POPLA Privacy notice

POPLA is administered by Flexible Resolution Services. Flexible Resolution Services is registered at the address of 3300 Daresbury Park, Daresbury, WA4 4HS. https://www.trustalliancegroup.org/

POPLA (the “Parking on Private Land Appeals” process, or “POPLA”), is contracted to provide dispute resolution to members of the British Parking Association (BPA). https://www.britishparking.co.uk/

POPLA takes your privacy seriously. This privacy notice tells you what to expect when POPLA collects personal information from you. It also explains how we will store and handle that data and keep it safe.

We know that there is a lot of information, but we want you to be fully informed about your rights, and how POPLA uses your personal data.

This notice is layered. So, if you wish, you can easily select the reason we process your personal information and see what we do with it.

Where we refer to your information or personal data in this policy, we mean any information about you from which you can be identified.

This privacy notice applies to information we collect about:

• visitors to the POPLA website;

• appellants, third parties, and other individuals in relation to the appeals POPLA has been asked to decide on

• people who call POPLA with telephone enquiries

• Job applicants, current and former employees

• Marketing and Communications data [your preferences in receiving marketing from us and your communication preferences]

Most of the personal information we process is provided directly by you for the purpose of an appeal or an enquiry to us. POPLA is the data processor of the personal data collected for your appeal. POPLA will only use the personal information you provide it, to administer your appeal and to provide the services you have requested from us. The information you provide will also help us direct your enquiries.

The types of personal information that we collect are only those details necessary for the consideration of your appeal. We also collect data that helps our understanding of our customers and providing the highest levels of service.

To ensure that the information we hold is accurate and up to date, please ensure that we are promptly informed of any relevant change to your contact details.

POPLA does sometimes share your data with third parties. POPLA only shares your personal data with third parties for the purpose of administering your appeal, those third parties include the named parking operator to which your appeal relates, and the British Parking Association, or where the transfer is to a secure data processor who carries out data processing operations on our behalf.

We keep our privacy notice under regular review to make sure it is up to date and accurate.

We hope the following sections will answer any questions you have but if not, please do get in touch with us.

All your personal information will be held and used in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 and any other legislation relating to the protection of personal data.

These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.

To protect the confidentiality of your personal information, we will ask you to verify your identity when contacting POPLA and before proceeding with any requests you make under this Privacy Notice.

If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act on your behalf.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

When someone visits www.popla.co.uk, we automatically collect and store the following information about your visit:

• The Internet domain (for example, 'domain.com' or 'isp.com' if you use a private Internet access account) and IP address (an IP address is a number, 'xxx.xxx.xxx.xxx', that is automatically assigned to your computer whenever you are surfing the web) from which you access our website;

• The type of browser software and operating system used to access our site;

• The date and time you access our site;

• The pages you enter, visit and exit our site from and

• If you linked to the server's domain from another website, the address of that website.

We use this information to help us identify click stream patterns, to improve our website, to learn about the number of visitors to our website and the types of technology our visitors use. This is statistical data about browsing actions and patterns and does not identify you as an individual.

We also use a third party service, Google Analytics, and Hotjar to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site.

We may collect information about your computer, including where available your IP address, operating system and browser type, this is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users' browsing actions and patterns and does not identify any individual.

Please note: We are not responsible for any use of your personal information you provide to third-party websites that may be accessed via our website or Websites. We recommend that you review the privacy policy of any third-party applications or websites that you use.

A cookie is a piece of data stored locally on your computer containing information about your activities on the Internet. Each website can send its own cookie to your web browser if your browser's preferences allow it. Many websites do this whenever a user visits their website in order to track online traffic flows.

For further information about what a cookie is and how POPLA uses them, please see the ‘cookie settings’ page of this website.

When you ask POPLA to consider an appeal, we will only request you provide the personal information that is needed to process your appeal.

