3. Special category Personal Data

UK Data Protection legislation defines certain personal data as special category data such as data regarding your ethnic origin, physical health, and mental health.

When we enforce a court order on behalf of our client, we have a legal obligation to understand whether customers are vulnerable so that we can apply the appropriate enforcement strategy and achieve the best outcome for the customer and our client. If we identify potential or actual customer vulnerability, we may ask for details, however, we will never compel a customer to provide special category data and we will always ask for consent to record your personal data on our case management system.

Sometimes we receive special category data to support a customer appeal or complaint. For example, a customer may appeal against a Penalty Charge Notice on the basis that they have a serious medical condition and provide medical evidence. Where special category data is volunteered for this specific purpose, we deem that consent has been received for that specific purpose only. We may share special category personal data with our client, as the (joint) data controller, or other members of the Marston group but only to ensure the enforcement is managed appropriately and in line with our legal obligations.

4. How and where information is stored and how long do we hold it for?

We process data in the UK, and it is securely stored in the Microsoft Azure cloud. Transfers of personal information to separate organisations located outside the UK are known as ‘restricted transfers’. Marston will only make a restricted transfer where we have completed a Transfer Risk Assessment and implemented appropriate safeguards to ensure the standard of data protection is not materially lower. Examples of appropriate safeguards are:

• Adoption of standard data protection clauses from the ICO’s International data transfer agreement (IDTA) and the international data transfer addendum
• Implementation of extra technical and organisational steps and put in place any extra protections identified in the Transfer Risk Assessment
• The transfer is to a territory that is deemed adequate by the ICO or the European Commission;

We always establish a lawful basis for processing where we are the data controller, and we will only keep personal data for the minimum period necessary to perform the lawful basis for processing. For example, our retention period for BWV footage is 90 days from the date of recording. We will only keep BWV footage beyond 90 days where we have established a lawful basis for doing so, such as, if one of our Enforcement Agents had been assaulted and Police have requested footage under Schedule 2 Part 1 of the Data Protection Act 2018. We have a system of retention periods which are regularly reviewed by the Data Protection Officer. Where your information is no longer required, we will ensure it is disposed of or deleted in a secure manner.

5. Disclosure of your information

We may share your data with other companies in our Group for the purposes described in this Privacy Notice. This includes our holding company and its subsidiaries. We will only share personal data with third parties or within the Group for the specific purposes set out below and where we have confidentiality clauses and confidentiality agreements (including data protection obligations) in place:

