PayParq Privacy Policy

1. Types of Personal Data We Collect

Depending on your interaction with PayParq, we may collect the following types of personal data:

2. How We Collect Personal Data

We collect data in three ways:

• Directly from you: Account creation, surveys, purchases, emails, customer support, or app interactions.
• Automatically: Cookies (including Google Analytics on the website), website logs, and ANPR systems.
• From third parties: Business and operating partners, hotels, and payment processors.

3. Legal Bases for Processing (GDPR)

We process personal data under the following legal bases:

• Consent: When you voluntarily provide personal information or opt in.
• Contractual necessity: To provide our Services or fulfill agreements with you.
• Legal obligation: To comply with applicable laws.
• Legitimate interests: To operate our Services, prevent fraud, secure facilities, or improve user experience.
• Vital interests: To protect individuals in emergencies.

4. How We Use Your Data

PayParq uses personal data to:

• Operate, maintain, and improve Services.
• Facilitate account and payment management.
• Communicate with users about their accounts, support, or marketing (where permitted).
• Conduct analytics to understand how the website is used and improve the Services.
• Prevent fraud, enforce rules, and maintain security.
• Comply with legal obligations and resolve disputes.

5. How We Share Personal Data

We may share data with:

• Service Providers (processors): Supabase (database and accounts), Vercel (hosting), Stripe (payments), Resend (e-mail delivery), Google (maps and website analytics) and Sentry (error monitoring on EU servers: technical error data and the IP address of the affected device, kept up to 90 days). Each processes data only on our instructions under a data processing agreement.
• Business Customers: Hotels or facilities where PayParq operates. Each customer may have separate privacy policies.
• Affiliates & Corporate Partners: Parent and subsidiary companies.
• Legal Authorities: As required by law or to enforce our rights.
• Corporate Transactions: In case of merger, acquisition, or insolvency.

We never sell data outside of legal obligations.

6. Cross-Border Data Transfers

Some of the providers listed in Section 5 (Vercel, Stripe, Resend, Google) may process data in the USA. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

7. Retention of Personal Data

PayParq retains personal data only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, or enforce agreements, except where otherwise specified below.

• Account and member data: kept while your account exists. You can delete your account at any time; accounts with no activity for 5 years are deleted after an e-mail warning 30 days in advance.
• Booking contact data (name, e-mail, phone, licence plate): for members, kept as part of the account's booking history while the account exists; for bookings without an account, anonymised 2 years after the booking ends, unless needed for an open claim or dispute.
• Accounting records (invoices, amounts, dates): 11 years, as required by Croatian accounting law, without contact details beyond what the law requires.
• ANPR data: retained for the duration of membership for members; deleted on request for non-members; 10 years for unpaid citations.
• Enforcement evidence photos: deleted 90 days after a case is paid, written off, or marked invalid; the case record is kept as required for accounting and audit.
• Other personal data: As required to comply with law or internal policies.

Financial and payment data is stored in accordance with legal, tax, and accounting requirements. Data processed via third-party providers is subject to their retention policies. PayParq regularly reviews personal data to ensure it is accurate and up to date. Data that is no longer needed for its intended purpose is securely deleted or anonymized.

8. Your Rights (GDPR)

You have the following rights under EU law:

• Access & Portability: Request a copy of your personal data.
• Correction: Correct inaccurate data.
• Deletion / Right to be forgotten: Request data deletion.
• Restriction of processing: Limit how your data is used.
• Objection: Object to marketing or profiling.
• Withdraw consent: Where processing is consent-based.
• Data portability: Receive data in structured, machine-readable format.

Requests can be sent to payparq@outlook.com, or use the "My data / delete me" form on this page. We will respond within 30 days. You also have the right to lodge a complaint with the Croatian supervisory authority, AZOP (azop.hr).

9. Cookies and Tracking

PayParq uses:

• Necessary cookies and storage to run the site (language, sign-in, booking in progress). These do not require consent.
• Analytics cookies (Google Analytics) on the website, to see which pages are visited, where visitors come from (e.g. a search engine or a link), approximate country/city, device and browser type. Google Analytics does not store IP addresses; we do not use it for advertising and do not combine it with your booking data. The mobile app does not use Google Analytics.

We do not use advertising cookies or session recording. You can opt out of Google Analytics at any time with Google's browser add-on (tools.google.com/dlpage/gaoptout) or by blocking or deleting cookies in your browser settings.

11. Children

Our Services are not intended for persons under 18 years. We do not knowingly collect data from children under this age.

12. Data Security

We implement state-of-the-art security measures, including:

• Encryption at rest and in transit.
• Role-based access controls.
• Audit logs for ANPR and sensitive data.
• Regular security testing and penetration tests.

13. Marketplace Platform & Operating Partners

PayParq is a technology marketplace that connects drivers with parking locations. PayParq itself does not physically operate the parking sites: on-site operations, staffing, access control, shuttle transfers and day-to-day management are carried out by independent operating partners (lot owners, managed-lot operators and service providers) under contract with PayParq.

To deliver a booking, PayParq shares the minimum personal data required (for example your name, vehicle registration plate, and booking window) with the operating partner responsible for the location you selected. Those partners act as independent controllers or as our processors, depending on the activity, and are contractually bound to process your data only for the purpose of fulfilling your booking and to keep it confidential and secure. A list of the operating partner for any given location is available on request.

14. Parking Enforcement Data

Where a location uses PayParq for enforcement, parking there without a valid booking, ticket or permit, or beyond the permitted time, gives rise to a parking charge under the terms posted at that location. PayParq is a private service provider and is not a public authority; a parking charge is a contractual charge, not a governmental fine.

