Privacy Policy

Published: 20 July 2026. Last updated: 9 September 2026.

This policy explains what personal data we collect through this website, why we collect it, and what your rights are. We have written it in plain English because that is how we work. If anything is unclear, email us at info@tpmcgroup.co.uk and we will explain.

Who we are

The Parking Management Consultancy Limited, trading as TPMC Group, is an independent parking advisory firm, registered in England and Wales.

• Company number: 16975568
• Registered office (our Companies House filing address): Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, Hampshire PO8 0BT
• Office (where we work and trade, and where to send post): Bridges Wharf, 4 Vicentia Court, London SW11 3GY
• Email: info@tpmcgroup.co.uk
• LinkedIn: our LinkedIn page

The two addresses above are different and serve different purposes. The Waterlooville address is our registered office and is used for statutory filings and formal service of documents. The London address is our office, the place we trade from, and it is the one to use for everyday correspondence, including anything about your personal data.

We are the “controller” of the personal data described in this policy. That means we decide why and how it is used, and we are responsible to you for it. We are registered with the Information Commissioner’s Office as a data controller. Our ICO registration reference is C1987723.

We have not appointed a data protection officer, because the law does not require us to appoint one. Data protection questions are handled by the company. Email info@tpmcgroup.co.uk, or write to us at our office address above, not at our registered office.

What we collect, and when

We only collect personal data you choose to give us, plus the minimal technical data involved in serving you these pages and in counting how often they are read, and, only if you accept it, in Google Analytics.

When you send an enquiry through our forms. Our enquiry and review-request forms collect your first name, last name, email address, your organisation (an optional field on the review-request form) and whatever you write in the message box. Please include only what we need in order to respond: the message box is free text, and anything you put in it will be processed as described here.

When you book a call through Calendly. Our booking page uses Calendly. When you book, Calendly collects your name, email address, the time you choose and anything you type into the booking form, and shares those details with us so we can hold the call.

When you join our operator and supplier register. The register form on our operators page collects details about your organisation and about you as its contact: organisation name, whether you are an operator or a supplier, the categories of product or service you provide (including anything you add in the optional “other” box), your coverage area, the sectors you serve, your accreditations, your name, your email address and a short profile of the organisation. This is business contact data, held about you in your professional capacity on the supply side of the parking sector. Like our other forms, the register form is delivered by Formspree.

When you correspond with us. If you email us or message us on LinkedIn, we hold that correspondence.

When you read a page on this site. We use Vercel Web Analytics to count page views. It tells us which pages people actually read and roughly where in the world they are, and nothing more than that. It sets no cookies and stores nothing on your device. Instead of giving you an identifier to carry around, Vercel makes a temporary hash from the request your browser sends, and discards it after 24 hours. Each page view records the time, the page path, the site that referred you, filtered details from the web address, your country, region and city, your device type, operating system and browser, and the version of the analytics script. Vercel states that these records are anonymous, are not tied to any individual, customer or IP address, and cannot be used to identify or re-identify you or to follow you across other websites. We see the results as aggregate counts: we cannot tell that a particular person read a particular page. We do not use the custom event tracking Vercel offers, and our internal /deal-desk tool is excluded from analytics entirely.

When you accept analytics cookies. We also use Google Analytics, but only if you click Accept on the cookie banner. Until you do, no Google script is loaded and nothing is sent to Google. If you click Reject, that stays the case. If you accept, Google Analytics sets cookies on your device (named _ga and _ga_RYVSXXY73D) that give your browser a random identifier, so that repeat visits from the same browser can be counted as one visitor rather than several. It then records the pages you view and any click on a link that takes you off this site, along with the time, the page that referred you, your device type, operating system and browser, and your approximate location (country and, usually, town or city). Google states that Google Analytics 4 does not log or store your IP address: it uses it to work out that approximate location at the moment of the request and then discards it. We have switched off Google’s advertising features, Google Signals and cross-site tracking, and we have set every consent type to “denied” except the one that allows analytics cookies, which is only switched on when you accept. We use the results to see which pages are read and where visitors come from. Our internal /deal-desk tool is excluded. You can withdraw your consent at any time using the Cookie settings link in the footer (see “Cookies and the cookie banner” below). Our Cookie Policy lists every cookie this site can set.

