Personal Data Retention & Sharing Policy

1. Introduction

RMC Business Solutions Ltd ("RMC Parking", "we", "us", "our") is committed to protecting the privacy and security of personal data. This policy explains how we collect, retain, use and share personal data in connection with our private parking enforcement activities.

We are registered with the Information Commissioner's Office (ICO) and operate in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

In the course of our parking enforcement activities, we may collect and process the following categories of personal data:

• Vehicle registration marks (VRMs)
• Vehicle make, model and colour
• Keeper name and address (obtained via DVLA KADOE)
• Photographic evidence of parking contraventions
• ANPR camera data including entry and exit times
• Appeal correspondence including name, address and email address
• Payment information (processed via our payment provider)

3. Legal Basis for Processing

We process personal data on the following legal bases:

• Legitimate interests — to enforce parking restrictions and recover unpaid parking charges on behalf of our clients
• Legal obligation — to comply with applicable legislation and regulatory requirements
• Contract — where you have entered into a contractual relationship with us, such as making a payment
• Consent — where you have provided consent for a specific purpose

4. DVLA KADOE Data

We access vehicle keeper data from the DVLA's Keeper at Date of Event (KADOE) service under an agreement with the DVLA. This data is accessed solely for the purpose of issuing Parking Charge Notices and pursuing unpaid charges. We use this data strictly in accordance with the DVLA's terms and conditions of access and the British Parking Association (BPA) Code of Practice.

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to any legal or regulatory requirements:

• Active PCN records — retained for the duration of the enforcement process and for 6 years thereafter
• ANPR data — retained for up to 28 days unless linked to an enforcement event, in which case it is retained with the PCN record
• Appeal correspondence — retained for 6 years from the date of resolution
• Payment records — retained for 7 years in accordance with financial record-keeping requirements
• Photographic evidence — retained for the duration of the relevant PCN record

6. Data Sharing

We may share personal data with the following categories of recipients:

• Debt collection agencies — where a PCN remains unpaid and has been escalated to debt recovery
• Legal representatives — where legal action is required to recover an unpaid charge
• The DVLA — as required for KADOE data access compliance
• The BPA — as required under our accreditation obligations
• POPLA (Parking on Private Land Appeals) — where an appeal is escalated to the independent appeals service
• IT service providers — who assist us in operating our systems under appropriate data processing agreements

We do not sell personal data to third parties and do not transfer personal data outside the UK.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• The right to access your personal data
• The right to rectification of inaccurate data
• The right to erasure (subject to legal obligations)
• The right to restriction of processing
• The right to data portability
• The right to object to processing

To exercise any of these rights, please contact us at parking@rmc.ltd.

8. Contact & Complaints

If you have any concerns about how we handle your personal data, please contact us in the first instance:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.