NexusPark – Privacy Policy

Introduction

Welcome to the Privacy Policy for NexusPark.

Your privacy is of great importance to us. This Privacy Policy is designed to give you a clear explanation of how we process your personal data when use NexusPark to pay for your parking. We are committed to protecting your personal data and to keeping you informed about your privacy rights and how the law safeguards your information.

NexusPark is operated by GroupNexus, which acts as the controller of your personal data. NexusPark enables users to create a parking permit by entering their vehicle registration mark. For paid-for parking, users can then pay for their parking using a debit or credit card. Card payments will be managed by Stripe on our behalf, with users directed to the secure Stripe interface to make a payment.

Users can also extend their parking permit using NexusPark by using a link provided to them by email or text message.

1. Important information and who we are

For the purposes of the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK GDPR) and other relevant data protection laws, GroupNexus is the controller responsible for your personal data.

Purpose of this Privacy Policy

This Privacy Policy explains how GroupNexus collects and processes your personal data through your use of NexusPark, including any personal data you provide when you otherwise interact with us.

It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your data.

Changes to the Privacy Policy and your duty to inform us of any changes

We keep this Privacy Policy under regular review and may update it from time to time to reflect changes in legal requirements or our processing practices. You should regularly review this Privacy Policy for updates.

It is important that the personal data we hold about you is accurate and current. Please notify us promptly if your personal data changes during your relationship with us.

2. The data we process about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where an individual’s identity has been completely removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Contact Data: Email address for providing your receipt for parking and other contact information if you contact us with a question or complaint. There is an option for you to include a mobile number to receive an SMS for permit reminders, but this is not mandatory.

• Financial Data: Payment card details processed by our payment provider, Stripe.

• Vehicle Data: The VRM of the vehicle you register on NexusPark.

• User Analytics Data: We perform analytics on our app to better understand our customers and how they use the app. However, we do not process your personal data for analytics purposes, which is conducted anonymously.

• Marketing Data: We do not use your personal data for direct marketing purposes.

We do not process any special category data about you when you use NexusPark. Special category data includes information relating to health, race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic information, and biometric data. We also do not collect or process any data relating to criminal convictions or offences.

If you fail to provide personal data

Where we are required by law, or under the terms of a contract with you, to collect personal data and you fail to provide that data when requested, we may be unable to perform the contract we have entered into or are attempting to enter into with you, e.g., to provide access to the app or its services.

3. How is your personal data collected?

We use different methods to collect data from and about you including through:

Direct interactions. You may provide us with your personal data when you:

• Use NexusPark.
• Pay for your parking using our Stripe interface.
• Provide us with feedback or contact us.

Indirect interactions.

When you use NexusPark, you will be asked for your vehicle registration mark (VRM). At this point we will share that VRM with a provider to obtain the vehicle make, model and colour, together with a stock image of your vehicle obtained from a provider which are displayed back to you to check that you have entered the VRM correctly.

When you park at a participating car park, your vehicle VRM may be collected as part of ANPR car park management systems. This happens whether or not you use NexusPark to pay for your parking and information on the use of ANPR for car park management will be displayed on site signage and in the GroupNexus Privacy Notice here:

https://groupnexus.co.uk/privacy-policy.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where it is necessary for the performance of a contract with you (i.e., when you use NexusPark to pay for your parking) under UK GDPR Article 6(1)(b). This includes uploading parking permit requests generated in NexusPark to create a parking permit in our operational systems.

• Where processing is necessary for compliance with a legal obligation to which we are subject under UK GDPR Article 6(1)(c).

We do not share your personal data with any third party unless they are engaged to provide services on our behalf to support the operation of the app and are doing so under a contractual arrangement. Those third-party suppliers are as follows:

Stripe for collecting payment for parking on our behalf. This process involves a transfer of your personal data to the USA which is undertaken using the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as the appropriate safeguard.

A vehicle data provider for returning the make, model and colour of your vehicle from the VRM provided so you can check your VRM has been entered correctly. Vehicle Data Global only receive your VRM.

