Privacy policyPrivacy policy
BayPay ("we", "us") provides a pay-by-phone parking service. This policy explains what personal data we collect when you use the BayPay website, driver app, operator portal and related emails, why we collect it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller for driver accounts and the BayPay platform is [BayPay Ltd], registered in England and Wales under company number [company number], whose registered office is at [registered address]. ICO registration reference [ICO number]. You can contact our privacy team at [privacy@baypay.co.uk].
The car park operator whose site you park in is a separate controller for the parking contract itself and for any enforcement action (see section 5).
2. What personal data we collect
Information you give us
- Account details — name, email address, mobile number and a password (stored only as a salted hash).
- Vehicles in your garage — vehicle registration numbers (VRNs) and the make, model, colour, year and fuel type associated with them.
- Permit details — where an operator issues you a digital permit: your name, email and the vehicle it covers.
- Correspondence — anything you send us when you contact support.
Information created when you use BayPay
- Parking sessions — the car park, tariff chosen, start and expiry times, amount paid, receipt number and payment reference.
- Payment data — payments are processed by Rapyd. BayPay never sees or stores your full card number; we receive a payment reference, status and the amount.
- Vehicle look-ups — when you enter a VRN we query the DVLA Vehicle Enquiry Service to pre-fill make, colour, year, fuel type, tax and MOT status.
- Plate scans — operators' parking officers check registrations against the platform. Each check records the VRN, result, car park, time and officer. Where a vehicle has no valid session or permit, an enforcement record is created (see section 5).
- Location — only if you tap "Near me", and only to centre the map. Your position is used in your browser and is not stored by BayPay.
- Technical data — IP address, browser type and basic request logs kept by our hosting providers for security and reliability.
3. How and why we use your data
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account, garage and permits | Performance of a contract with you |
| Taking payment and recording your parking session so that it can be verified by the operator | Performance of a contract with you and with the operator |
| Sending receipts, expiry reminders, permit notices and password-reset codes by email | Performance of a contract / legitimate interests (you can turn expiry reminders off in your profile) |
| Pre-filling vehicle details from the DVLA | Legitimate interests — accuracy of the registration you pay against |
| Allowing operators to see which vehicles have paid, and logging unpaid parking for enforcement | Legitimate interests of BayPay and the operator in managing private land and collecting parking charges |
| Preventing fraud, abuse and misuse of the service; keeping the service secure | Legitimate interests / legal obligation |
| Accounting, statements to operators and tax records | Legal obligation |
We do not sell your personal data and we do not use it for third-party advertising.
4. Who we share your data with
- Car park operators — the operator of the car park you park in can see the registration, session times and amount for sessions at their sites, permits they have issued, and enforcement records for their sites. They do not see your card details.
- Rapyd — our payment provider, which processes your card or wallet payment under its own privacy policy.
- DVLA — the registration you enter is sent to the DVLA Vehicle Enquiry Service to retrieve vehicle details.
- Resend — the email delivery service used to send receipts and notifications.
- Google and Netlify — our application hosting and data storage providers.
- Enforcement providers — where an operator refers unpaid parking to a parking-enforcement company, the operator may pass on the VRN, time, location and details of the last paid session (section 5).
- Authorities — where required by law, court order or to protect the rights and safety of others.
Some providers store data outside the UK. Where they do, transfers are protected by the UK International Data Transfer Agreement, UK-approved standard contractual clauses or an adequacy decision.
5. Operators, plate scanning and enforcement
BayPay collects parking charges on behalf of the operator that owns or manages the car park. When you pay, your registration and session are made visible to that operator so its officers can confirm you have paid. If a vehicle is scanned with no valid session or permit (after any grace period the operator allows), BayPay records the registration, time, location, officer and the details of the vehicle's most recent paid session. The operator may export these records to its enforcement provider, which may then request the registered keeper's details from the DVLA under its own legal basis. Any parking charge notice is issued by the operator or its enforcement provider, not by BayPay; disputes about a notice should be raised with the issuer.
Operators may also keep a watchlist of registrations for their own sites (for example vehicles that have repeatedly parked without paying). Watchlist entries are visible only to that operator's staff.
6. How long we keep your data
- Account, garage and permit data — for as long as your account is open, then deleted within [90 days] of closure unless we must keep it for the reasons below.
- Parking sessions, receipts and statements — [7 years] to meet accounting and tax obligations.
- Plate-scan logs and enforcement records — [24 months], or longer while a parking charge is being pursued or disputed.
- Password-reset codes — 30 minutes. Sign-in tokens — 30 days.
- Email delivery logs — as retained by Resend under its policy.
7. Cookies and local storage
BayPay does not use advertising or analytics cookies. To keep you signed in, the site stores a sign-in token and your basic profile in your browser's local storage; it is removed when you sign out. The operator portal remembers your last-selected car park and reporting period in session storage. Map tiles are loaded from OpenStreetMap, and the address search uses OpenStreetMap's Nominatim service, both of which receive your IP address when you use the map.
8. Your rights
You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased where we have no lawful reason to keep it, to restrict or object to processing based on legitimate interests, to data portability, and to withdraw consent where processing relies on it. You can update your name, mobile number, reminder preference and vehicles at any time in your account. To exercise any other right, email [privacy@baypay.co.uk]; we respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
9. Security
Passwords are stored as salted, iterated hashes and are never sent by email. All traffic is encrypted with HTTPS. Access to the platform database is restricted to BayPay administrators, and operator staff can only see data for their own car parks. Card details are handled solely by Rapyd, a PCI-DSS Level 1 service provider.
10. Contact and changes
Questions about this policy: [privacy@baypay.co.uk] or write to [registered address]. We may update this policy from time to time; the date at the top shows when it last changed, and significant changes will be announced in the app or by email.