Privacy Notice

1. Who is responsible for your data

The data controller is the legal operator of PCNRescue.uk shown in our Legal information. PCNRescue.uk is the trading name used for this service.

Legal operator

Jacek Woznicki

Trading name

PCNRescue.uk

Business / service address

88 Shadwell Drive

Email

jack78787812@gmail.com

For privacy questions or requests, use the public contact details in Legal information.

2. Information we collect

• Account data: name, email address, password hash, account status, login/security records and account preferences.
• Case data: PCN or parking charge documents, photographs, PDFs, vehicle registration, notice number, dates, issuing authority/operator, your description of events and other evidence you choose to provide.
• Generated case material: extracted details, AI analysis, possible points to check, missing-information prompts, appeal drafts, evidence checklists and submission guidance.
• Payment data: product purchased, amount, currency, Stripe session/payment identifiers, payment status and customer email. PCNRescue.uk does not receive or store your full card number or security code.
• Technical and security data: information reasonably necessary to operate sessions, prevent abuse, investigate faults and protect the service, such as timestamps, security events and limited server logs.
• Communications: information you provide when contacting us about support, privacy, refunds or complaints.

3. Why we use personal information and our lawful bases

We do not rely on consent for processing that is strictly necessary to provide the core service. If we introduce optional marketing or non-essential tracking, we will ask for the appropriate consent before using it.

4. Health, disability and other special-category data

Some PCN cases may genuinely require evidence such as Blue Badge or disability information. Please upload special-category data only where it is relevant and necessary for the challenge. Where such information is necessary to establish, exercise or defend legal rights in the PCN/parking-charge dispute, we process it under the applicable UK GDPR special-category condition for legal claims.

Do not upload medical records or sensitive information that is not needed for your case. You should redact unrelated information where practical.

5. Use of artificial intelligence

PCNRescue.uk uses AI to read uploaded material, extract case details, summarise the notice, identify matters worth checking and prepare draft appeal material. Relevant document content and the facts you provide may therefore be sent to an AI service provider as part of delivering the service.

The current AI provider is OpenAI through its business API. Our application requests are configured not to store application state where supported (including store=false for the Responses API). OpenAI states that API/business data is not used to train its models by default unless a customer opts in, although abuse-monitoring data can normally be retained for a limited period under OpenAI’s API data controls.

AI output can be wrong or incomplete. It does not make the legal decision on your PCN and is not used by PCNRescue.uk to make a solely automated decision that itself produces a legal or similarly significant effect. You should review important facts and deadlines before acting on a draft.

6. Who we share information with

We only share information where needed for the service, security or legal obligations. Key categories include:

• hosting and infrastructure providers that store the website, database and uploaded files;
• OpenAI for AI-assisted document analysis and drafting;
• Stripe for secure payment processing and transaction administration;
• email/service providers where needed to send verification, password, order or support messages;
• professional advisers, insurers, law-enforcement, regulators, courts or public authorities where disclosure is required or reasonably necessary by law.

We do not sell uploaded PCN documents or personal information to advertisers.

7. International transfers

Some service providers may process information outside the United Kingdom. Where UK personal data is transferred internationally, we use the transfer mechanism that applies to the provider and the transfer, such as an adequacy arrangement, the UK Extension to the Data Privacy Framework, or contractual safeguards including the UK Addendum to standard contractual clauses.

8. How long we keep information

We use a documented retention and deletion schedule. We do not keep complete PCN evidence merely because storage is available.

• unpaid or abandoned case content is normally deleted after 90 days without case activity;
• for a paid case, uploaded PCNs/evidence, case narrative, AI analysis and appeal drafts are normally kept for up to 18 months after the last case activity, then the source documents and case content are deleted or scrubbed;
• special-category information such as health/disability or Blue Badge evidence is not kept in a separate long-term archive and is not retained longer than the relevant case content;
• minimal payment, order, consent and accounting records are normally retained for 7 years from the transaction, or longer only where a tax enquiry, chargeback or legal hold requires it;
• login/rate-limit security records are kept for no more than 90 days in the normal course; expired authentication tokens are removed shortly after expiry;
• inactive accounts are reviewed after 24 months without activity. Closing an account removes the live profile/authentication data, while transaction records that must still be kept are retained separately and minimally;
• a genuine active complaint, chargeback, ICO/tax enquiry, court/tribunal matter or security incident may create a limited legal hold that temporarily overrides routine deletion.

Our current hosting plan uses rolling provider backups. Data deleted from production may remain beyond normal use until the relevant backup rotates out. If a backup is restored, retention cleanup is re-applied.

9. Your data protection rights

Depending on the circumstances and lawful basis, you may have rights to access your information, correct it, request erasure, restrict processing, receive portable data, and object to certain processing. Where processing is based on consent, you can withdraw that consent without affecting processing that was lawful before withdrawal.

A request may be refused or limited where the law permits, for example where information must be retained to comply with a legal obligation or for the establishment, exercise or defence of legal claims.

10. Security and uploaded documents

We use technical and organisational measures intended to reduce the risk of unauthorised access, including server-side access controls, protected upload storage, secure sessions, CSRF protection and restricted administrative access. No internet service can guarantee absolute security.

Only upload information relevant to the notice and make sure you are entitled to provide personal information about any other person shown in the material.

11. Cookies

The site currently uses cookies that are necessary for security, sessions and optional “keep me signed in” functionality. We do not currently run advertising or analytics cookies in the PCNRescue application. See the Cookie Policy for details. Cookie Policy.

12. Data protection complaints, the ICO and changes to this notice

If you think we have infringed data protection law, you can use our published Complaints Procedure. We provide a clear route for data-protection complaints, acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep you informed where necessary, and communicate the outcome without undue delay. Complaints Procedure.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). You do not lose that right by contacting us first.

ICO — Make a complaint

We may update this notice when the service, providers or law changes. The version date at the top identifies the notice currently in force. Material changes will be highlighted where appropriate.