PCG Cardiff is based in Cardiff, Wales. We are the data controller for personal data collected through this website.
Data Controller: PCG Cardiff
Address: 346 North Road, Cardiff, CF14 3BP
Contact: Contact form or contactus@pcgcardiff.co.uk
ICO Registration: [PENDING — to be updated upon registration]
We only collect personal data that is necessary to process your order, manage your account, or communicate with you. We do not collect data for advertising or profiling purposes.
We use essential session cookies only (to maintain your login and shopping cart). We do not use analytics, tracking pixels, or any third-party cookies. See our Privacy Promise for full technical detail.
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Processing and fulfilling your order | Name, address, email, order details | Contract performance |
| Sending order confirmations and dispatch notifications | Email address | Contract performance |
| Managing your account | Email, password hash | Contract performance |
| Responding to customer enquiries | Name, email, message content | Legitimate interests |
| Keeping financial and tax records | Order details, transaction amounts | Legal obligation (HMRC) |
| Sending marketing newsletters (only if you subscribed) | Email address | Consent |
| Fraud prevention and security | Order and account data | Legitimate interests |
We will never use your data for purposes incompatible with those listed above without first obtaining your consent.
We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only where strictly necessary:
All third parties with whom we share data are required to handle it in compliance with applicable data protection law.
Our website is hosted on servers located in the United States (Tampa, Florida). By using this website and placing orders, you acknowledge that your data may be transferred to and stored in the US. We ensure appropriate safeguards are in place through our hosting provider's data processing terms.
| Data Type | Retention Period | Reason |
|---|---|---|
| Your name, delivery address, email and phone number on a delivered order | 14 days after delivery is confirmed | Data minimisation — kept only as long as needed to handle post-delivery queries |
| The underlying order record (order reference, items purchased, amounts paid, payment reference, order date, order status) | 6 years | HMRC legal requirement for financial records |
| Account data | Until you request deletion | Account management |
| Newsletter subscriptions | Until you unsubscribe | Consent-based |
| Customer service correspondence | 2 years | Dispute resolution / legitimate interests |
Once an order has been delivered for 14 days, we automatically and permanently remove your name, delivery address, email and phone number from that order — replacing your name with a generic reference number. This happens whether or not you ask us to. The order itself (what was bought, what was paid, and when) is kept for 6 years as HMRC requires, but from that point on it can no longer be linked back to you personally. Outside of this, data is securely and permanently deleted once its retention period above has passed.
Under UK GDPR, you have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete your data where there is no legal reason to retain it.
Ask us to restrict processing of your data in certain circumstances.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests or for direct marketing.
Withdraw marketing consent at any time by unsubscribing.
Lodge a complaint with the ICO if you believe we've mishandled your data.
To exercise any of these rights, please use our contact form and select "Privacy / data request" as the subject. We will respond within 30 days.
Note on order history: as explained in Section 6, we already anonymise the personal details on your delivered orders automatically 14 days after delivery, without needing to be asked. The order record itself (what was bought and paid, stripped of anything identifying you) can't be erased early, as we're legally required to keep it for HMRC for 6 years.
We use essential session cookies only. These are strictly necessary for the website to function — they maintain your login session and shopping cart. No consent is required for essential cookies under UK PECR.
We do not use analytics cookies, advertising cookies, or any third-party cookies of any kind. See our Privacy Promise for independently verified proof of this.
We take the security of your data seriously. Measures we have in place include:
In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection regulator:
We would appreciate the opportunity to resolve any concern directly before you contact the ICO — please contact us first.
We may update this privacy policy from time to time. The current version will always be published on this page with the date of last update shown at the top. We will notify you of any significant changes by email where we hold your address.