App privacy policy

Parkalot.io (“we,” “us,” “our,” or “Parkalot”)
Last Updated: December 17, 2024

1. Introduction

This Privacy Policy explains how Parkalot.io collects, uses, processes, and protects personal data when you use our services at:

https://app.parkalot.io
https://web.parkalot.io
Parkalot app for Microsoft Teams
Parkalot iOS app
Parkalot Android app
and others

This policy applies to all users, including:

Trial users (free 30‑day period)
Administrators (organizations that manage parking, desks, rooms, EV chargers, or other workplace assets)
End users (employees, contractors, or visitors who book or use assets managed in Parkalot)

Parkalot.io resides in Europe – Poland – Kraków, 29 Listopada 180 street, Zip code: 31‑236.

2.1 Data Controller vs. Data Processor

For trial users (admins), Parkalot.io acts as Data Controller for personal data processed to operate, secure, and improve the service, and to communicate with you, as described in this Privacy Policy.
For paid subscription customers, your organization (the “Customer” or “Admin”) is the Data Controller for workplace data it configures in the service (for example, users, parking lots, desks, rooms, and bookings). Parkalot.io acts as Data Processor for that data, in accordance with the Data Processing Agreement (DPA) executed with your organization and applicable data protection law.

3. Personal Data We Collect

3.1 Data Collected from All Users

Data Type	Examples	Purpose	Legal Basis
Account identifiers	Email address, username	Account creation, authentication, system notifications	Contract (performance of the service); legitimate interest (service operation)
Credentials	Password (hashed), authentication tokens	Secure login and session management	Contract; legitimate interest (security)
Technical data	IP address, device type, OS, browser, language, time zone	Service delivery, security, fraud prevention, troubleshooting, performance monitoring	Legitimate interest (secure and reliable operation)
Usage logs	Feature usage, clicks, timestamps, error logs	Analytics, product improvement, capacity planning	Legitimate interest (service improvement)

3.2 Data Configured by Administrators

Depending on how your organization configures Parkalot, we may process additional data categories, such as:

Data Type	Examples	Purpose	Legal Basis
Profile data	Name, work email, department, role	Identifying users within the organization’s workspace	Contract (with your organization)
Vehicle data	License plate, car model, parking permit ID	Parking allocation, access control, violation management	Contract (with your organization)
Booking data	Parking, desk, room, EV charger reservations; check‑in/out times	Resource booking, usage reporting, enforcing rules set by Administrators	Contract (with your organization)
Contact details (optional)	Phone number, alternative email	Support communication, operational notifications	Contract; legitimate interest (support and operations)

Your Administrator controls which fields are mandatory or optional within the service. When Parkalot.io acts as Data Processor, these data categories are processed under the instructions of your organization.

3.3 Data Not Intentionally Collected

Payment card numbers and other payment related data (these are handled by third‑party payment providers, where applicable).

4. How We Use Personal Data

4.1 Core Purposes

Parkalot.io uses personal data to:

Provide and operate the service – including account creation, authentication, booking functionality, parking/desk/room management, and integrations with platforms such as Microsoft 365 and Teams.
Maintain security and prevent abuse – including monitoring for suspicious activity, protecting against fraud or misuse, and enforcing applicable terms.
Provide support and communicate with you – for example, to respond to support tickets, send operational messages (service status, feature changes), or inform Administrators of important account‑related updates.
Perform analytics and improve the platform – such as measuring feature adoption, diagnosing issues, testing new functionality, and optimizing performance, primarily using aggregated or pseudonymised data.
Comply with legal obligations – including record‑keeping obligations, responding to lawful requests from authorities, and enforcing legal claims.

4.2 Marketing Communications

Parkalot.io may use contact information (such as Administrator email addresses) to send information that may be relevant to your organization.

You can adjust the information we send by contacting us.

5. Subprocessors and International Data Transfers

5.1 Subprocessors

To provide and operate the service, Parkalot.io uses carefully selected third‑party service providers (subprocessors), which may process personal data on our behalf.

Current key subprocessors include:

Subprocessor	Purpose	Main Locations
Google Ireland Limited / Google LLC	Cloud infrastructure, hosting, databases, logging, analytics, email delivery	EU (Ireland), USA
Amazon Web Services, Inc. (AWS)	Cloud infrastructure and hosting services	EU, USA

Each subprocessor is bound by contractual obligations that ensure they implement appropriate technical and organisational measures to protect personal data and only process data according to Parkalot.io’s instructions.

A current list of subprocessors and their roles may be made available on request and will be updated if material changes occur.

5.2 Transfers Outside the EEA / UK

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA) and the United Kingdom, including the United States, where some of our subprocessors operate data centers.