When you ask us to review your appeal, you will need to provide us with some personal information, including your name, address, email address, contact number and any details relevant to the Parking Charge Notice and/or the appeal.

We require your personal information to pursue POPLA’s legitimate interest in a way which might reasonably be expected as part of our appeals process.

It is necessary to share your personal information with the parking operator which is the subject of your appeal. POPLA will request you provide authority for us to approach the parking operator to obtain information relevant to the Parking Charge Notice. This parking operator will be asked to provide us with its response to your appeal, this will include any information it holds about you from the point of issuing the Parking Charge Notice until the point you came to POPLA.

POPLA may also ask you to provide further information that would be relevant to your appeal.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

POPLA only uses the information you provide to:

• respond to your enquiry or enquiries

• consider your appeal

• comply with our reporting requirements; and

• help us to improve the quality of our services including IT improvements

• compile aggregated data

Should you wish to withdraw your appeal, you should contact POPLA.

In some specific circumstances you have the right to request that we stop processing your personal data for example, when you withdraw consent, or object and we have no legitimate overriding interest, or once the purpose for which we hold the data has come to an end.

Please note that if your appeal is active when you ask us to stop processing of your personal data, POPLA will not be able to continue to process your appeal.

We record and monitor incoming and outgoing telephone calls (if it’s not withheld). Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint. Recordings may also be used for staff training exercises, to improve the quality of our services.

The telephone calls that we record will be kept secure and subsequently deleted in a structured and organised manner. Recorded calls are kept for a period of twelve (12) months. If a call recording provides useful information or evidence that supports your appeal we may keep this as part of your appeal for a period of 6 years.

We also collect Calling Line Identification (“CLI”, also known as “caller ID”) when you contact us by telephone. This means that we will be provided with, and will record, the telephone number that you have used to contact us unless you have taken steps to withhold the number.

Any email sent to us, including any attachments, may be monitored and used by us for reasons of security and for monitoring compliance with office policy. Email monitoring or blocking software may also be used. Please be aware that you have a responsibility to ensure that any email you send to us is within the bounds of the law.

If an email provides useful information or evidence that supports your appeal we may keep this as part of your appeal for a period of 6 years.

You are able to contact us via Twitter or Facebook. Please note that we have no influence on the scope of data that is collected by these social networks through their sites. The data use policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.

We may retain some information provided via social networks if it is relevant to your complaint.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your rights include:

The right to be informed

POPLA aims to be transparent within our Privacy Policy over how we use your personal data. The Privacy Policy will also confirm how long POPLA will retain your data for.

Right of access

You have the right to request a copy of any information about that POPLA holds about you. There are some exemptions, which means you may not always receive all the information we process. For those requesting a Subject Access Request, it will be provided free of charge in most cases and within one month. Please see the section entitled “Right of access to personal information” for further information.

The right to rectification

You have the right to request the correction of your personal data when it is incorrect, out of date or incomplete. You can also contact us via yourrights@trustalliancegroup.org and we can amend inaccurate personal data, however, please note that in some circumstances we may ask for the documentary proof that the amendment is necessary. Any changes to personal data will have to be communicated to each recipient to whom the personal data has been disclosed (likely to be the parking operator that issued you with the Parking Charge Notice), unless it is impossible or disproportionate.

The right to erasure

In some circumstances you can request the erasure of your personal data. These include when holding your personal data it is no longer necessary, you withdraw consent, or you object to its processing. Some information held by POPLA is required by law to be held for a period of time. You can contact POPLA via yourrights@trustalliancegroup.org if you wish to make a request.

The right to restrict data

In some circumstances you can request that we restrict the processing of your personal data. This can be done in circumstances where we need to verify the accuracy of personal data, if you do not wish to have personal data erased or you object to the processing and we are considering this request.

The right to Data Portability

In some circumstances you can request a copy of the personal data you provided to us in a machine-readable format or you can ask that this data be transferred another third party.

The right to object

You can stop the processing of your personal data for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data.

