Data Protection Officer

We have appointed a data protection officer (DPO) who is responsible for this Privacy Notice. If you have any questions about this Privacy Notice, please contact the DPO in one the following ways:

Email address: dpo@marstonholdings.co.uk

Postal address: DPO, Marston Holdings Limited, Rutland House 8th Floor, 148 Edmund Street, Birmingham, B3 2JR.

Our ICO registration number is Z1532374.

If you would like to understand or exercise your privacy rights, please see section 7 of this Privacy Notice.

Details of our internal complaints policy are set out in section 8.3.

01. What this Privacy Notice covers 

This Privacy Notice aims to give you information on the personal data we collect and process in relation to:

• This website https://www.marstonholdings.co.uk/nsl/
• Any communications you have with us.
• The services we provide to our clients.

As an outsourced provider of parking, traffic and clean air zone services, normally our clients are Data Controller as they determine the purpose of processing your personal data.

NSL Limited will normally be a Data Processor acting under a written contract with our client, Data Controller. There are occasions where we are joint or sole Data Controller.

We always establish a lawful basis for processing where we are a Data Controller. This is set out in more detail in section 2.

This Privacy Notice does not extend to the use of personal data by any other third-party websites that are linked to or from our website, whether we provide those links or whether they are shared by other users. We have no control over how your data is collected, stored or used by  third parties and we advise you to check the privacy policies of any such websites before providing any data to them.

02. Data we may collect about you and how we use it.

We may collect your personal data through various means, including via our website, email or other electronic correspondence, by telephone, by direct contact, or if you voluntarily submit it, and where we are otherwise required by law to collect personal data.

As a provider of outsourced parking services we refer to members of the public that we interact with in order to provide those services to our clients, as ‘customers’.

For example, where we issue a parking charge notice, the customer is the registered keeper of the vehicle.

The way in which we will process your personal data will depend on how we interact with you, for example, whether you are our client or a customer, and the nature of the services we are providing.

The table below explains how we process personal data for the outsourced services we deliver to clients as well as any other activities that involve processing personal data.

Outsourced Parking Services that we deliver to our clients:

Other Personal Data that we may process:

03. Special category Personal Data

UK Data Protection legislation defines certain personal data as special category data such as data regarding your ethnic origin, physical health and mental health.

When we enforce a court order on behalf of our client we have a legal obligation to understand whether customers are vulnerable so that we can apply the appropriate enforcement strategy and achieve the best outcome for the customer and our client.

If we identify potential or actual customer vulnerability, we may ask for details, however, we will never compel a customer to provide special category data and we will always ask for consent to record your personal data on our case management system.

Sometimes we receive special category data to support a customer appeal or complaint. For example, a customer may appeal against a Penalty Charge Notice on the basis that they have a serious medical condition and provide medical evidence. Where special category data is volunteered for this specific purpose, we deem that consent has been received for that specific purpose only.

We may share special category personal data with our client, as the (joint) data controller, or other members of the Marston group but only to ensure the enforcement is managed appropriately and in line with our legal obligations.

04. Protecting your information

Data security is of great importance to us and to protect your data we have put in place suitable physical, electronic and managerial controls to safeguard and secure data collected through our website or otherwise.

You should note that when using the website and our related services, your information may travel through third party infrastructures that are not under our control. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.

We use high level encryption software on our IT networks to prevent access to your personal information. Unfortunately, the internet is never a completely secure environment. Therefore, we cannot guarantee that hackers or unauthorised personnel will not gain access to your personal information despite our best efforts.

We have put in place confidentiality clauses or confidentiality agreements (including data protection obligations) with our third-party service providers and require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Notwithstanding the security measures that we take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting personal data to us via the internet.

05. How and where information is stored and how long do we hold it for?

The data that we collect from you may be transferred to, and stored at, a destination outside the UK/European Economic Area (“the EEA”) at third party suppliers (the EEA consists of all EU member states, plus Norway, Iceland and Liechtenstein).

