not directed at children under 16 and we do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

12. Security

We use technical and organisational measures including HTTPS for all site traffic, hashed admin passwords, encrypted database backups, and least-privilege access controls. No security system is perfect; you can help by using a strong unique password if you have an account with us, and by reporting any suspicious activity.

13. Updates to this notice

We will update this notice from time to time, particularly when our processing activities change or when guidance from the ICO changes. The "Last updated" date at the top of the page reflects the most recent revision. Where the change is material, we will notify booked customers by email.

14. Contact

Park4Travels Ltd, 20 to 22 Wenlock Road, London, N1 7GU. Company number 16762547. hello@park4travels.co.uk · park4travels.co.uk/contact.