Skip to main content
ScanNeo

Legal - Privacy Policy

ScanNeo Ltd is committed to protecting personal data and respecting privacy.

Version: V4
Last updated: 20 July 2026

ScanNeo Ltd (“ScanNeo”, “we”, “us”, “our”) is committed to protecting personal data and respecting privacy. This Privacy Policy explains how we collect and use information when operating our services and systems.

1. Who we are

ScanNeo Ltd
Company No: 16123858
Registered Office: 159 High Street, Barnet, EN5 5SU, UK
Website: www.scanneo.co.uk
ICO Registration Reference: ZB933762
Data protection contact: Steve Stamp - contact@scanneo.co.uk

2. How we collect data

We operate portable camera systems mounted to vehicles that collect data while travelling through public roads and publicly accessible areas. We also collect data through vehicle registration mark (VRM) checks against a client authority's permit or restriction database, through the ScanNeo CEO mobile application used by enforcement officers to review and record enforcement decisions (including Blue Badge verification, where a client's service includes this), and through signage and bay-restriction surveys.

Data is collected:

  • In public spaces only
  • Passively and automatically, or by an enforcement officer actively reviewing and recording a decision (for example, Blue Badge verification)
  • Without interaction with individuals, except where a Blue Badge or permit check requires an officer to make a decision

3. What data we collect

Depending on context, we may collect:

  • Images of vehicles in public spaces
  • Vehicle Registration Marks, and associated permit or restriction status
  • Images of public infrastructure and signage
  • Contextual street imagery
  • Blue Badge status and validity, where a client authority's service includes Blue Badge verification — this may reveal that an individual holds a disability-related permit
  • Records of enforcement decisions and supporting evidence (for example, contravention records and appeals evidence)
  • Enforcement officer activity data (for example, which officer reviewed a case)
  • Where a vehicle keeper lookup is required to issue an enforcement notice, the registered keeper's name and address obtained from DVLA (see “DVLA keeper information” below)

Individuals and faces may appear incidentally within images.

4. How we process data

  • Images are processed automatically
  • Faces are blurred or masked on-device
  • VRMs are converted into internal system tags and checked against a client authority's permit or restriction records to determine enforcement status
  • Raw imagery is retained for short periods only (see “Data retention” below)
  • Where Blue Badge verification is provided, status data is reviewed by an enforcement officer and may be flagged for further review

We do not perform automated facial recognition.

4a. DVLA keeper information

For some engagements, identifying a vehicle's registered keeper is a necessary step in issuing a Penalty Charge Notice or equivalent enforcement notice. DVLA keeper-lookup access (for example, under the KADOE service) is held and used by whichever party is legally responsible for issuing that notice under the relevant enforcement scheme — this may be us, or it may be the client authority or operator, depending on the engagement; where we act only as a technology supplier to a local authority, keeper information is typically obtained by the authority or its notice-processing agent, not by us.

Where keeper information is obtained from DVLA rather than directly from the individual, this is disclosed in accordance with Article 14 UK GDPR: the source (DVLA), the categories of data obtained (the registered keeper's name and address) and the purpose (issuing an enforcement notice) are set out to the individual at the point they are contacted — ordinarily via the Penalty Charge Notice or equivalent enforcement correspondence issued by the responsible authority or operator.

5. Our role: controller and processor

ScanNeo acts as a data controller for the personal data it processes for its own purposes, including operating and securing our platform, our website and enquiries, our own staff and enforcement-officer account records, and the analytics and development work described in this policy.

For the enforcement data we capture and process on behalf of a specific client authority or operator — such as VRM detections, permit-verification results and enforcement evidence — our role depends on the engagement and is set out in our contract with that client. In most cases we process this data as a processor, acting on the client's documented instructions under a data processing agreement; where our contract with a client provides otherwise, we will process that data as a controller, or as a joint controller with the client, and this policy and our privacy notices will reflect that. Either way, where a client authority is the controller for specific records, we will act on that authority's instructions in relation to that data, including a request to delete or return it.

6. Lawful basis for processing

We process data under the following lawful bases, depending on the type of processing and our role for that data:

  • Public task, where we are supporting a public authority in exercising its official enforcement functions (Article 6(1)(e) UK GDPR)
  • Legitimate interests, for service delivery, security, analytics, platform improvement and the development of our detection technology, balanced against individuals' rights (Article 6(1)(f) UK GDPR)
  • Substantial public interest, where we process Blue Badge or other disability-related data to support a public authority's obligations to disabled residents — relying on Article 9(2)(g) UK GDPR and the equality of opportunity or treatment condition in Schedule 1, Part 1, paragraph 8 of the Data Protection Act 2018. An Appropriate Policy Document is maintained for this processing, in accordance with Schedule 1, Part 4 of the Data Protection Act 2018, and is available to data subjects and regulators on request.

