Privacy Policy

Published: 20 July 2026. Last updated: 27 July 2026.

This policy explains what personal data we collect through this website, why we collect it, and what your rights are. We have written it in plain English because that is how we work. If anything is unclear, email us at info@tpmcgroup.co.uk and we will explain.

Who we are

The Parking Management Consultancy Limited, trading as TPMC Group, is an independent parking advisory firm, registered in England and Wales.

• Company number: 16975568
• Registered office (our Companies House filing address): Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, Hampshire PO8 0BT
• Office (where we work and trade, and where to send post): Bridges Wharf, 4 Vicentia Court, London SW11 3GY
• Email: info@tpmcgroup.co.uk
• LinkedIn: our LinkedIn page

The two addresses above are different and serve different purposes. The Waterlooville address is our registered office and is used for statutory filings and formal service of documents. The London address is our office, the place we trade from, and it is the one to use for everyday correspondence, including anything about your personal data.

We are the “controller” of the personal data described in this policy. That means we decide why and how it is used, and we are responsible to you for it. We are registered with the Information Commissioner’s Office as a data controller. Our ICO registration reference is C1987723.

We have not appointed a data protection officer, because the law does not require us to appoint one. Data protection questions are handled by the company. Email info@tpmcgroup.co.uk, or write to us at our office address above, not at our registered office.

What we collect, and when

We only collect personal data you choose to give us, plus the minimal technical data involved in serving you these pages and in counting how often they are read.

When you send an enquiry through our forms. Our enquiry and review-request forms collect your first name, last name, email address, your organisation (an optional field on the review-request form) and whatever you write in the message box. Please include only what we need in order to respond: the message box is free text, and anything you put in it will be processed as described here.

When you book a call through Calendly. Our booking page uses Calendly. When you book, Calendly collects your name, email address, the time you choose and anything you type into the booking form, and shares those details with us so we can hold the call.

When you join our operator and supplier register. The register form on our operators page collects details about your organisation and about you as its contact: organisation name, whether you are an operator or a supplier, the categories of product or service you provide (including anything you add in the optional “other” box), your coverage area, the sectors you serve, your accreditations, your name, your email address and a short profile of the organisation. This is business contact data, held about you in your professional capacity on the supply side of the parking sector. Like our other forms, the register form is delivered by Formspree.

When you correspond with us. If you email us or message us on LinkedIn, we hold that correspondence.

When you read a page on this site. We use Vercel Web Analytics to count page views. It tells us which pages people actually read and roughly where in the world they are, and nothing more than that. It sets no cookies and stores nothing on your device. Instead of giving you an identifier to carry around, Vercel makes a temporary hash from the request your browser sends, and discards it after 24 hours. Each page view records the time, the page path, the site that referred you, filtered details from the web address, your country, region and city, your device type, operating system and browser, and the version of the analytics script. Vercel states that these records are anonymous, are not tied to any individual, customer or IP address, and cannot be used to identify or re-identify you or to follow you across other websites. We see the results as aggregate counts: we cannot tell that a particular person read a particular page. We do not use the custom event tracking Vercel offers, and our internal /deal-desk tool is excluded from analytics entirely.

Technical data. This site is hosted by Vercel. Our forms are delivered by Formspree and our booking calendar by Calendly. Like most web services, they process some technical information, such as your IP address and browser type, in order to deliver the pages to you, run the service and protect it against spam and abuse. We do not use this data to profile you.

We do not use advertising tools on this site, and we do not buy, sell or trade personal data.

Why we use your data, and our lawful basis

UK data protection law requires us to have a lawful basis for everything we do with your personal data. Here is each purpose and its basis:

Responding to your enquiry and holding the conversation you asked for. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR). You contacted us about your parking arrangement; our legitimate interest is running our advisory business by responding to the business enquiries we receive. We think this is well within your reasonable expectations: you gave us your details precisely so that we would reply. We use nothing beyond what you provided, and we use it only for that purpose, so the impact on you is minimal. You can object at any time (see “Your rights” below).

Arranging and holding a booked call. Lawful basis: legitimate interests, on the same reasoning: you asked for the call.

Assessing register entries and making introductions. If you join our operator and supplier register, we use the details you give us to assess your organisation and, where what you provide matches a client’s need, to introduce you to that client. Lawful basis: legitimate interests. You registered for exactly this purpose, and our legitimate interest is advising clients with a whole-of-market view of the supply side. Inclusion is decided on assessment, never on payment: that is our assessed, not paid principle. We use only the business details you chose to give us, so the impact on you is minimal, and you can ask us to update or remove your entry at any time.

Keeping records of correspondence. Lawful basis: legitimate interests. Keeping a sensible record of what was discussed protects both sides if there is later a dispute about what was said.

Understanding how this site is used. Lawful basis: legitimate interests. Our legitimate interest is knowing which pages are actually read, so we can write better ones and stop wasting effort on the rest. Vercel states that what it records is anonymous and cannot be linked back to an individual. We have set out a lawful basis anyway, because the safer assumption is that a short-lived hash of a request might count as personal data even if we can never connect it to a person. The balance is straightforward: we get page counts, nothing is stored on or read from your device, no profile is built, and we cannot pick you out of the numbers, so the impact on you is close to nil. If you would still rather not be counted, a tracker-blocking extension or a browser that blocks scripts will stop it, and you can tell us you object using the details below.

Complying with legal obligations, such as responding to a rights request or a lawful demand from an authority. Lawful basis: legal obligation (Article 6(1)(c)).

We do not currently rely on consent for any processing on this site, including our analytics, which needs no consent because it stores nothing on your device and reads nothing from it. We do not send marketing emails. If we start a newsletter or marketing list, it will be opt-in and this policy will be updated first.