We will only transfer your data to a recipient outside the UK/EEA where we are permitted to by law. For example:

•  Where the transfer is based on standard data protection clauses adopted or approved by the European Commission;
• Where the transfer is to a territory that is deemed adequate by the European Commission; or
• Where the recipient is subject to an approved certification mechanism and the personal data is subject to appropriate safeguards, or if an exemption applies.

We always establish a lawful basis for processing where we are the data controller, and we will only keep personal data for the minimum period necessary to perform the lawful basis for processing.

We have a system of retention periods which are regularly reviewed by the Data Protection Officer. Where your information is no longer required, we will ensure it is disposed of or deleted in a secure manner.

06. Disclosure of your information

We may share your data with other companies in our Group for the purposes described in this Privacy Notice. This includes our holding company and its subsidiaries.

We will only share personal data with third parties or within the Group for the specific purposes set out below and where we have confidentiality clauses and confidentiality agreements (including data protection obligations) in place:

a. We may also disclose your personal information to third parties in the event that we expand or reduce all or part of our business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets. If our business or substantially all of its assets are acquired by a third party, personal data held by us about our customers, clients and website users will be one of the transferred assets and the new owner or newly controlling party will, use the data for the purposes for which it was originally collected by us.

b.  We may compile statistics about the use of our website including data on traffic, usage patterns, user numbers, sales and other information. All such data will be anonymised and will not include any personally identifying information. We may, from time to time, share such data with third parties such as prospective investors, affiliates, partners and advertisers. Data will only be shared and used within the bounds of the law.

c. In certain circumstances we may be legally required to share certain data held by us, which may include your personal information, for example, for compliance purposes, where we are involved in legal proceedings, where we are complying with the requirements of legislation, a court order, or a governmental, investigative or taxation authority. We do not require any consent from you in order to share your data in such circumstances and will comply, as required, with any legally binding request that is made of us. In these circumstances we may be prevented by the police, courts, or a similar authority from pre-notification or being as transparent as with other data processing activities.

d. We may share your data in pursuing a third party’s legitimate interest. This may include situations where we are required to go beyond our specific legal obligations set in laws and regulations to assist law enforcement or private stakeholders in their efforts to combat illegal activities, such as money laundering, fraud prevention or misuse of services. However, the use of personal data in such circumstances will be restricted to data which is relevant to our services and necessary to identify you.

07. Complaints

 If you have a privacy complaint, please contact the Data Privacy Team.

There is a two-stage complaint process which includes a right of appeal to the Data Protection Officer

a. Stage One: 

Please forward your complaint plus any supporting documentation either by post or email to:

Postal address:  Data Privacy Team

Marston Holdings Limited,

Rutland House 8th Floor,  148 Edmund Street,  Birmingham,  B3 2JR

Email address:   datarequest@marstonholdings.co.uk

The Data Privacy Team take all privacy concerns seriously and will investigate the matter thoroughly.

The Data Privacy Manager or Team Leader will respond to your complaint in writing.

We aim to respond to complaints as soon as possible, but at the latest within one calendar month of receipt.

b. Stage Two

If you are unhappy with the stage one response from the Data Privacy Team you can appeal directly to the Data Protection Officer.

Please forward your appeal to dpo@marstonholdings.co.uk or alternatively write to the Data Protection Officer at the above address.

The decision of the Data Protection Officer is our final response and the end of the internal complaints process.

You have the right to raise a complaint at any time or obtain advice from the Information Commissioners Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

The ICO prefer that you exhaust our internal complaints process before you bring the matter to their attention.

We would also appreciate the chance to properly investigate the matter and report our findings back to you.

When we investigate a complaint, we may need to share personal data with the organisation you have an outstanding debt with and with other relevant bodies e.g., the Civil Enforcement Association or the Local Government Ombudsman to adjudicate on disputed complaints.

All complaints will be dealt with in strict confidence; however, we are usually required to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant does not want information identifying him or her to be disclosed, we aim to respect that. However, it may not always be possible to handle a complaint on an anonymous basis.