For each case we record the vehicle registration plate, the time and place, and photographs of the vehicle. Before a charge is issued, the case is checked against bookings and permits for that location and reviewed by a person. Charges can be paid, queried or appealed online.

If a charge remains unpaid, the claim is handed to our lawyer. For each individual case, the lawyer requests the registered keeper's details from the Ministry of the Interior on the basis of a notarial certificate of the claim. We do not carry out bulk or automated searches of vehicle registers. The keeper is then contacted in writing, with information on this processing, the source of the data and how to pay or object; if the claim is still unpaid it may be pursued through a notary or the courts.

The legal bases are our legitimate interest in recovering sums owed for parking and the establishment, exercise or defence of legal claims (Art. 6(1)(f) GDPR). Enforcement data is shared only as needed with our lawyer, notaries, the Ministry of the Interior (for the individual request above), courts, postal and payment providers. Cases for vehicles that had a valid booking or permit are discarded with their photos; other enforcement data is kept only for as long as needed to pursue or defend the claim and then deleted or anonymised.

You may query or appeal a charge, or exercise your data-protection rights, through the contact details in section 18.

15. PayParq Membership

When you complete a purchase through PayParq you automatically become a PayParq member. We create and maintain a member account associated with your contact details so we can deliver your booking, provide receipts and passes, offer support, operate loyalty and returning-customer features, and send service communications. The legal basis is the performance of your contract and our legitimate interest in operating the membership; marketing communications are sent only with your consent, which you can withdraw at any time.

16. Business Development & Prospective Partner Data

To develop new parking supply, PayParq prepares non-binding draft proposals for prospective locations and businesses. For this we process only publicly available business information — such as business name, address, publicly listed contact details, publicly posted images, and location data — obtained from public listings, maps, directories and the public web. We do not process special-category data for this purpose.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in business-to-business outreach and preparing conceptual proposals. Draft proposals are a first, non-binding stage; any deeper integration, listing, or data sharing happens only after the prospective partner confirms interest and a formal agreement is signed. Images and materials are shown as illustrative, remain the property of their owners, and imply no affiliation or endorsement.

Prospective-partner data is retained only as long as needed for outreach and is deleted if there is no interest. If you are a business featured in a draft proposal, you may object, or request access, correction or removal of your data or images at any time by contacting us — we action such requests promptly.

17. Changes to This Privacy Policy

We may update this Policy. All updates will be posted here, with an updated effective date at the top of this page.

18. Contact Us

For privacy inquiries or concerns:

Data Controller:

Indirektno, Obala Kneza Domagoja 52, 21322 Brela

OIB: 83928715622

Republic of Croatia

Email: payparq@outlook.com

Supervisory authority: AZOP (Agencija za zaštitu osobnih podataka), Croatia.

19. Addendum — Proposed Parking Locations & Parking Providers

1. Proposed Parking Locations

PayParq may display proposed, preliminary, or unverified parking locations on its website or other services for informational, promotional, and demand-testing purposes.

The publication of such a location does not necessarily mean that PayParq has entered into a commercial agreement with the owner or operator of the location.

Where information relating to a parking owner, operator, representative, or other individual is collected in connection with a proposed location, PayParq may process such personal data for legitimate business purposes, including:

• communicating with the relevant person;
• evaluating and verifying the parking location;
• discussing potential cooperation;
• preparing or improving a potential listing;
• responding to enquiries;
• assessing customer demand;
• onboarding the location if cooperation proceeds; and
• maintaining records of business communications and potential commercial relationships.

2. Public Display

PayParq generally does not publicly display personal contact details of prospective parking owners or operators on proposed-location pages.

A proposed location may contain general information such as its approximate location, photographs, parking characteristics, indicative pricing, or other non-personal information.

Where a proposed location is not available for online booking, users may be directed to contact PayParq to request confirmation of current availability and pricing.

3. Legal Basis

Depending on the circumstances, PayParq may process personal data relating to prospective parking providers on the basis of:

• taking steps at the request of the individual prior to entering into a potential business relationship;
• performance of an existing agreement;
• PayParq's legitimate interests in developing, operating, securing, and improving its parking marketplace and business relationships; or
• another lawful basis where required by applicable data-protection law.

Where PayParq relies on legitimate interests, it will consider the interests, rights, and freedoms of the relevant individual.

4. Data Minimisation and Retention

PayParq seeks to collect and retain only personal information reasonably necessary for the relevant business purpose.

Personal data relating to prospective or inactive parking providers may be deleted, anonymised, or otherwise removed when it is no longer reasonably necessary for the purpose for which it was collected, subject to applicable legal, accounting, dispute-resolution, or other retention requirements.

5. Third-Party Information

Where PayParq receives information about a parking owner, operator, or other individual from another person or publicly available source, PayParq may process such information for legitimate business purposes, subject to applicable data-protection requirements.

PayParq does not represent that every proposed parking location displayed on its services has been independently verified or that the person associated with a proposed location has authorised every piece of publicly displayed location information.

6. Enquiries Concerning Proposed Locations

When a user contacts PayParq regarding a proposed parking location, PayParq may process the user's contact details and communications in order to respond to the enquiry, verify availability, communicate with the relevant parking provider, and facilitate a potential future booking or commercial relationship.

A proposed location is not considered bookable merely because it is displayed on the PayParq platform.

7. Rights of Data Subjects

Individuals whose personal data is processed by PayParq may have rights under applicable data-protection legislation, including rights of access, rectification, erasure, restriction of processing, objection, and data portability where applicable.

Requests concerning personal data may be submitted through the contact details provided in PayParq's Privacy Policy.

This Addendum forms part of the PayParq Privacy Policy and should be read together with the remainder of that policy.