Data Processing Addendum

Last updated 11 October 2026

This Data Processing Addendum forms part of the Parkstack Terms whenever PARKSTACK LTD, company number 17483563, processes personal information for a park or attraction. The park is the controller and Parkstack is the processor for that information. Terms such as controller, processor, personal data and processing have the meanings given in UK data protection law.

1. Processing instructions

Parkstack will process personal data only on the park’s documented instructions, including the settings and actions the park uses in the service, these terms and other written instructions Parkstack accepts. Parkstack will not sell guest data or use it for advertising. If UK law requires other processing, Parkstack will tell the park before processing unless the law prohibits that notice. Parkstack will tell the park if an instruction appears to breach applicable data protection law.

2. Details of the processing

Subject matter and duration

Hosting and operating the park’s public website, ticketing, order management, gate lookup, transactional email, support and privacy-conscious analytics for the term of the Parkstack service, followed by the return, deletion and limited retention described below.

Nature and purpose

Collecting, storing, organising, retrieving, displaying, transmitting, exporting, securing, anonymising and deleting information so the park can publish its website, sell and manage tickets, admit guests, handle refunds, understand aggregate website use and meet documented legal obligations.

People and information covered

Data subjects are guests, prospective guests and people who contact the park. Data may include name, email, phone number, postcode, ticket products, visit dates, order and refund history, payment references supplied by Stripe, contact messages and short-lived anonymous website event identifiers. Parkstack does not store full card numbers. The service is not intended to collect special-category or criminal-offence data, and the park must not instruct Parkstack to collect it without a separate written agreement.

3. The park’s responsibilities

The park decides the lawful purposes and lawful bases for its processing, gives guests an accurate privacy notice, responds to people exercising their rights, keeps its instructions lawful, limits staff access and does not enter unnecessary or sensitive information. The park may use the service’s privacy tools and contact Parkstack for further assistance.

4. Confidentiality and security

Parkstack ensures that people authorised to process personal data are bound by confidentiality. Taking account of the risk, available technology and implementation cost, Parkstack maintains appropriate technical and organisational measures, including encrypted transport, tenant access controls, authenticated operator access, least-privilege administration, security logging, protected secrets, backups, dependency maintenance, incident procedures and data minimisation. Security measures may evolve without reducing the overall level of protection.

5. Subprocessors

The park gives general written authorisation for Parkstack to use subprocessors needed to provide the service. Service providers used to deliver Parkstack include Stripe for payments, Resend for transactional email, Cloudflare for website and media delivery, Railway for API hosting, Neon for the database and Anthropic for the console's help assistant. To the extent a provider processes park-controlled data on Parkstack’s behalf, it is a subprocessor under this addendum. Parkstack will impose equivalent data protection obligations on each subprocessor and remains responsible for its subprocessor’s performance of those obligations. Parkstack will give reasonable advance notice of a material new subprocessor so the park can raise a reasonable data-protection objection. A provider may separately act as an independent controller for parts of its service, as described in that provider’s own terms.

6. International transfers

Parkstack will not make a restricted transfer except on the park’s instructions and with a lawful transfer mechanism. Where required, Parkstack will use UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by UK law, and will complete any required transfer risk assessment.

7. Assistance and rights requests

Taking account of the nature of the processing and information available, Parkstack will provide reasonable assistance with access, correction, deletion, restriction, objection and portability requests; security and breach duties; data protection impact assessments; and prior consultation with the ICO. If Parkstack receives a request concerning park-controlled data, it will pass it to the park and will not respond substantively unless instructed or legally required.

8. Personal data breaches

Parkstack will notify the park without undue delay after becoming aware of a personal data breach affecting the park’s data. As information becomes available, Parkstack will describe the nature and likely consequences, the affected information and people, the measures taken or proposed, and a contact for follow-up. Parkstack will take reasonable steps to contain, investigate and mitigate the breach.

9. Return, deletion and retention

During the service, the park can export its content and reports. At the end of the service, Parkstack will, at the park’s choice, return or securely delete personal data and delete existing copies, unless UK law requires retention. Parkstack’s published privacy notice explains the operational retention schedule. Backup copies are isolated from ordinary use and deleted through the normal backup cycle. De-identified aggregate information that can no longer be linked to a person is not personal data and may be retained for historical reporting.

10. Demonstrating compliance

Parkstack will provide information reasonably necessary to demonstrate compliance with this addendum and allow reasonable audits or inspections by the park or its independent auditor. Audits must normally be requested in writing, occur during business hours, avoid unnecessary access to other customers’ information and use existing reports and evidence where these are sufficient. The parties will agree reasonable scope, timing and costs.

11. Priority and contact

If this addendum conflicts with the Parkstack Terms on processing personal data, this addendum takes priority. Other liability provisions in the Terms continue to apply to the extent permitted by law. Parkstack's registered office is 128 City Road, London, United Kingdom, EC1V 2NX. Questions and written instructions can be sent to hello@parkstack.net.