 08. Controlling your personal information

• When you submit information via our website, you may be given options to restrict our use of your data. In particular, we aim to give our clients and website users strong controls on our use of their data for direct marketing purposes (including the ability to opt-out of receiving emails from us, which you may do by unsubscribing using the links provided in our emails and at the point of providing your details).

• You may also wish to sign up to one or more of the preference services operating in the UK: The Telephone Preference Service the Corporate Telephone Preference Service and the Mailing Preference Service. These will help to prevent you receiving unsolicited marketing by phone/mail. Please note, however, that these services will not prevent you from receiving marketing communications that you have consented after signing up.

09. Your legal rights

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data. The rights available to you depend on our reason for processing your information and (in most cases) we have one calendar month to respond to your request:

9.1  Your right to withhold information

You may access certain areas of our website without providing any data at all. However, to use all features and functions available on our website you may be required to submit or allow for the collection of certain data.

You may restrict your internet browser’s use of Cookies. For more information, see section 11 and our Cookie Policy https://www.marstonholdings.co.uk/cookie-policy/.

9.2 Ensuring the accuracy of your information

If you believe that any data we are holding on you is incorrect or incomplete, please contact us as soon as possible using the contact details at the top of this Privacy Notice. We will promptly correct or remove any information that is incorrect.

You have the right to settle or close your customer account and request that your personal information be removed from our website or other records.

Upon the closure of your account, we are not obliged to retain your information and may delete any or all of your account information without liability unless it is specifically required for legal reasons.

If you request an account closure, we may retain basic residual information about you in our backup and/or archival copies of our database. This will be deleted in accordance with our data retention policy.

 9.3  Your right of access

You have the right to ask us for copies of your personal data. This right always applies.

There are some exemptions, which means you may not always receive any or all or the information we process. If an exemption applies, we will always explain it to you.

For example, you may not receive full copies of original documents because your right of access only covers personal information. Other information may be redacted. If it is important that you receive full copies of original documents, you may want to telephone our customer contact centre instead.

If you would like a copy of any personal information, we hold about you please complete this form. When you click submit your request will instantly be acknowledged by the Data Subject Access Team.

Privacy Web Form (onetrust.com)

You can still submit your Data Subject Access Request in writing if you prefer to our dedicated email address datarequest@marstonholdings.co.uk or verbally through our Customer Contact Centre.

9.4   Your right to rectification

You have the right to ask us to rectify data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

However, please be aware that as an outsourced provider of transportation and enforcement services much of the information we hold about you is received from our clients. Therefore, we may not be able to automatically amend personal data on request and we may instead need to work with our client or re-direct your request. For example, we cannot change the name on a court order issued to our client.

 9.5       Your right to erasure

You have the right to ask us to erase your personal data in certain circumstances.

If an exemption applies, we will always explain it to you. For example, we would not normally erase a live court order as we have a lawful basis for processing that does not rely on your consent.

 9.6       Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. If an exemption applies, we will always explain it to you.

97       Your right to object to processing

You have the right to object to processing in certain circumstances. If an exemption applies, we will always explain it to you.

9.8       Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us to another organisation or third party or give it to you. The right only applies if we are processing information based on your consent or under a contract with you and the processing is automated.

 If you would like to exercise any of your rights above, our contact details can be found at the top of this Privacy Notice.

10. Cookies

Our website may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of our website and to provide and improve our services.

By using our website, you may also receive certain third-party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than us. For more details, please refer to Our Cookie Policy: https://www.marstonholdings.co.uk/section-policy/.

11. Changes to our Privacy Notice

We may change this Privacy Notice as we may deem necessary from time to time, or as may be required by law. Any changes will be immediately posted on our website together with the version number and date. If the change in Privacy Policy materially impacts our data subjects, then we will also communicate with them directly.

We recommend that you check this page regularly to keep up to date. This Privacy Notice was last updated in June 2021.

© NSL Limited

Version 7.1

September 2021