• We may share your data with our client where they have instructed us. We will only do this where our client is data controller for the specific case.
• We may sometimes contract with third parties to supply services to you on our behalf. These may include payment processing, correspondence management and mailing. In some cases, the third parties may require access to some or all of your data. Where any of your data is required for such a purpose, we will take all reasonable steps to ensure that your data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the law.
• We may also disclose your personal information to third parties in the event that we expand or reduce all or part of our business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets. If our business or substantially all of its assets are acquired by a third party, personal data held by us about our customers, clients and website users will be one of the transferred assets and the new owner or newly controlling party will, use the data for the purposes for which it was originally collected by us.
• We may compile statistics about the use of our website including data on traffic, usage patterns, user numbers, sales and other information. All such data will be anonymised and will not include any personally identifying information. We may, from time to time, share such data with third parties such as prospective investors, affiliates, partners, and advertisers. Data will only be shared and used within the bounds of the law.
• In certain circumstances we may be legally required to share certain data held by us, which may include your personal information, for example, for compliance or regulatory purposes, where we are involved in legal proceedings, or where we are complying with the requirements of legislation, a court order, or a governmental, investigative or taxation authority. We do not require any consent from you in order to share your data in such circumstances and will comply, as required, with any legally binding request that is made of us. In these circumstances we may be prevented by the police, courts, or a similar authority from pre-notification or being as transparent as with other data processing activities.
• We may share your data in pursuing a third party’s legitimate interest. This may include situations where we are required to go beyond our specific legal obligations set in laws and regulations to assist law enforcement or private stakeholders in their efforts to combat illegal activities, such as money laundering, fraud detection or prevention or misuse of services. We will ensure that any such processing is strictly necessary for these purposes. These are activities for which a balancing test is not required because the processing is in the public interest or there is a specific recognised legitimate interest under the Data Use and Access Act 2025.
• We may share the supplied name and address with a tracing agency to either confirm residency or provide up-to-date contact information. Marston has a statutory responsibility to ensure the customer receives a notice of enforcement. Failing to communicate may lead to escalating fees, or potential removal and sale of the customers vehicles or other assets. The tracing agencies we use are set out below together with their customer websites:
  • Experian Limited — Experian Credit Report, Free Credit Score & Comparison
  • Equifax Limited — Equifax UK Credit Scores and Credit Reports
  • GB Group Limited — GBG Identity Verification and Fraud Prevention Solutions
  • LexisNexis — LexisNexis Legal and Professional Solutions and Products
• We may use a credit reference agency to help identify enforcement customers that may require additional support or forbearance to tailor our enforcement action appropriately. We firstly send a statutory notice of enforcement to the customer’s address. If either full payment is not made or a payment plan is not agreed, then after 7 days we may send a request to a credit reference agency for a single index score to identify any financial strain. If potential financial strain is identified, we will consider alternative strategies that can produce a better outcome for the customer. For example, where we hold contact data, we will look to increase our proactive attempts to make contact to support the customer paying at the compliance stage of the enforcement process therefore avoiding additional statutory fees that would be incurred if an enforcement agent were required to visit. If we are not contacted or unable to make contact with a customer during the compliance stage, then at some point an enforcement agent visit may be necessary to properly understand the customer’s individual circumstances. The personal data that we share with the credit reference agency is customer name, address, and date of birth only. This processing does not leave a footprint on the customer credit file nor is customer data shared with any other organisation including our client. The credit reference agency we use is called Experian Limited and their address is The Sir John Peace Building, Experian Way, NG2 Business Park, Nottingham NG80 1ZZ.
• We may share enforcement case files with the Enforcement Conduct Board (ECB). The ECB are the independent oversight body for the enforcement industry in England and Wales. The ECB investigate complaints once customers have exhausted Marston’s internal complaints procedure. The ECB may request complaint case history including body worn video or call recordings. The ECB are the data controller for their complaint investigation and further details of how they process data is contained on their privacy notice: https://enforcementconductboard.org/privacy-policy/

6. Complaints

We continuously review and monitor our standards for processing your personal data. If you have queries or concerns, please first contact us on datarequest@marstonholdings.co.uk and we will do our best to resolve it. If you remain dissatisfied about how we have processed your personal data, you may want to escalate to a complaint. If your complaint is about a subject access request or your data privacy rights, please refer to section 9.3, where your will find further information on how we process these. We will acknowledge your complaint immediately if you use our webform below, otherwise within 5 working days.

We have a two-stage complaint process.

a) Stage One

Please click on our complaints Privacy Web Form where you can attach any supporting documentation and set out your complaint.

Complaints Privacy Web Form

When you submit the webform you will receive an acknowledgement receipt. We will aim to investigate and respond to your complaint within 30 days. We would appreciate the chance to properly investigate the matter and report our findings back to you. If you prefer to post a letter to us instead it will take longer to reach the Data Privacy Team and you will not receive an automatic acknowledgement receipt. Please mark all post clearly for the Data Privacy Team and send to:

b) Stage Two

If you are unhappy with the stage one complaint investigation response from the Data Privacy Team, you can appeal at stage two directly to the Data Protection Officer. Please forward your stage two appeal to dpo@marstonholdings.co.uk. The Data Protection Officer will aim to respond within 14 days. The decision of the Data Protection Officer is our final response and the end of the internal complaints process. You can also ask the Information Commissioners Office (ICO) to review how we have handled your complaint (https://ico.org.uk/). The ICO prefer that you exhaust our internal complaints process and provide them with a copy of our final response before they begin their investigation.

7. Controlling your personal information

• When you submit information via our website, you may be given options to restrict our use of your data. In particular, we aim to give our clients and website users strong controls on our use of their data for direct marketing purposes (including the ability to opt-out of receiving emails from us, which you may do by unsubscribing using the links provided in our emails and at the point of providing your details).
• You may also wish to sign up to one or more of the preference services operating in the UK: The Telephone Preference Service, the Corporate Telephone Preference Service and the Mailing Preference Service. These will help to prevent you receiving unsolicited marketing by phone/mail. Please note, however, that these services will not prevent you from receiving marketing communications that you have consented after signing up.

