Data processing summary
For hire companies: who decides what happens to hirers' personal data, and who else handles it. A signed agreement is available on request.
Last updated: [Date]
Roles
For the hirers, vehicles and notices in your PCNs, you are the controller and [Company name] (PCN Flow) is the processor. We act on your documented instructions, which are your use of the service and your settings. For our own users' account details we are the controller, as the privacy notice explains.
What we process for you
- Subject matter: transferring liability for penalty charge notices to your hirers and telling them.
- Duration: while your account is open, and for [retention period] afterwards unless you ask us to delete sooner.
- People: your hirers, and your own staff who use the service.
- Data: hirer name and address, vehicle registration, hire dates, hire agreements and any details they contain, and the notices and replies.
What we promise
- We process the data only to provide the service and as you instruct.
- Everyone who can access it is bound by confidentiality.
- We keep it secure as described on the security page.
- We help you answer requests from hirers and the regulator, and tell you without undue delay if we find a personal data breach.
- We return or delete the data when the service ends, if you ask.
- We let you check that we follow these rules, and give you the information you need to do so.
Sub-processors
These providers handle data for us. We will tell you before we add or replace one.
| Provider | What for | Where |
|---|---|---|
| Hetzner | Hosts the app and its database. | Europe [confirm datacentre] |
| Cloudflare | R2 storage for uploaded files and backups; the network connection to the app. | [confirm R2 location] |
| Postmark | Sends and receives email (representations, hirer notices, replies, system mail). | United States |
| Anthropic | Reads uploaded notices and hire agreements. | United States |
| Stannp | Prints and posts letters, when a company switches posting on. | United Kingdom |
| Resend | A backup email service, used only if we switch to it. | United States |
Transfers outside the UK
Some providers process data in the United States. We rely on the safeguards in their terms, such as the UK addendum to the standard contractual clauses or the UK-US data bridge.
Contact
To ask for the signed agreement, or about anything here: [email protected].