Technical data. This site is hosted by Vercel. Our forms are delivered by Formspree and our booking calendar by Calendly. Like most web services, they process some technical information, such as your IP address and browser type, in order to deliver the pages to you, run the service and protect it against spam and abuse. We do not use this data to profile you.

We do not use advertising tools on this site, and we do not buy, sell or trade personal data.

Why we use your data, and our lawful basis

UK data protection law requires us to have a lawful basis for everything we do with your personal data. Here is each purpose and its basis:

Responding to your enquiry and holding the conversation you asked for. Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR). You contacted us about your parking arrangement; our legitimate interest is running our advisory business by responding to the business enquiries we receive. We think this is well within your reasonable expectations: you gave us your details precisely so that we would reply. We use nothing beyond what you provided, and we use it only for that purpose, so the impact on you is minimal. You can object at any time (see “Your rights” below).

Arranging and holding a booked call. Lawful basis: legitimate interests, on the same reasoning: you asked for the call.

Assessing register entries and making introductions. If you join our operator and supplier register, we use the details you give us to assess your organisation and, where what you provide matches a client’s need, to introduce you to that client. Lawful basis: legitimate interests. You registered for exactly this purpose, and our legitimate interest is advising clients with a whole-of-market view of the supply side. Inclusion is decided on assessment, never on payment: that is our assessed, not paid principle. We use only the business details you chose to give us, so the impact on you is minimal, and you can ask us to update or remove your entry at any time.

Keeping records of correspondence. Lawful basis: legitimate interests. Keeping a sensible record of what was discussed protects both sides if there is later a dispute about what was said.

Understanding how this site is used. Lawful basis: legitimate interests. Our legitimate interest is knowing which pages are actually read, so we can write better ones and stop wasting effort on the rest. Vercel states that what it records is anonymous and cannot be linked back to an individual. We have set out a lawful basis anyway, because the safer assumption is that a short-lived hash of a request might count as personal data even if we can never connect it to a person. The balance is straightforward: we get page counts, nothing is stored on or read from your device, no profile is built, and we cannot pick you out of the numbers, so the impact on you is close to nil. If you would still rather not be counted, a tracker-blocking extension or a browser that blocks scripts will stop it, and you can tell us you object using the details below.

Google Analytics. Lawful basis: consent (Article 6(1)(a) UK GDPR), because the cookies it sets need your consent under the Privacy and Electronic Communications Regulations, and where that rule applies consent is also the right basis under UK GDPR. It runs only after you click Accept, and you can withdraw at any time through the Cookie settings link in the footer. Withdrawing is as easy as accepting.

Complying with legal obligations, such as responding to a rights request or a lawful demand from an authority. Lawful basis: legal obligation (Article 6(1)(c)).

The only processing on this site that relies on consent is Google Analytics, described above. Everything else rests on the bases set out in this section. We do not send marketing emails. If we start a newsletter or marketing list, it will be opt-in and this policy will be updated first.

Who we share your data with

We use five service providers (“processors”) who handle personal data on our behalf:

• Vercel Inc. hosts this website and provides our page-view analytics. Everything you send to or read from this site passes through Vercel’s infrastructure, so its servers handle technical data such as your IP address in order to deliver the pages to you.
• Formspree, Inc. delivers our website forms and forwards submissions to our inbox.
• Calendly LLC provides the booking calendar on our review page.
• Airtable provides the private database we use as our internal contact record. We copy enquiry details (your name, organisation, email address and message) and booking details (your name, email address, the time you chose and any cancellation note) into it, alongside business contact details and our own working notes about the organisations we deal with, so we can keep track of a conversation without hunting through an inbox. It is an internal record only: nothing in it is published, access is limited to us, and we do not use it to make automated decisions about anyone.
• Google LLC provides Google Analytics, which runs only if you accept analytics cookies. Google processes the analytics data on our behalf under the Google Analytics data processing terms and uses it to provide the service to us. We have not enabled the settings that would let Google use it for its own advertising purposes.

