This Privacy Notice outlines how Canterbury Christ Church University (the Data Controller) collects, uses, and protects personal data in relation to car park ticketing and the processing and issuing of parking permits. It applies to any staff member, student or member of the public who uses a University car park to park their vehicle.
We are committed to handling your personal data responsibly and transparently, in accordance with the Data Protection Act 2018 and UK General Data Protection Regulations (GDPR) and any other relevant legislation. This notice is intended to ensure you are fully informed about how your personal information is used and the rights you have in relation to it.
You can access our Data Protection Policy here.
1. What personal information do we collect about you?
When you engage with the University in relation to parking in a University car park, we collect and retain relevant personal data. This information is used for the purposes set out in Section 3 of this Privacy Notice.
We may process the following categories of personal data about you:
- Name
- Department
- Contact details
- Carer status
- Disability or health condition status
- Proof of carer, disability or health condition status
- The Vehicle Registration Plate Number of the car parked in breach of our Terms and Regulations,
- Photographs of the vehicle and
- Other personal data the University could require to demonstrate the legitimacy of a claim.
2. How do we collect your information?
The University may collect your personal data through a range of methods and sources, depending on your relationship with us and the nature of our interaction. We may collect your personal information:
- Directly from you – any correspondence you send us or any evidence you provide in relation to your claim. Through forms or correspondence such as when applying for a car park permit.
- From third parties – photographs University staff take of your vehicle in our car parks, including your registration.
3. How do we use your personal data?
The University may process your personal data for the following purposes:
- To issue you with a penalty charge notice when you breach the University car park terms and conditions
- To manage any claims raised by yourself or a third party on your behalf
- To facilitate the collection of debts owed in unpaid charges.
- To process your application and issue a permit
- Contact you in the event of an emergency or when needing to move your vehicle
- To comply with statutory and regulatory requirements, including those under the Data Protection Act 2018 and UK GDPR and the British Parking Associations Code of Conduct.
4. The lawful basis we use to process your data
Data protection law sets out reasons for collecting and processing your personal data. In this section, we outline the legal bases the University uses.
We will be processing your data under:
- Article 6(1)(b) Contract "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"
Where we process Special Category Data, we will do so under the following legal basis:
- Article 9(2)(a) Explicit consent
5. Who do we share your personal data with
We may share your personal data with trusted third-party service providers who act as data processors on our behalf. These partners are Workflow Dynamics for the purposes of processing your car park charges. We may also share your personal data with debt recovery companies, solicitors and courts in relation to unpaid charges. All third parties are required to handle your data securely and in accordance with data protection legislation.
We may also disclose your personal data where necessary to meet our legal or statutory obligations under the Data Protection Act 2018 and UK GDPR. This may include sharing information with government departments, regulatory bodies, funding agencies, or law enforcement authorities where disclosure is legally required.
Whoever we share your information with, we will only share what is relevant and necessary to perform the specific task or to meet our legal obligations.
6. How long do we keep your personal data
We retain personal data only for as long as is necessary to fulfil the purposes set out in this Privacy Notice, including to satisfy legal, regulatory, and contractual obligations. This includes our obligations under the Data Protection Act 2018 and UK GDPR.
In relation to proof of disability, health condition or carer status, evidence is deleted after your parking permit application has been processed. In relation to car park permit applications, we retain personal data for two years after the application has been processed.
In relation to car park charges, we retain personal data for six years after the payment of the charge, in line with our legal and statutory requirements for Simple Contract under the Limitation Act 1980. When identifiable records are no longer required for the purposes set out in this Privacy Notice, they are either anonymised or securely disposed of according to our Confidential Waste Policy.
7. How do we protect and store your personal information
We are committed to safeguarding the personal data we process and have robust internal policies and controls to prevent unauthorised access, accidental loss, destruction, misuse, or disclosure of personal data. Access to personal information is strictly limited to authorised University personnel who require it for the performance of their duties in connection with the management of parking permits, car park charges and claims.
Where personal data is shared with third-party processors, such parties are contractually required to act solely on our instructions, implement appropriate technical and organisational safeguards, and comply fully with the requirements of the Data Protection Act 2018 and UK GDPR.
8. The Data Controller and further information
Canterbury Christ Church University is the Data Controller for this personal data.
Please click the link below to access further information regarding:
Version Control
| Title: | Car Park Privacy Notice |
| Applicable to: | General Public |
| Process Owners: | Chief Estates Officer |
| Department responsible: | Estates & Facilities |
| Date approved: | 28th July 2026 |
| Date of review: | 28th July 2028 |
| Date last amended: | 28th July 2026 |