Privacy policy
Parka group (Parka Lausnir ehf., Parka Technologies Ltd and Parka Global Ventures Limited)
Effective 18 September 2026
Dealing with Parka on behalf of a council, operator or other business? See our Business Contacts Notice.
This policy has 3 parts. Part 1 applies to everyone. Part 2 adds information for users in the United Kingdom. Part 3 adds information for users in Iceland, Ireland and the rest of the EEA. Please read Part 1 together with the part for your territory.
Part 1: Core policy (all users)
1. Who is responsible for your data
The Parka group company responsible for your personal data (the "controller") depends on where the car park you use is located, unless your agreement with us states otherwise:
- United Kingdom: Parka Technologies Ltd, registered in England and Wales, company number 17406342, registered office 57A Broadway, Leigh-on-Sea, Essex SS9 1PE. Registered with the Information Commissioner's Office, registration ZC227117.
- Ireland and the rest of the EEA: Parka Global Ventures Limited, registered in Ireland, company number 785665, registered office Mespil House, Sussex Road, Dublin 4, D04 T4A6.
- Iceland: Parka Lausnir ehf., Icelandic company ID 480616-2270, registered office Kringlunni 4-6, 103 Reykjavík.
When we act for a car park operator. Where Parka operates cameras or collects payments on behalf of a car park operator, that operator decides why and how your data is used and is the controller. Parka acts as its processor under a data processing agreement. In plain terms: if your question is about a specific car park's rules, charges or refunds, the operator named on the signage at that car park is responsible, and Parka handles your data on its instructions. For your own Parka app account, and for everything in this policy that is not tied to a specific operator's car park, the Parka company listed above is the controller.
Contact for data protection matters: [email protected]. We respond to requests within 1 month.
2. What we collect, and where it comes from
| Category | Examples | Source |
|---|---|---|
| Vehicle data | Vehicle registration number; entry and exit times captured by camera | Read by ANPR camera, or entered by you in the app, web checkout or kiosk |
| Account data | Name, email address, phone number, chosen vehicle(s) | Provided by you when you create an account |
| Transaction data | Car park, session times, amount paid, partial card reference (never your full card or bank account number) | Generated when you park and pay; card processing is handled by our payment acquirers |
| Technical data | Device type, operating system, app version, IP address, language setting, crash logs, in app usage events | Collected automatically by the app and our websites |
| Registered keeper data | Name and address of a vehicle's registered keeper | Requested from the relevant national vehicle registry (for example the DVLA in the United Kingdom or Samgöngustofa in Iceland), only where a parking fee remains unpaid past its deadline |
| Business customer data | Company name, contact person, business contact details, billing information | Provided by you when opening a business account |
| Correspondence | Emails and support messages you send us | Provided by you |
We collect as little as possible. Paying for parking requires only your vehicle registration number. If you pay on time, we never request keeper information about you. If you use the Parka app, the app also collects the account and technical data described above.
3. Why we use your data, and our legal grounds
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the parking service: starting and ending sessions, calculating and taking payment, receipts | Vehicle, account, transaction data | Performance of a contract (Article 6(1)(b)) |
| Settling funds with car park operators (reconciliation) | Vehicle registration, session times, partial card reference | Performance of a contract, and the legitimate interests of Parka and the operator in accurate settlement (Article 6(1)(f)) |
| Recovering unpaid parking fees, including requesting keeper details | Vehicle, transaction, registered keeper data | Legitimate interests in recovering sums owed (Article 6(1)(f)); keeper requests are made under the applicable national registry framework |
| Fraud prevention and platform security | Technical, transaction data | Legitimate interests in protecting the service and its users (Article 6(1)(f)) |
| Keeping accounting and tax records | Transaction data | Legal obligation (Article 6(1)(c)) |
| Service communications about your use of Parka | Account data | Performance of a contract |
| Marketing communications (only if you opt in) | Account data | Consent (Article 6(1)(a)); you can withdraw it at any time |
| Anonymised statistics (occupancy, utilisation) | Aggregated data that can never be traced back to you | Outside data protection law once anonymised; the anonymisation step relies on legitimate interests |
| App and service improvement, analytics | Technical data | Legitimate interests (Article 6(1)(f)), and consent where required for cookies or similar technologies |
Where we rely on legitimate interests we have balanced those interests against your rights, and you can object at any time (section 8).