Safeguards are applied to ensure minimal impact on individuals.

7. Who we share data with

  • Client authorities and operators for whom we deliver services, limited to the data necessary for the agreed service
  • Google Cloud Platform, as our infrastructure and hosting provider
  • Where relevant to a specific engagement, permit or payment system providers designated by a client

We do not sell personal data.

Where a client authority (such as a local council) remains the data controller for specific records — for example, its own permit register, DVLA keeper data or enforcement case data — we process that data on the authority's instructions, and will act on the authority's request to delete or return it, including at the end of an engagement.

8. International data transfers

Our systems are hosted on Google Cloud Platform / Firebase infrastructure located in the UK (London, europe-west2 region). We do not transfer personal data outside the UK or European Economic Area in the ordinary course of providing our services. Where a sub-processor is located outside the UK/EEA, we put in place an appropriate transfer mechanism, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

9. Data retention

  • Raw imagery that is not linked to a suspected contravention is deleted automatically within 24 hours through routine system processes
  • Enforcement-related data (including images, VRM data and permit/Blue Badge verification results) linked to a suspected contravention is retained for as long as necessary to support enforcement action and any related appeal, and in any event no longer than the applicable statutory appeal period — in most cases up to 12 months — or per a client's own retention requirements where longer
  • Anonymised or fully aggregated data (from which individuals cannot reasonably be re-identified) may be retained long term for analytics and technology development

10. Automated processing and human review

We do not carry out solely automated decision-making that produces legal or similarly significant effects on individuals. Vehicle detections and potential contraventions are flagged automatically by our systems, but no penalty or enforcement action is issued without review by a human enforcement officer.

11. Your rights

Under UK GDPR, you have the right to:

  • Request access to your personal data
  • Request correction or deletion of your personal data
  • Object to processing
  • Request that we restrict processing of your personal data
  • Request that your personal data be provided to you or transferred in a portable format (data portability), where applicable
  • Withdraw consent at any time, where we rely on consent as our lawful basis (this is not our primary basis for most of the processing described in this policy)
  • Lodge a complaint with the ICO

Rights may be limited where data is anonymised or where processing is necessary for public task or legitimate interests. Where a client authority is the controller for specific data, we will direct your request to them, or assist them in responding to it.

Anonymised and aggregated datasets may be used by ScanNeo for analytics, service improvement and the development and training of our detection and enforcement technologies. Where imagery includes blurred faces, this reduces but does not remove identifiability — the vehicle registration mark, vehicle appearance and location may still allow indirect identification, so this data remains personal data (it is pseudonymised, not anonymised) unless and until it is further aggregated into non-identifying statistical outputs. We process pseudonymised data for technology development under our legitimate interests, having assessed this against individuals' rights. You may object to this specific use of your data at any time by contacting us at contact@scanneo.co.uk; where technically feasible, we will exclude your data from future technology development.

12. Security

We apply appropriate technical and organisational measures to protect data, including:

  • Encryption of data in transit and at rest
  • Role-based access controls and multi-factor authentication for system access
  • On-device blurring or masking of faces before transmission
  • Audit logging of system access and data queries
  • A data breach response process, including notification to the ICO and affected individuals where required by law

13. Data Protection Impact Assessment and video surveillance

We have completed a Data Protection Impact Assessment for our ANPR and enforcement data processing activities, in accordance with Article 35 UK GDPR. A summary is available to client authorities and regulators on request.

Our vehicle-mounted camera systems operate in line with the Surveillance Camera Code of Practice and ICO guidance on video surveillance. Vehicles are marked with appropriate signage to indicate camera use.

14. Cookies

This website uses cookies. For details of the cookies we use, and how to manage your preferences, please see our separate Cookie Policy at scanneo.co.uk/cookies.

15. Complaints

If you have a concern about how we handle your data, please contact us first at contact@scanneo.co.uk so we can try to resolve it. If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — ico.org.uk.

16. Contact us

For privacy-related enquiries:

Email: contact@scanneo.co.uk

17. Changes to this policy

We review this policy regularly and may update it from time to time. Material changes will be reflected in an updated “last updated” date at the top of this page.