A vehicle stock image provider for returning a stock image of your vehicle using the make, model and colour of your vehicle so you can check your VRM has been entered correctly. Imagin Studios do not process your personal data.

We collect user analytics on NexusPark, but this is conducted anonymously and no personal data is processed.

We may also share your personal data with third parties in connection with a sale, transfer, or merger of part or all of our business or assets, or where we acquire or merge with another organisation. In such circumstances, the new owners may use your personal data in the same manner as described in this Privacy Policy.

We require all recipients of your personal data to respect its security and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

5. Data security

We have implemented appropriate technical and organisational security measures to minimise the likelihood of your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees and our service providers who have a business need to know. They will only process your personal data on our instructions, and they are subject to obligations of confidentiality. We have procedures in place to manage any suspected personal data breach and will notify you and any applicable supervisory authority where we are legally required to do so.

6. Data retention

How long will we use your personal data for?

We retain payment data for 6 years in line with accounting best practice. However, we may retain personal data for a longer period where reasonably necessary to comply with legal, regulatory, tax, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you. When you use our car parks, we will retain ANPR data for 26 weeks and where a penalty charge notice is issued, we will keep that data for 2 years or 6 years if it remains unpaid.

When we no longer need your personal data, we will dispose of or minimise the personal data in accordance with approved company processes to ensure all reasonable efforts and precautions are taken to protect the confidentiality of the data.

In certain circumstances, you have the right to request the deletion of your personal data. Further details on your rights are set out in the section below.

7. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These rights include the following:

Request access to your personal data.

Commonly known as making a ‘subject access request’, this enables you to receive a copy of the personal data we hold about you and to check that we are processing it lawfully.

Request correction of your personal data.

This enables you to have any incomplete or inaccurate data we hold about you corrected. We may need to verify the accuracy of the new data you provide to us. As a registered user of the app, you will be able to edit much of your own information directly.

Request erasure of your personal data.

This enables you to ask us to delete or remove personal data where there is no lawful basis for us continuing to process it. You may also request erasure where you have exercised your right to object to processing, where your data has been processed unlawfully, or where erasure is required to comply with applicable law. Please note, however, that we may not always be able to comply with an erasure request for specific legal reasons, which will be explained to you where applicable.

Object to processing of your personal data.

You may object to processing in certain circumstances where you believe it adversely affects your fundamental rights and freedoms.

Request restriction of processing of your personal data.

This enables you to ask us to suspend processing of your personal data in the following situations:

• Where you wish us to establish the accuracy of the data.
• Where you believe our use of the data is unlawful, but you do not want us to erase it.
• Where you require us to retain the data for the establishment, exercise, or defence of legal claims, even if we no longer need it for our purposes.
• Where you have objected to our use of your data and we are verifying whether we have overriding legitimate grounds to continue processing it.

Request the transfer of your personal data.

This enables you to request the transfer of your personal data to you or to a third party. We will provide the data in a structured, commonly used, and machine‑readable format. This right applies only to personal data that you provided to us where processing is based on consent or a contract and carried out by automated means.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required

You will not usually have to pay a fee to access your personal data or to exercise your other rights. However, we may charge a reasonable fee or refuse to act on a request if it is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may request specific information to confirm your identity and ensure that your personal data is not disclosed to anyone without the right to receive it. We may also contact you for additional information to help us respond more efficiently.

Time limit to respond

We aim to respond to all valid requests within one month. Where a request is complex or multiple requests have been made, it may take longer. In such cases, we will keep you informed of progress.

Complaints or queries

If you wish to make a complaint, please refer to our complaints policy:

https://groupnexus.co.uk/complaints-policy

How to contact us

If you would like more information about how we process your data or if you wish to assert any of your rights set out above, please contact our data protection officer/ privacy team by:

Email: dpo@groupnexus.co.uk

OR

Write to us at:

Data Protection Officer

GroupNexus

Jack Straws Castle

North End Way

London, NW3 7ES

This Policy was last updated on 9 July 2026.