Privacy Policy

Last updated: 12 October 2026

Who we are

This parking management system is operated by LEX Liverpool Ltd ("we", "us"), which acts as the data controller for the personal data described below. For any question about this policy, or to exercise any of the rights listed further down, contact us at dpo@lexliverpool.com.

What we collect

The data we hold depends on how you interact with the system:

• System users (staff with a login): username, display name, email address, and a securely hashed password. We never store your password in readable form.
• Vehicles & drivers: driver name, vehicle registration plate, dimensions and weight, and the company the vehicle is associated with.
• Companies: company name and, where provided, a contact email and phone number.
• Bookings: which vehicle is booked into which space and when, arrival/departure times, a contact phone number where given, and check-in/check-out timestamps.
• Public booking form: if you book a space through a shared event link without logging in, we collect your name, email address, and the vehicle/booking details listed above.
• Uploaded files: site plan PDFs and a site logo. These aren't personal data on their own.
• Technical data: our hosting provider's infrastructure logs standard web request data (e.g. IP address, timestamps) as part of running the service; we don't use this for tracking or analytics.

Why we process it, and on what basis

We process this data to operate the parking booking system: allocating spaces, managing arrivals and departures, and maintaining accurate vehicle/company records. This is necessary for our legitimate interests in running the site safely and efficiently (and, for bookings made directly with us, to perform that booking). We also keep a short-lived record of failed login attempts, which is necessary for our legitimate interest in keeping accounts secure. We do not use your data for marketing, and we do not sell or rent it to anyone.

Who we share it with

We use Railway (a cloud hosting provider) to run the application and database; our primary infrastructure is hosted in the EU (Netherlands). Railway processes data on our instructions as a data processor and may, as part of providing its service, process technical data outside the UK/EU. We don't share your data with any other third party, and we don't use advertising or analytics services on this site.

How long we keep it

We keep account, vehicle, company and booking records for as long as they're relevant to operating the site, and afterwards for a reasonable period where we have a legitimate reason to (for example, resolving a dispute about a past booking). Failed login records are kept for 15 minutes and then no longer used. If you'd like older records reviewed or removed sooner, contact us using the details above.

Cookies

This site uses a single strictly-necessary session cookie to keep you signed in, and your browser's local storage to remember your light/dark display preference. Neither is used for tracking, advertising, or analytics, so no cookie consent banner is shown.

Security

Passwords are stored using a strong one-way hash, not in readable form. The site is served over HTTPS, access to staff accounts is role-based, and we apply reasonable technical measures to protect data against unauthorised access.

Your rights

Under UK GDPR (and EU GDPR, where it applies to you), you have the right to:

• Ask what personal data we hold about you and get a copy of it (access)
• Ask us to correct inaccurate or incomplete data (rectification)
• Ask us to delete your data, where we don't have a legal reason to keep it (erasure)
• Ask us to restrict or object to certain processing
• Ask for your data in a portable format, where applicable
• Complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority

To exercise any of these, email dpo@lexliverpool.com. We'll respond within one month.

Changes to this policy

We may update this policy from time to time; the date at the top reflects the last revision.