Each acts under its own data processing terms and only processes your data to provide its service to us.

There is one sharing that is the point of the service itself: if you have joined our operator and supplier register, we may share the details you registered, including your name and contact details, with a client we are advising where what your organisation provides matches that client’s needs. That is what the register is for, and it is the only reason we would pass your register entry on.

Beyond that, we do not share your personal data with parking operators, suppliers, marketers or anyone else, except where the law requires it or where professional advisers (such as our lawyers or accountants) need it to advise us. In particular, we do not pass enquiries from landowners or property managers to operators or suppliers. If your enquiry leads to an engagement and that work requires sharing (for example, approaching the market on your behalf), it happens under your engagement terms and with your knowledge, not under this policy.

International transfers

All five of our providers are based in the United States: Vercel Inc., which hosts this site and provides our analytics, Formspree, Inc., which delivers our forms, Calendly LLC, which provides our booking calendar, Airtable, which provides our internal contact record, and Google LLC, which provides Google Analytics. Data you send through a form or a booking is therefore processed outside the UK, including in the United States, and so are the enquiry and booking details we keep in our contact record. So is the technical data involved in serving you these pages, because the site is hosted there.

UK law allows that only where a recognised safeguard is in place. We rely on two:

• For Vercel, Formspree, Calendly and Airtable, the safeguard is contractual: the standard contractual clauses approved for transfers out of the UK, in each provider’s data processing agreement, being either the International Data Transfer Agreement (IDTA) or the EU standard contractual clauses with the UK Addendum. We do not rely on any certification for these four.
• For Google, the safeguard is Google LLC’s certification under the EU-US Data Privacy Framework and its UK Extension, which the UK Government has recognised as providing adequate protection. Google’s analytics terms also include standard contractual clauses as a fallback.

If a provider changes its terms or loses its certification so that UK requirements are no longer met, we will change how we use that provider or replace it.

If you want to know what safeguard applies to your data, email info@tpmcgroup.co.uk and we will tell you and point you to the provider’s current terms.

How long we keep your data

• Enquiries that do not lead to an engagement: we keep the enquiry and related correspondence for 24 months from our last contact with you, so we can pick the conversation back up if you return. At the end of those 24 months we delete it.
• Enquiries that lead to an engagement: the records become part of the client file and are kept under our engagement terms and the retention periods that apply to professional advisory records.
• Operator and supplier register entries: we keep your entry for as long as your organisation remains on the register, so we can consider it when advising clients. We review every entry at least once every 24 months. We remove an entry whenever you ask us to, and we remove it at review if we can no longer verify the organisation or its details.
• Booking data held by Calendly and form data held by Formspree are also retained under those providers’ own schedules; we delete what we control on the timescales above.
• The copies held in our Airtable contact record follow the same periods as the originals: when we delete an enquiry or a booking, we delete it there too.
• Analytics: the temporary hash Vercel makes from a request is discarded after 24 hours. What is left is aggregate page counts in our Vercel account, which are not personal data and are not linked to anyone.
• Google Analytics: the cookies last two years on your device unless you delete them or withdraw consent, in which case we delete them. Event data in our Google Analytics property is kept for 2 months, the shortest period Google offers, and then deleted by Google. Aggregate reports with no identifier attached may persist beyond that. Google’s own handling of the data is governed by the Google Analytics data processing terms.

The logic: long enough to be useful to you and to us if the conversation continues, and no longer.

