Privacy notice

Who is responsible for your information

Drive2park Ltd, trading as Drive2Park, is the data controller for personal information used to operate this parking marketplace. Its company number is 17529688 and its registered office is 27 Wordsworth Gardens, Aylesham, Canterbury, Kent, CT3 3LY. Contact support@drive2park.com about your information, the organisation responsible for it or this notice. This notice explains our data use; it is not a request for blanket consent.

Bookings, accounts and guest checkout

We use names, email addresses, telephone numbers, vehicle registrations where supplied, booking dates, amounts and payment status to arrange and manage parking, contact the parties and resolve booking problems. We also retain records of the legal terms accepted, their version, acceptance time and relevant account or listing reference. This processing is necessary for the booking or account service you request.

You can book as a guest. We create internal records to manage the booking and send a secure access link, without requiring a customer sign-in account. A guest email is not automatically treated as a verified sign-in account. Keep access links private.

Account authentication is provided through Supabase. We do not use plaintext passwords for customer support. Do not send a password to us or a host.

Hosts, listings, reviews and other people

Host information includes contact details, payout-account references and readiness status, EV eligibility declarations and their version/acceptance time, selected charger-access periods, parking addresses, approximate locations, photographs, prices, availability and access instructions. Public listings show listing content, the host display name and an approximate area. Exact arrival details are released to the booking parties after payment is confirmed.

We share the driver, vehicle and contact information needed for a booking with its host through the relevant booking features, and relevant host details with the driver. A host must use driver information for the booking, safety and related legal obligations, not unsolicited marketing.

Messages, support enquiries, issue reports and reviews are used to provide the service, investigate complaints and protect users. Published reviews and listing photos are public. Keep addresses, access codes and other people’s personal information out of public titles, descriptions, photos and reviews. Stripe collects identity and bank verification information directly for payout onboarding; the platform stores its account references and status.

Interest requests and partnerships

When you register interest, we collect your name, email, requested location, role, parking pattern, number of spaces and any optional details to assess and respond to the request. This does not create a booking or an account, and submissions are not treated as verified customers. Request-related processing is necessary to take steps you ask for towards a service or to pursue our legitimate interest in responding to a relevant business or hosting enquiry.

News and offer emails require the separate, optional checkbox. We record that choice, its time and the privacy version; refusing marketing does not prevent an enquiry. You can withdraw marketing consent or ask to close the request through the support contact above. No automated marketing flow is enabled by submitting this form.

Interest records are restricted to authorised administration. We aim to review inactive, unsuccessful requests for deletion after 12 months unless there is an ongoing relationship or another justified retention need; this currently requires an operator review. Abuse controls use a keyed IP-address hash rather than storing the raw address in interest records. Rate-limit buckets expire after two days and are removed on subsequent submissions. A configured security CAPTCHA may use Cloudflare Turnstile to prevent abuse.

Payments and service providers

Stripe processes payments, refunds and host payouts, including card, bank and identity-verification information submitted on its secure pages. We store payment references, amounts and status rather than full card details. Stripe also processes information for its own regulatory and fraud-prevention purposes; see Stripe’s privacy notice.

Our application uses Supabase for authentication, database and listing-photo storage; Vercel for hosting and delivery; Resend for service email; Google Places for requested address searches; OpenStreetMap tile services for maps; and externally hosted photographs, including Pexels. Browser and device providers deliver push notifications if you enable them. Providers receive the information necessary for those functions. Map, photo and hosting requests can disclose IP addresses and technical network details to the provider.

Providers may process information outside the UK. The applicable provider locations and any UK adequacy arrangements, approved contractual safeguards or other lawful transfer conditions must be considered for each service. Contact us for information about the arrangements relevant to your data and how to obtain information about safeguards.

Host tax reporting and booking evidence

For digital-platform reporting and due diligence, we collect individual hosts’ legal names, home addresses, tax residence, National Insurance numbers or other applicable tax identifiers and dates of birth; company hosts provide legal names, primary addresses and registration/tax identifiers. We record verification outcomes and restricted historical copies. Tax numbers, home addresses supplied for tax and dates of birth are not public listing information. Hosts separately provide supplier names and booking contact details; traders also provide the business contact address shown to drivers.