4. Who receives your data
We do not sell or rent your personal data, and we do not share it with anyone for their own marketing. The recipients, or categories of recipients, are:
- The operator of the car park you used: your vehicle registration number, session times and a partial card reference, for reconciliation and for handling queries about that car park.
- Payment acquirers: our acquiring partners (currently Straumur in Iceland and Adyen in the United Kingdom) process the card transaction. They receive your card details directly. Parka never holds your full card number.
- National vehicle registries: we submit requests to the relevant registry when requesting keeper details for unpaid fees.
- IT service providers (processors): hosting and infrastructure (Amazon Web Services, EU region, Ireland), email and collaboration (Google Workspace, Google Ireland Limited), work management (ClickUp Ireland Limited), shared inbox and support correspondence (Missive, Heliom Inc., United States), and app analytics (Google Analytics and Firebase, Google Ireland Limited). Each processes data only on our instructions under a data processing agreement.
- Debt recovery: Parka or the relevant operator may instruct a debt recovery provider to pursue an unpaid fee.
- Group companies: the 3 Parka companies share data between them where needed to provide and support the service (section 6).
- Authorities: police and other authorities where the law requires disclosure, or where it is requested in connection with an accident or suspected criminal act.
- Business transfers: if Parka or part of its business is merged, acquired or reorganised, your data may be transferred to the successor entity, which must honour this policy.
5. How long we keep your data
We keep personal data for no longer than the purpose requires. The periods, or the criteria we use to set them, are:
| Data | Retention period or criteria |
|---|---|
| Transaction and accounting records | 7 years in Iceland (Accounting Act No. 145/1994); 6 years from the end of the relevant financial year in the United Kingdom (HMRC requirements); 6 years in Ireland (Companies Act 2014) |
| Camera images and plate reads for a session that has been paid | Kept only as long as needed to handle card disputes, refunds and queries about that session |
| Camera images and plate reads for an unpaid or invoiced session | Kept until the fee is settled or the matter is otherwise closed, and then only as long as accounting law requires for the related record |
| Camera images not linked to any parking session or charge | Deleted on a rolling basis and not retained |
| Registered keeper data | Deleted once the unpaid fee is settled or the matter is closed |
| Account data | Kept while your account is active. When you delete your account we anonymise your personal data immediately, except where we have a legal reason to keep it under Article 17(3) (for example accounting obligations or the defence of legal claims) |
| Technical and security logs | Kept only as long as needed for security monitoring and incident investigation |
| Correspondence | Kept while needed to handle your query and any follow up, then deleted |
Parka is standardising the camera data periods above into fixed maximum retention periods across all deployments, and will publish those periods here when they are in place. Where a car park operator is the controller, its own retention instructions apply.
6. International transfers
Your data moves between the 3 Parka group companies in Iceland, the United Kingdom and Ireland. These transfers are covered by adequacy arrangements in both directions: the European Commission renewed its adequacy decisions for the United Kingdom on 19 December 2025, in force until 27 December 2031, and the United Kingdom recognises the EEA, including Iceland and Ireland, as adequate.
Some of our service providers process data in the United States, in particular Missive (Heliom Inc.) and the US entities behind Google's analytics services. For those transfers we rely on the EU-US and UK-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses with the UK International Data Transfer Addendum for UK data. You can request a copy of the relevant safeguard from [email protected].
7. Automated decisions
Parking sessions start and stop automatically when a camera reads your plate. That is how the service works and it forms part of your contract with us. Where a decision that has legal or similarly significant effects for you, in particular the decision to issue a charge for an unpaid parking fee, is made by automated means, you have the right to ask for a person to review it, to express your point of view, and to contest it. Contact [email protected] or the operator named on the car park signage. Territory specific rules on automated decision making are in Parts 2 and 3.
