Legal & Compliance
Privacy & GDPR
Last updated: 25 August 2026
Who we are
Maxine Brown, trading as Don't Pay That (“Don't Pay That”, “we”, “us”), is a sole trader based in England. We are the data controller for personal data collected through our website and services. If you have questions about how we use your data, contact us at privacy@dontpaythat.uk.
What data we collect
- Contact data: Email address.
- Transaction data: Payment records (card details are not stored by us, they are processed by our payment provider).
- Technical data: IP address, browser type, pages visited, referring URLs.
- Communications data: Messages you send us via email or our contact form.
What we deliberately do not collect
This matters more than usual for a service like ours, so we set it out plainly.
- We do not collect health or disability information. Some of our letters deal with disabled tax classes, medical circumstances or hardship. In every case you complete the letter yourself and send your evidence directly to the council, Transport for London or the parking operator. It never comes to us. We hold no special category data as defined by Article 9 of the UK GDPR.
- Our free checking tools send us nothing. The charge checker and the ULEZ X-Ray run entirely in your browser. Your answers about your vehicle, your circumstances or your finances are never transmitted to us and are never stored. Close the tab and they are gone.
- We do not accept uploaded documents. There is no facility on this site to send us your V5C, your notice, your photographs or your medical evidence, and we would rather keep it that way.
- We never see your card details. Payments are handled entirely by Stripe.
How we use your data
| Purpose | Legal basis |
|---|---|
| Delivering the template letter(s) you purchase | Contract performance |
| Processing payments and refunds | Contract performance |
| Sending the free Parking Fine Cheat Sheet, if you request it via our fine-checker quiz | Contract performance (fulfils your specific request; not a marketing subscription) |
| Sending marketing emails (parking tips, news, and service updates) | Consent (UK GDPR Article 6(1)(a)), you may withdraw consent at any time by unsubscribing |
| Adding your email to our customer list after a purchase, for follow-up guidance and updates | Consent (UK GDPR Article 6(1)(a)). We only do this if you ticked the marketing box at checkout. If you did not tick it, you are not added |
| Responding to your support queries | Legitimate interests |
| Improving our service quality | Legitimate interests (anonymised data only) |
| Complying with legal obligations | Legal obligation |
Email marketing
We send marketing emails only to people who have given explicit consent by ticking the relevant checkbox on our website. This consent is recorded with a timestamp. Our marketing emails cover parking charge news, tips, and service updates.
You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@dontpaythat.uk. Withdrawal of consent does not affect service emails, we will still send you emails necessary to deliver the service you have purchased (order confirmation, template download, assessment results).
We use Brevo to manage our email list. Brevo acts as a data processor on our behalf under a Data Processing Agreement. Your email address is stored on Brevo's servers, which are subject to appropriate safeguards under UK GDPR. You can view Brevo's privacy policy at brevo.com/legal/privacypolicy.
Cookies
We use strictly necessary cookies to operate the website. We may also use analytics cookies to understand how visitors use the site, but only if you have given consent via the cookie banner. You can change your cookie preference at any time by clearing your browser cookies and revisiting the site.
How long we keep your data
We keep data only for as long as there is a reason to, and the reason is stated for each.
| What | How long | Why |
|---|---|---|
| Purchase and order records | 6 years | Limitation Act 1980, and tax record keeping |
| Marketing list entries | Until you unsubscribe, then removed | Consent lasts until you withdraw it |
| Customer list entries | Until you unsubscribe, then removed | As above |
| Contact form messages | 12 months | Long enough to deal with the query and any follow-up |
| Server logs, including IP addresses | As retained by our hosting provider on its standard schedule | Security and diagnosing faults |
| Free tool answers | Not applicable, never collected | They stay in your browser |
You can ask us to delete your data at any time. Where a legal retention period applies, such as the six years for order records, we will keep only what that obligation requires and delete the rest.
Who we share your data with
We sell drafted template letters for you to send yourself, we do not submit appeals to parking operators or contact independent adjudicators (POPLA / IAS) on your behalf, so we do not share your data with them. We share your personal data only with:
- Vercel: Our website hosting provider.
- Stripe: Our payment processor, for secure transaction handling.
- Brevo: Our email service provider (see “Email marketing” above for details).
All of the above operate under appropriate data processing agreements. We do not sell your data to any third parties.
Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data (right to be forgotten)
- Object to processing based on legitimate interests
- Request restriction of processing
- Data portability
- Lodge a complaint with the ICO (ico.org.uk)
To exercise any of these rights, please contact us.
Changes to this policy
We may update this policy from time to time. Significant changes will be notified to our email list. The “Last updated” date at the top of this page reflects the most recent revision.