Where your personal data is used for any marketing purposes, you can also contact POPLA via dpo@trustalliancegroup.org if you wish to stop any processing.

Automated decision making and profiling

POPLA does not make automated decisions, nor does it use profiling. POPLA will confirm to you if it undertakes Automated decision making or profiling. If it does you can request that a member of the POPLA team review any decision made solely on automated processing of your data. (i.e. where the decision has been made by a solely automated process).

Right of access to personal information

POPLA tries to be as open as it can be in terms of giving people access to their personal information. Motorists with active appeals are provided with access to a portal where they can view the evidence uploaded by the parking operator

Individuals are provided with access to a portal where they can view the evidence uploaded by the parking operator and review the personal data uploaded to the appeal. You can also find out if we hold any personal information by making a ‘Subject Access Request’ (SAR).

Should you wish to obtain a copy of the personal data that we hold on you, please send an email to us at dpo@trustalliancegroup.org.

It will assist us to process your request efficiently if you include:

• any POPLA reference numbers contained in correspondence we have sent to you;

• the names of any members of POPLA staff who you have been in contact with;

• a summary of the information you would like us to provide; and

• verification of your Identity.

There will be no fee for the first copy of information provided in response to a SAR, and we will usually send a copy of all the personal data that we hold concerning you within 30 days.

Please note that a subject access request does not entitle you to be provided with specific documents or an entire file, but rather, it entitles you to be provided with your ‘personal data’ in a clear and permanent form. There are some exemptions, which means you may not always receive all the information we process. Exemptions protect particular types of information, for example, information about how the business works. We may also remove personal information that includes personal information about someone else.

POPLA will provide the requested information via electronic means unless you request another means. Please note that POPLA may extend the timescale by a further two months if your request is particularly complex.

Explaining the legal basis we rely on:

The law on data protection sets out the different reasons for which a company may collect and process your personal data, including:

Legitimate interest: In order to consider your appeal we require your personal information to pursue our legitimate interests in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

Consent: In specific situations, we can collect and process your data with your consent, for example, when you tick a box to receive email newsletters.

When collecting your personal data, we will always make clear to you which data is necessary in connection with the particular activity.

Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Contractual obligations: In certain circumstances, we need your personal information to comply with our contractual obligations.

Legal compliance: If the law requires us to, we may need to collect and process your personal information.

We will only retain your personal information for as long as is necessary for the purpose or purposes for which we have collected it.

If you send POPLA paper documents, disks or USB’s containing information about your complaint, we will upload these securely to a digital format. The originals will then be destroyed within one month of receipt.

In some cases we will exercise discretion when necessary in destroying original documents and may keep them longer if they are not readable in a digital format.

In all cases we will retain your complaint file for a period of up to 6 years after the case has been closed.

The retention period is set at 6 years for the following reasons:

• to ensure we have dealt with all aspects of your enquiry or appeal; and

• to assist us should you or the parking operator contact us again about the matter in the future.

You have a right to contact POPLA at any time during this period to correct or amend any information you have provided to us.

We may record and/or retain anonymised information about your appeal in order to document and/or measure our own performance or the performance of the parking operators.

All personal information that we hold will be deleted at the end of a six-year period, or earlier if requested, in a structured and organised manner.

If someone contacts us regarding an issue that could potentially fall within our remit, but we do not accept the issue for consideration, we will keep the information for three years after the case has been closed.

If someone contacts us as part of an initial enquiry and does not lodge an appeal, we will keep the information for a period of 6 months.

Website Information

Retention period: 6 months

This includes

• Internal domain

• IP address

• Browser software

• Date and time accessed site

• Further website info

Telephone recordings

Retention period: 12 months

Social media contacts

Retention period: 6 months (unless forms part of the complaint details)

Paper documents, disks or USB's

Retention period: Originals kept for a period of one month unless explicitly request that they are returned during this time. Please note that we may keep them longer if they are not readable in a digital format

Appeal file

Retention period: 6 years

Survey

Trust Alliance Group has anonymised results returned to it.