Your rights

UK GDPR gives you rights over your personal data. You can ask us:

• for a copy of the personal data we hold about you (access);
• to correct anything that is wrong (rectification);
• to delete your data (erasure), for example if you enquired and the conversation went nowhere;
• to limit what we do with it while a question about it is resolved (restriction);
• to object to processing based on our legitimate interests: if you object, we will stop unless we can show compelling grounds to continue;
• to receive the data you gave us in a portable format (data portability), where that right applies.

To exercise any of these, email info@tpmcgroup.co.uk. There is no fee, no form to fill in and no special wording required. We will respond within one month; if your request is complex we may extend this by up to two further months, and we will tell you if so. We may need to check you are who you say you are before acting.

Complaints

If you are unhappy with how we have handled your data, please tell us first; we would rather fix it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection, which can investigate complaints about how organisations use personal data. You can reach the ICO at ico.org.uk or on 0303 123 1113.

Cookies and the cookie banner

A cookie is a small text file a website stores on your device so it can recognise your browser later. The law that governs cookies is regulation 6 of the Privacy and Electronic Communications Regulations. It says we may not store information on your device, or read information already there, without your consent, unless doing so is strictly necessary to provide something you have asked for. Analytics cookies are not strictly necessary, so we ask first.

The banner. When you first visit, a banner asks whether you will accept analytics cookies. There are two buttons, Accept and Reject, and neither is favoured over the other. Nothing from Google is loaded until you choose, and nothing at all is loaded if you reject. You can ignore the banner and keep reading: doing nothing means no analytics cookies are set.

What Accept does. It allows Google Analytics to run and to set the cookies described in “What we collect, and when”. It allows nothing else. We do not use advertising cookies on this site, and the banner cannot switch any on.

What Reject does. No Google script is loaded, no Google Analytics cookie is set, and nothing is sent to Google. The site works exactly the same either way.

The consent cookie. Whichever you choose, we store your choice in a single first-party cookie so that we do not ask you again on every page. It holds only your choice and the date you made it. It lasts 12 months, after which the banner will appear again.

Changing your mind. Click Cookie settings in the footer of any page. The banner reopens and you can switch from Accept to Reject, or the other way, whenever you like. If you withdraw consent, we stop loading Google Analytics from that moment and we delete the Google Analytics cookies on this site’s domain. Withdrawing does not affect what was lawfully collected while your consent stood, but that data is deleted from Google Analytics on the retention timescale in “How long we keep your data”. You can also delete cookies through your browser settings at any time.

Cookies we do not ask about. Our Formspree forms and the Calendly booking calendar may set cookies that are needed for them to work and to protect against spam and abuse. Those are strictly necessary and exempt from the consent rule. Vercel Web Analytics, our other page counter, sets no cookies at all and stores nothing on your device, which is why it is not covered by the banner. If we find that an embedded service is setting anything beyond what it needs, we will either switch it off or ask for your consent before it runs.

The full list of cookies, with their purpose and lifetime, is in our Cookie Policy.

Changes to this policy

If we change how we handle personal data, we will update this policy and change the date at the top. Significant changes will be flagged clearly on this page. This policy was published on 20 July 2026 and was last updated on 9 September 2026.

The 9 September 2026 update added Google Analytics, which runs only if you accept it on the new cookie banner, named Google as a provider, added consent as the lawful basis for that analytics, and replaced the section that explained why there was no cookie banner with one that explains the banner we now have. We also published a separate Cookie Policy. Nothing about how we handle your enquiries, bookings or register entries changed. Earlier versions of this policy said that if we ever added a tool that stores or reads information on your device, it would be off until you gave consent. That is what we have done.

The 18 August 2026 update named Airtable as the provider of our internal contact record, and set out what we keep there and for how long. We collect nothing new from you as a result: it is the same enquiry and booking details, held somewhere we can find them.

The 27 July 2026 update added our use of Vercel Web Analytics, named Vercel as our host as well as our analytics provider, and explained why no cookie banner is needed. Nothing about how we handle your enquiries, bookings or register entries changed.