Where such transfers occur:

Parkalot.io relies on Standard Contractual Clauses (SCCs) or other appropriate safeguards recognised under GDPR to ensure an adequate level of protection.
Additional technical and organisational measures are applied where appropriate, in line with regulatory guidance.

By using the service, you acknowledge that such international transfers may occur, subject to these safeguards.

6. Data Retention

Parkalot.io retains personal data only for as long as necessary for the purposes described in this Privacy Policy, subject to legal requirements.

Trial accounts: Data related to trial tenants may be deleted or anonymised after a reasonable period following the end of the trial if no paid subscription is activated.
Active paid accounts: Data is retained for the duration of the subscription and a limited period thereafter (for example, to allow export on termination, resolve billing matters, or meet legal obligations).
Inactive accounts: If an account has not been accessed for an extended period (for example, 12 months), Parkalot.io may classify it as inactive and may delete or anonymise associated data after prior notice, where feasible.

In some cases, data may be retained longer if required by applicable law, regulatory requirements, or in connection with the establishment, exercise, or defence of legal claims.

7. Data Subject Rights

Under GDPR and similar laws, individuals have certain rights regarding their personal data, subject to conditions and limitations in applicable law. These may include:

Right of access – to obtain confirmation whether Parkalot.io processes personal data about you and, if so, to receive a copy.
Right to rectification – to correct inaccurate or incomplete personal data.
Right to erasure – to request deletion of personal data in certain circumstances.
Right to restriction of processing – to request restriction of processing in specific situations.
Right to data portability – to receive your personal data in a structured, commonly used, and machine‑readable format, and to transmit it to another controller where technically feasible.
Right to object – to object to processing based on legitimate interests, including for direct marketing.
Right to withdraw consent – where processing is based on consent, withdrawal will not affect the lawfulness of processing before withdrawal.

7.1 How to Exercise Your Rights

To exercise your rights, contact us at:

Email: admin@parkalot.io

Please provide sufficient information to identify yourself (e.g. name, email, organization) and describe your request clearly. We may need to verify your identity before acting on the request. Parkalot.io will respond within the timeframes required by applicable law.

7.2 Requests in an Organizational Context

If your account is provided by an organization using Parkalot (for example, your employer), that organization is typically the Data Controller for your workplace data. In such cases, Parkalot.io may refer your request to the relevant organization and will act on their instructions where required under the DPA.

8. Security

Parkalot.io implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature, scope, context, and purposes of processing and the risks to individuals.

Such measures may include, among others:

Encryption of data in transit (e.g. TLS) and, where appropriate, at rest
Access controls and role‑based permissions
Secure development and deployment practices
Logging and monitoring for suspicious activity
Regular review of technical and organisational measures and internal processes

No system can be guaranteed to be completely secure. While Parkalot.io takes reasonable steps to protect data, transmission of information over the internet is at your own risk.

9. Cookies and Similar Technologies

Parkalot.io may use cookies and similar technologies (such as local storage, pixels, or tags) to:

Maintain session state and keep you logged in
Remember your preferences and settings
Perform analytics on how the service is used
Improve user experience and troubleshoot issues

Where required by law, consent will be obtained for the use of non‑essential cookies. Information about the specific cookies used may be made available via a cookie banner or separate cookie notice.

10. Third‑Party Sites and Services

The service may contain links or integrations to third‑party websites, applications, or services. This Privacy Policy does not apply to those third parties, and Parkalot.io is not responsible for their privacy practices. Users should review the privacy policies of those third parties before providing any personal data to them.

11. Data Processing Agreement (DPA)

For paid subscription customers that require Parkalot.io to act as Data Processor under GDPR or UK GDPR, Parkalot.io offers a Data Processing Agreement (DPA), which sets out:

The subject matter and duration of processing
The nature and purpose of processing
The types of personal data and categories of data subjects
The obligations and rights of the Customer (Data Controller) and Parkalot.io (Data Processor)
Requirements for confidentiality, security measures, subprocessing, international transfers, assistance with data subject rights, and breach notification.

The DPA is made available upon request and must be executed by both parties. In the event of any conflict between this Privacy Policy and an executed DPA, the DPA will generally prevail for processing carried out under that agreement.

12. Changes to This Privacy Policy

Parkalot.io may update this Privacy Policy from time to time, for example to reflect changes in services, legal requirements, or processing practices.

The “Last Updated” date at the top of this document indicates when it was last revised.
Material changes may be communicated through the service interface, by email to Administrators, or by other reasonable means.
Continued use of the service after the effective date of any changes constitutes acceptance of the updated Privacy Policy, to the extent permitted by law.

If you do not agree with changes to this Privacy Policy, you should stop using the service and, where applicable, request account deletion through your Administrator or by contacting Parkalot.io.

13. Contact Details

For questions, concerns, or requests related to this Privacy Policy or to personal data processing, contact: