Privacy notice

How PCN Flow handles personal data, in plain English.

Last updated: 13 November 2026

Who we are

PCN Flow is run by Dataforge IT Limited (company number 16738174, Office 6452, 58 Peregrine Road, Hainault, Ilford, Essex IG6 3SZ).

We play two roles. For the people who use PCN Flow at a hire company, and people who ask us for a trial, we decide how the data is used, so we are the controller. For the hirers and vehicles in a hire company's PCNs, the hire company decides what we do with the data and we work on its behalf, so we are the processor.

What we process

• Trial requests: your name, company, company email and phone, and PCN volume if you give it.
• Hire company users: name, work email, a hashed password, two-factor settings and sign-in records.
• Hirers and their hire: name, address, vehicle registration, hire dates and the hire agreement the hire company uploads. If the agreement shows a date of birth or driving licence details, those are part of the document. We don't send them to an issuer unless its form requires them.
• Penalty charge notices: the notice and what is read from it, and the replies issuers send back.
• Messages to us: what you write when you ask for support or email us.

Why we use it

To set up and support trial accounts. To read each notice, find the hire that covers it, ask the issuer to pass the penalty to the hirer, and tell the hirer. To run the service: keep accounts secure, answer support requests, keep backups and fix faults. Our lawful basis is performing our contract with the hire company and our legitimate interest in replying to enquiries and running a secure service. For hirers, the hire company's own legal basis is that it must name the hirer to the issuer to avoid being held liable for the penalty.

Who it goes to

• The issuing authority (council, Transport for London, private operator and so on): only what is needed to transfer liability.
• The hirer, to tell them that the penalty has been passed to them.
• Our service providers, listed below. They process data only to provide their part of the service.

We don't sell personal data and we don't use advertising tools. To count visits to this website we use Cloudflare Web Analytics, which sets no cookies and doesn't follow you across other sites.

Reading documents with AI

Notices and hire agreements are read by Anthropic's AI service, which receives the document and returns the details we ask for. Under Anthropic's commercial terms, content sent through its API isn't used to train its models. A person at the hire company checks the details before anything is sent.

Where it is kept

The app and its database run on a Hetzner server. Files and backups are in Cloudflare R2. Some providers, such as Anthropic and Postmark, process data in the United States. Where data leaves the UK we rely on the safeguards in those providers' terms, such as the UK addendum to the standard contractual clauses or the UK-US data bridge.

How long we keep it

• Trial requests that don't become an account: 12 months.
• Hire company records: while the hire company has an account, and for 6 years after it closes, the time a claim about the service could still be brought.
• Backups: 30 days.
• Expired sign-in sessions and sign-in attempts: 30 days.
• Support messages: 2 years.

Your rights

You can ask to see your data, correct it, delete it, restrict or object to how it is used, or have it moved. If you are a hirer, ask the hire company that sent your notice first; we will help them answer. You can also ask us at [email protected]. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.