Privacy and Data Handling

AppealPilot is operated by Benjamin Bowker, a sole trader trading as "AppealPilot", based in the United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Benjamin Bowker is the data controller for the personal data described in this policy.

Contact for anything in this policy: support@appealpilot.co.uk · Phone: 07534 973480

• Identity and contact details - the registered keeper's name, postal address, and your email address;
• Vehicle and case details - vehicle registration (VRM), parking operator, location, PCN reference, and the route you selected;
• Documents you upload - your parking charge notice, Notice to Keeper, reminder letters, or photos of them. These may themselves contain personal data such as your address or photographs of your vehicle;
• Consent record - the date, time, and IP address at which you authorised us to act on your behalf;
• Payment information - payment is handled by Stripe. We never see or store your card number; we hold only the payment status and a Stripe transaction reference;
• Correspondence - emails between you and us, and correspondence with the operator about your case;
• Technical and security data - IP addresses and timestamps in security and access logs used to protect the service (for example rate limiting and admin access auditing).

We collect this directly from you, and during the case we may receive further information about you from the parking operator or an independent appeals service.

• To deliver the service - reviewing your case, drafting and submitting the appeal, corresponding with the operator, and sending you email updates. Lawful basis: performance of a contract.
• To take payment and process refunds. Lawful basis: performance of a contract.
• To keep the service secure - security logs, abuse prevention, and auditing of administrative access. Lawful basis: legitimate interests (protecting the service and customer data).
• To keep business and tax records. Lawful basis: legal obligation.
• To establish or defend legal claims if a dispute arises. Lawful basis: legitimate interests.

We do not send marketing emails, we do not sell personal data, and we do not use your data for automated decision-making or profiling.

To run your appeal: we share your details and documents with the parking operator named on your notice and, where applicable, an independent appeals service (such as POPLA or the IAS). This is the core of the service you are buying.

Service providers (processors) who handle data on our instructions under contract:

• Stripe - payment processing;
• Cloudinary - storage of uploaded documents;
• MongoDB Atlas - case database;
• Resend - transactional email delivery;
• Cloudflare - website hosting and content delivery;
• Render - application hosting.

We may also disclose data where required by law, or to professional advisers under confidentiality.

Some of the providers above process data outside the UK (for example in the United States or the EEA). Where they do, transfers are protected by UK adequacy regulations (including the UK-US Data Bridge for certified providers) or by the UK International Data Transfer Agreement / standard contractual clauses.

• Case data (documents, keeper details, correspondence) - deleted within 12 months of your case closing, unless a dispute is ongoing or you ask us to keep it longer (for example because an operator has resurfaced);
• Payment and accounting records - kept for 6 years, as required for UK tax purposes;
• Security logs - kept for up to 12 months.

You can ask us to delete your case data sooner; see section 8. We will do so unless we still need it for the purposes above.

• all connections to the service are encrypted (HTTPS);
• documents are uploaded over authenticated, signed transfers and stored with a reputable cloud provider;
• access to case data is restricted to the operator of the service, and administrative access is logged and audited;
• we collect only what the appeal needs - no accounts, no passwords, no card details held by us.

No online service can guarantee absolute security, but if we ever became aware of a breach affecting your data we would inform you and the ICO where required by law.

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to our processing in certain circumstances;
• receive your data in a portable format;
• withdraw your authority for us to act at any time (this does not affect processing already carried out).

To exercise any of these, email support@appealpilot.co.uk from the address you used with us. We respond within one month, free of charge.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113 - though we would welcome the chance to resolve any concern first.

Our website does not set analytics, advertising, or tracking cookies, and works without cookies. When you pay, you are taken to Stripe's checkout pages, which set their own cookies as described in Stripe's privacy policy.

The service is for adults dealing with their own parking charges and is not directed at anyone under 18.

We may update this policy from time to time, for example if we change providers. The current version, with its date, is always on this page; significant changes affecting an open case will be notified by email.

Benjamin Bowker, trading as AppealPilot

Email: support@appealpilot.co.uk

Phone: 07534 973480