POPLA has a number of protections in place to ensure that your personal data is kept secure. All of our employees understand the content of this privacy policy and are appropriately trained in data protection legal requirements.

We have been independently tested to verify its systems meets the requirements of Cyber Essentials and Cyber Essentials plus. This is a standard set by the Government having worked together with the industry to improve standards for cyber security. Cyber Essentials Plus offers a higher level of assurance through the external testing of POPLA’s cyber security approach.

We would recommend that if you are sending us USB’s or disks containing information, you consider encryption or passwords that you can provide to us separately to enable us to access the information.

In order to process your appeal, we will ordinarily need to disclose the personal information you send us to the parking operator your appeal relates to.

We may also need to disclose it to a third party, for example an independent expert or interpreters that help us with our investigation.

In some circumstances we are legally obliged to share information. If we receive a request from a regulatory body or law enforcement agency, and if permitted under GDPR and other laws, we may disclose certain personal information to such bodies or agencies.

To help us process our work we have contracts with companies who provide us with services such as IT support or translation services (if English is not your first language). We only provide third parties with the information they need to know to perform their specific services. We work closely with all the third parties to ensure that your personal data is secure and protected at all times. Our contracts with them makes it clear that they must hold it securely, abide by the principles and provisions of Data Protection, and only use it as we instruct them to. If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Sometimes we will need to share your personal data with third parties and suppliers outside the UK, such as Europe and the USA.

If we do this, we have procedures in place to ensure your data receives the same protection as if it were being processed inside the UK. For example, our contracts with third parties stipulate the standards they must follow at all times. If you wish for more information about these contracts, please contact our Data Protection Officer.

Any transfer of your personal data will follow applicable laws and we will treat the information under the guiding principles of this Privacy Notice.

When appeals are accepted by POPLA, the decision will be undertaken by a designated POPLA assessor, however, the appeal can be progressed via some automated procedures, for example the acceptance of an appeal when submitted via the website/web form and any reminder emails at significant points within the appeals process,

If your appeal is progressed using an automated process it is only done so using an appropriate mathematical and statistical procedure, for the purposes of considering your appeal and progressing it through our process.

POPLA has implemented the technical and operational measure appropriate to ensure that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised.

POPLA will advise you if your appeal is to be dealt with wholly by automated means. In instances where your appeal is wholly undertaken by automated means you have the right to ask that an employee reviews any decisions made.

When individuals apply to work at POPLA, the information they supply is used to process their application and to monitor recruitment statistics. Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau we will not do so without informing the candidate beforehand unless the disclosure is required by law.

Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We do retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.

Once a person has taken up employment with POPLA, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with POPLA has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it after a period of 7 years.

Please see the relevant dedicated privacy policies for further information.

Reviews and updates to this notice:

POPLA endeavours to keep this privacy notice up-to-date by reviewing it at intervals of not more than six months. We additionally seek to ensure it is updated promptly if we make a materially relevant alteration to our processes or practices.

POPLA encourages visitors to frequently check this page for any changes to its Privacy Policy.

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.

If you have any questions that haven’t been covered, please contact our Data Protection Officer who will be pleased to help you:

• Email us at dpo@trustalliancegroup.org

• Or write to us FAO of the Data Protection Officer

The Information Commissioner Office (ICO) regulates data protection, for further information on the Data Protection please visit the following website:

www.informationcommissioner.gov.uk

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact the ICO by calling 0303 123 1113.

Or go online to www.ico.org.uk/concerns (please note we cannot be responsible for the content of external websites)

The Freedom of Information Act 2000 (“the FOIA”) places additional obligations, over and above those set out within the GDPR and Data Protection Act 2018, upon organisations and entities that are typified as being public authorities.

POPLA is not defined as a public authority within the meaning of the FOIA and is therefore not subject to the obligations set out within it.