We process required reporting data to comply with legal obligations, share reportable information with HMRC or an authorised reporting provider, and provide hosts with the information reported about them. Reporting does not itself mean tax is owed. Necessary tax and due-diligence records are retained for applicable statutory periods, including five years after the end of the relevant digital-platform reportable period, with any longer retention justified for a legal hold or another legal obligation. Retention and erasure requests are reviewed against those duties.

We save the version and content of the booking agreement, supplier and driver details, prices, cancellation policy and acceptance time with new bookings. Confirmation emails contain the agreed terms; access instructions and exact space addresses are shared for fulfilling a confirmed booking. Restricted tax identifiers are not included in booking agreements, emails or ordinary booking responses.

Purposes and lawful bases

• Contract: creating accounts, listing spaces, quoting and fulfilling bookings, taking payments, facilitating payouts, service messages and booking support.
• Legitimate interests: proportionate security, misuse prevention, service troubleshooting, investigating complaints and protecting legal claims. Security data can include IP addresses or derived hashes, session information and technical logs. You can object to processing based on legitimate interests.
• Legal obligation: records and disclosures required by applicable accounting, tax, payment, data-protection or other law. Host information may need to be collected, verified and reported to HMRC where digital-platform reporting rules apply.
• Consent or your optional choice: optional display storage and permissions such as location or push notifications. Browser permission controls let you turn location and notifications off. Email marketing is optional and off by default. If you opt in, we record your choice, the date, the wording shown and its version. You can withdraw that choice in Your account. Essential booking, payment and account-service emails are separate.

We may also share relevant information with professional advisers or authorities where there is a lawful reason. We do not sell personal data. Automated rules help check availability, calculate prices and prevent misuse; contact support if you need a decision or booking problem reviewed by a person.

Storage, location and notifications

The cookie and display-preference policy explains essential session and guest-access storage, optional display memory and how to change it. Advertising consent is not bundled into accepting booking terms.

If you choose a location feature, your device asks for permission. Location can be used for the requested search or directions feature; you can instead enter a location manually. Push alerts require browser permission and a saved subscription endpoint. Essential booking and payment emails are separate from optional push settings.

How long we retain information

We retain information for the purposes for which it is needed, not simply because storage is available. The criteria include whether an account or booking is active, whether a complaint, payment dispute or legal claim remains open, and applicable accounting, tax and fraud-prevention obligations. Retention requirements can mean booking and financial records outlast account closure.

Account closure and erasure requests are reviewed by support; they do not trigger immediate deletion of every record. We consider what can be deleted or anonymised, what must be retained and why. Ask us for the retention criteria for a particular record. Service providers may retain records independently where required by their own legal obligations.

Your rights and complaints

Depending on the circumstances, you can request access, correction, erasure, restriction or portability, withdraw consent and object to processing. You can object to processing based on legitimate interests and to any direct marketing. Withdrawing consent does not affect processing that was lawful before withdrawal.

Contact the email above or follow our data-request and complaints procedure. You do not need an account. Requests are normally free and answered without undue delay, normally within one month, subject to lawful identity checks, clarification or extensions. A data-protection complaint will be acknowledged within 30 days and investigated without undue delay.

You can complain to the Information Commissioner’s Office. These rights have legal limits, including other people’s rights and required record retention.

Security, children and changes

We use access controls to restrict account and booking information and separate public listing information from private arrival details. No online service can promise absolute security. If you suspect an exposed access link or unauthorised access, contact support promptly.

The service is intended for adults aged 18 or over. Contact us if you believe a child’s information has been supplied inappropriately. We may update this notice when processing changes and provide further notice where required. Continued use is not treated as consent to new optional processing.

Marketplace operation counts

We keep aggregate daily counts of search requests, empty results, listing opens, direct booking links and checkout sessions created to understand whether discovery and booking work. These counters do not store visitor identifiers, IP addresses, exact locations or enquiry details. They count requests, not unique customers, and are reviewed annually for retention.