8. Protecting your information

Data security is of great importance to us and to protect your data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure data collected. We use high-level encryption software to ensure that unauthorised individuals do not gain access to your personal information despite our best efforts. We have put in place confidentiality clauses or confidentiality agreements (including data protection obligations) with our third-party service providers and require all third parties to respect the security of your personal data and to treat it in accordance with the law. Notwithstanding the security measures that we take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting personal data to us via the internet.

9. Your legal rights

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data. The rights available to you depend on our reason for processing your information and (in most cases) we have one calendar month to respond to your request:

• 9.1 Your right to withhold information: You may access certain areas of our website without providing any data at all. However, to use all features and functions available on our website you may be required to submit or allow for the collection of certain data. You may restrict your internet browser’s use of Cookies. For more information, see section 11 and our Cookie Policy.
• 9.2 Ensuring the accuracy of your information: If you believe that any data we are holding on you is incorrect or incomplete, please contact us as soon as possible using the contact details at the top of this Privacy Notice. We will promptly correct or remove any information that is incorrect. You have the right to settle or close your customer account and request that your personal information be removed from our website or other records. Upon the closure of your account, we are not obliged to retain your information and may delete any or all of your account information without liability unless it is specifically required for legal reasons. If you request an account closure, we may retain basic residual information about you in our backup and/or archival copies of our database. This will be deleted in accordance with our data retention policy.
• 9.3 Your right of access: You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive any or all of the information we process. If an exemption applies, we will always explain it to you. For example, you may not receive full copies of original documents because your right of access only covers personal information. Other information may be redacted. If it is important that you receive full copies of original documents, you may want to telephone our customer contact centre instead. If you would like a copy of any personal information we hold about you please direct your request to our dedicated Data Subject Access Team using the DSAR Webform. To submit a subject access request using our webform click here: DSAR Webform
  The web-form is secure to protect your personal data, and you will receive a time stamped acknowledgement. The webform is also easy to use and one submitted is directed straight into data privacy team work queue. After you have submitted your webform you can chat directly to the team and will receive updates.
  You can still submit your Data Subject Access Request in writing if you prefer or by email
  to our dedicated email address datarequest@marstonholdings.co.uk . But please note that this will delay how long it takes us to receive it or we might not even receive it.
  Please do not include any other information with your data request, such as an operational query or complaint because the team only process data privacy rights.
  Depending on whether you contact us from a confirmed email address and whether you want copies of body worn video footage we may need to confirm your identity before accepting your subject access request. This is for data security. We will only ask for identification where we do not have sufficient information to confirm that the personal data belongs to you or your email address is unconfirmed.
• 9.4 Your right to rectification: You have the right to ask us to rectify data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. However, please be aware that as an outsourced provider of transportation and enforcement services much of the information we hold about you is received from our clients. Therefore, we may not be able to automatically amend personal data on request, and we may instead need to work with our client or re-direct your request. For example, we cannot change the name on a court order issued to our client.
• 9.5 Your right to erasure: You have the right to ask us to erase your personal data in certain circumstances. If an exemption applies, we will always explain it to you. For example, we would not normally erase a live court order as we have a lawful basis for processing that does not rely on your consent.
• 9.6 Your right to restriction of processing: You have the right to ask us to restrict how we use your information in certain circumstances.
• 9.7 Your right to object to processing: You have the right to object to specific processing activities if our processing is based on legitimate interests.
• 9.8 Your right to data portability: This right only applies if we are processing information based on your consent or under a contract with you and the processing is automated. You have the right to request a transfer of automated information you provided.

10. Cookies

Our website may place and access certain first party Cookies on your computer or device. First party Cookies are those placed directly by us and are used only by us. We use Cookies to facilitate and improve your experience of our website and to provide and improve our services. By using our website, you may also receive certain third-party Cookies on your computer or device. Third party Cookies are those placed by websites, services, and/or parties other than us. For more details, please refer to Our Cookie Policy: https://marstonholdings.co.uk/section-policy/.

11. Changes to our Privacy Notice

We may change this Privacy Notice as we may deem necessary from time to time, or as may be required by law. Any changes will be immediately posted on our website together with the version number and date. If the change in Privacy Policy materially impacts our data subjects, then we will also communicate with them directly. We recommend that you check this page regularly to keep up to date. This Privacy Notice was last updated in July 2026.