8. Your rights
You can, at any time and free of charge:
- Access the personal data we hold about you
- Correct inaccurate data
- Erase data we no longer need to keep
- Restrict or object to processing, including any processing based on legitimate interests
- Receive your data in a portable format where processing is based on contract or consent
- Withdraw consent at any time, where processing is based on consent, without affecting past processing
Contact [email protected] and we will respond within 1 month. You may also complain to a supervisory authority: the Information Commissioner's Office (United Kingdom), the Data Protection Commission (Ireland) or Persónuvernd (Iceland). Details are in Parts 2 and 3.
9. Security
Parka Lausnir ehf. is certified to ISO/IEC 27001:2022 (certificate 272132). Parka Technologies Ltd and Parka Global Ventures Limited operate under the same certified information security management system, with extension of the certification scope to both companies in progress, overseen by Parka's information security manager. Transfers between our systems are encrypted, access to personally identifiable information is restricted and logged, and staff are bound by confidentiality.
10. Children
Parka's services are designed for drivers and vehicle keepers and are not directed at children. You must be old enough to hold a driving licence or a payment method to use the service. We do not knowingly collect children's data. If you believe a child has provided us data, contact [email protected] and we will delete it. Territory specific age rules are in Parts 2 and 3.
11. Cookies and similar technologies
The Parka app uses Google Analytics and Firebase to understand how the app is used and to fix crashes. Our websites parka.app and parka.is use Google Analytics and show a consent banner; non essential cookies are set only with your consent, and you can change your choice at any time through the banner. The website smartparka.com sets only cookies that are strictly necessary to operate it and does not use advertising or third party analytics cookies.
12. Business contacts
If you deal with Parka as a representative of a council, a car park operator or another business, the way we handle your business contact details is described in our separate Business Contacts Notice at smartparka.com.
13. Changes and contact
This policy is published at smartparka.com/privacy and we update it there as needed. Material changes are flagged on that page. Questions: [email protected].
Part 2: United Kingdom supplement
This part adds information for users of car parks in the United Kingdom, where Parka Technologies Ltd is the controller, or processor for the relevant operator. UK data protection law is the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
- Supervisory authority: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk. Parka Technologies Ltd's registration: ZC227117.
- Keeper data: requests are made to the DVLA under its Keeper at Date of Event framework, which requires accredited trade association membership and limits use of the data to recovering the unpaid parking charge.
- Automated decision making: the Data (Use and Access) Act 2025 sets the UK framework for significant automated decisions. Where such a decision is made about you, you are entitled to safeguards including information about the decision, the right to make representations, and the right to obtain human intervention. Section 7 of Part 1 describes how this applies to parking charges.
- Subject access: we respond to access requests within 1 month. Under UK law we may conduct a reasonable and proportionate search for the information you request.
- Children: in the UK, the age at which a child can consent to information society services is 13. Our services remain not directed at children (Part 1, section 10), and we have regard to the ICO's Age Appropriate Design Code to the extent it applies.
- ANPR: our UK camera deployments follow the ICO's video surveillance guidance, including a data protection impact assessment before deployment and prominent signage at each site naming the controller.
Part 3: EEA and Iceland supplement
This part adds information for users of car parks in Iceland, Ireland and the rest of the EEA, where the EU GDPR (as incorporated into the EEA Agreement) applies, in Iceland through Act No. 90/2018 on Data Protection and the Processing of Personal Data. The controller is Parka Lausnir ehf. (Iceland) or Parka Global Ventures Limited (Ireland and the rest of the EEA).
- Supervisory authorities: Persónuvernd, Laugavegur 166, 105 Reykjavík, personuvernd.is (Iceland); Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, dataprotection.ie (Ireland). You may complain to the authority in your own EEA country.
- Keeper data: requests are made to the relevant national vehicle registry (Samgöngustofa in Iceland) under the applicable national framework.
- Automated decision making: Article 22 of the EU GDPR applies. You have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, except where necessary for your contract with us or based on your explicit consent, and in those cases you retain the right to human intervention, to express your point of view and to contest the decision.
- Children: the age of consent for information society services is 16 under the EU GDPR default, and 16 in Ireland. Iceland has set it at 13 under national law. Our services remain not directed at children.