Who we share your data with

We use three service providers (“processors”) who handle personal data on our behalf:

• Vercel Inc. hosts this website and provides our page-view analytics. Everything you send to or read from this site passes through Vercel’s infrastructure, so its servers handle technical data such as your IP address in order to deliver the pages to you.
• Formspree, Inc. delivers our website forms and forwards submissions to our inbox.
• Calendly LLC provides the booking calendar on our review page.

Each acts under its own data processing terms and only processes your data to provide its service to us.

There is one sharing that is the point of the service itself: if you have joined our operator and supplier register, we may share the details you registered, including your name and contact details, with a client we are advising where what your organisation provides matches that client’s needs. That is what the register is for, and it is the only reason we would pass your register entry on.

Beyond that, we do not share your personal data with parking operators, suppliers, marketers or anyone else, except where the law requires it or where professional advisers (such as our lawyers or accountants) need it to advise us. In particular, we do not pass enquiries from landowners or property managers to operators or suppliers. If your enquiry leads to an engagement and that work requires sharing (for example, approaching the market on your behalf), it happens under your engagement terms and with your knowledge, not under this policy.

International transfers

All three of our providers are based in the United States: Vercel Inc., which hosts this site and provides our analytics, Formspree, Inc., which delivers our forms, and Calendly LLC, which provides our booking calendar. Data you send through a form or a booking is therefore processed outside the UK, including in the United States. So is the technical data involved in serving you these pages, because the site is hosted there.

UK law allows that only where a recognised safeguard is in place. Our safeguard is contractual. For each provider we rely on the transfer terms in its data processing agreement, and specifically on the standard contractual clauses approved for transfers out of the UK, which are either:

• the International Data Transfer Agreement (IDTA); or
• the EU standard contractual clauses with the UK Addendum.

We rely on those contractual terms, and not on any certification. We do not claim that any of these providers is certified under the UK Extension to the EU-US Data Privacy Framework, and we do not rely on that framework as our safeguard. If a provider changes its transfer terms so that they no longer meet UK requirements, we will change how we use that provider or replace it.

If you want to know what safeguard applies to your data, email info@tpmcgroup.co.uk and we will tell you and point you to the provider’s current terms.

How long we keep your data

• Enquiries that do not lead to an engagement: we keep the enquiry and related correspondence for 24 months from our last contact with you, so we can pick the conversation back up if you return. At the end of those 24 months we delete it.
• Enquiries that lead to an engagement: the records become part of the client file and are kept under our engagement terms and the retention periods that apply to professional advisory records.
• Operator and supplier register entries: we keep your entry for as long as your organisation remains on the register, so we can consider it when advising clients. We review every entry at least once every 24 months. We remove an entry whenever you ask us to, and we remove it at review if we can no longer verify the organisation or its details.
• Booking data held by Calendly and form data held by Formspree are also retained under those providers’ own schedules; we delete what we control on the timescales above.
• Analytics: the temporary hash Vercel makes from a request is discarded after 24 hours. What is left is aggregate page counts in our Vercel account, which are not personal data and are not linked to anyone.

The logic: long enough to be useful to you and to us if the conversation continues, and no longer.

Your rights

UK GDPR gives you rights over your personal data. You can ask us:

• for a copy of the personal data we hold about you (access);
• to correct anything that is wrong (rectification);
• to delete your data (erasure), for example if you enquired and the conversation went nowhere;
• to limit what we do with it while a question about it is resolved (restriction);
• to object to processing based on our legitimate interests: if you object, we will stop unless we can show compelling grounds to continue;
• to receive the data you gave us in a portable format (data portability), where that right applies.

To exercise any of these, email info@tpmcgroup.co.uk. There is no fee, no form to fill in and no special wording required. We will respond within one month; if your request is complex we may extend this by up to two further months, and we will tell you if so. We may need to check you are who you say you are before acting.

Complaints

If you are unhappy with how we have handled your data, please tell us first; we would rather fix it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection, which can investigate complaints about how organisations use personal data. You can reach the ICO at ico.org.uk or on 0303 123 1113.

Cookies, and why there is no cookie banner

This site sets no cookies for analytics or advertising, and we use no tracking cookies. Embedded services, namely our Formspree forms and the Calendly booking calendar, may set cookies that are necessary for them to function and to protect against spam and abuse.

Our analytics do not use cookies either. Vercel Web Analytics works by making a temporary hash from the request your browser sends, so it stores nothing on your device and reads nothing already stored there.

That is why you are not being asked to accept cookies. The rule that produces cookie banners is regulation 6 of the Privacy and Electronic Communications Regulations. It bites where a website stores information on your device, or gains access to information already stored there, for anything other than a strictly necessary purpose. Our analytics does neither. The only cookies in play are the ones our forms and booking calendar need in order to work, and those are exempt from the consent rule. If we find that an embedded service is setting anything beyond that, we will either switch it off or ask for your consent before it runs.

We should be straight about one thing. An earlier version of this policy said we used no analytics, and promised that if we added any we would update this policy, publish a notice reflecting what is actually set, and ask for consent where the law requires it. We have now added Vercel Web Analytics, and this update is that promised change. We have told you exactly what it records, in the section above. We have not asked for your consent because, on what this tool does, the law does not require it. If we ever add something that does store or read information on your device, such as a conventional analytics or advertising cookie, we will ask for your consent first and it will be off until you give it.

Changes to this policy

If we change how we handle personal data, we will update this policy and change the date at the top. Significant changes will be flagged clearly on this page. This policy was published on 20 July 2026 and was last updated on 27 July 2026.

The 27 July 2026 update added our use of Vercel Web Analytics, named Vercel as our host as well as our analytics provider, and explained why no cookie banner is needed. Nothing about how we handle your enquiries, bookings or register entries changed.