Privacy Notice

Last updated: 10 November 2026 · Version 1.4

---

This notice explains what we do with personal data when you visit our website, enquire about our services, become a customer, or work with us as a supplier.

If you are a business customer and want to know how we handle data inside the services we provide to you — your Microsoft 365 tenant, your website, your backups — that is a different relationship in law. There, you are the data controller and we act on your instructions. It is covered by our Data Processing Agreement and our Subprocessor list, not by this notice.

If you are a home customer, this notice covers everything we hold about you, including the data inside the services we provide. Section 2.10 explains what that involves.

---

1. Who we are

PCQ Solutions Ltd is a company registered in England and Wales, number 04019429, with its registered office at Cambrian House, Cambrian Place, Llanidloes, Powys, SY18 6BX.

We are registered with the Information Commissioner’s Office under registration number Z1285873.

For the purposes of this notice, PCQ Solutions Ltd is the data controller.

Contact us about data protection:

[email protected] PCQ Solutions Ltd, Cambrian House, Llanidloes, Powys, SY18 6BX 01686 411000

We are not required to appoint a Data Protection Officer, and have not appointed one. Data protection enquiries are handled by Joe Lowe, Managing Director.

---

2. What we collect and why

2.1 If you visit our website

What we collect. Your IP address, browser type and version, operating system, the pages you view, the time and date of your visit, and the site you came from. If you submit a form, we collect whatever you put in it.

Our website carries a live chat facility provided by ISL Online. If you use it, the content of your conversation and your technical details are processed by them on our behalf.

Why. To keep the website secure and available, to understand how it is used, and to respond to you if you contact us.

Our lawful basis. Legitimate interests — running and protecting our website, and responding to enquiries. For any non-essential cookies, your consent.

See our Cookie Policy for detail on cookies specifically.

2.2 If you enquire about our services

What we collect. Your name, business name, email address, telephone number, service address where relevant, and the content of your enquiry. For broadband and connectivity enquiries we may also check line availability at an address, which involves passing the address to a supplier.

Why. To respond to you, prepare a quotation, and check whether we can actually supply what you are asking for.

Our lawful basis. Steps taken at your request before entering a contract. Where you are not the contracting party — for example you are an employee of a prospective customer — legitimate interests in responding to business enquiries.

If you don’t go ahead, we keep your enquiry for 12 months in case you come back to us, then delete it.

2.3 If you become a customer

What we collect. Contact details for the people we deal with at your organisation; billing and payment details including bank details for Direct Debit; service addresses; account references and line identifiers; records of the services you take; correspondence with us; support request history.

Why. To provide the services, bill for them, support you, and keep proper business records.

Our lawful basis. Performance of our contract with you. For billing records, legal obligation. For service improvement, security and recovering money owed, legitimate interests.

2.4 If you contact our support team

What we collect. Your name, contact details, the content of your request, and records of what we did about it. Where we attend remotely or on site, notes of the work carried out.

We do not record telephone calls. If you leave us a voicemail, our telephone platform (Uboss, provided through Zen Internet) transcribes it and writes a short summary. The recording, transcript and summary are emailed to our support desk, where they become a support record, matched to your account by your phone number where we hold it. They are kept as part of your support history.

Why. To resolve your request, keep a history so the next person picking it up knows what has happened, and to improve our service.

Our lawful basis. Performance of our contract, or legitimate interests where you are an employee of a customer rather than the contracting party.

2.5 If you are a supplier or business contact

What we collect. Name, role, business contact details, and records of our dealings.

Why. To manage the relationship and buy goods and services.

Our lawful basis. Performance of a contract, or legitimate interests in managing supplier relationships.

2.6 If you apply for a job with us

What we collect. Your CV, contact details, employment history, qualifications, references and any information you give us during the process.

Why. To assess your application.

Our lawful basis. Steps taken at your request before entering a contract, and legitimate interests in recruiting.

How long. Six months after the role is filled if you are unsuccessful, unless you ask us to keep your details for future vacancies.

2.7 Marketing

What we collect. Name, business email address, and your marketing preferences.

Why. To tell you about our services.

Our lawful basis. Consent, or legitimate interests where you are an existing customer and we are telling you about services similar to those you already have.

Signing up on our website. If you sign up for updates on our website, we ask for your email address and your consent. Our email service, EmailOctopus, then sends you an email asking you to confirm before you are added to our list. The sign-up form uses Cloudflare Turnstile to block automated sign-ups. We keep your email address until you unsubscribe; after that we keep only a record that you have unsubscribed, so that we do not email you again.

You can opt out at any time — use the unsubscribe link in any email, or write to us at the address above. We will act on it promptly and it will not affect the services you receive.

2.8 If you interact with us on social media

We maintain pages on Facebook, Instagram and LinkedIn.

What we collect. If you message us, comment, or post on our pages, we see what you send and your public profile information. If you send us an enquiry that way, we may keep it as an enquiry or support record.

Why. To respond to you and to promote our services.

Our lawful basis. Legitimate interests — responding to people who contact us and promoting our business.

What we do not control. These platforms process your data under their own terms, for their own purposes, and we have no control over that. The statistics they give us about our page audience are produced by the platform from data it holds about you; for those statistics we and the platform are jointly responsible, but only the platform can tell you how the underlying data is processed. If you want to understand or object to that, you need to go to the platform itself. We would also say plainly that a social media platform is not a private channel — if your enquiry involves anything confidential, email or phone us instead.

2.9 If you bring a device to us for repair or data transfer

This applies whether you are a business or a member of the public.

What we collect. Your name and contact details, details of the device and the fault, and a record of the work we carry out. Where you ask us to transfer or recover data, or where we need to protect your data before working on a device, a copy of the data on that device. Where the work requires us to sign in, the password or PIN you give us — written on paper, kept physically with your device, and destroyed when the work is finished. We do not record it on a computer or in our systems.

Why. To carry out the work you have asked us to do, and to be able to answer questions about it afterwards.

Our lawful basis. Performance of our contract with you. Where you are not the person we contract with, our legitimate interests in carrying out the work requested.

What is on your device. A device holds whatever its owner has put on it, which can include health information, financial details, photographs and private correspondence. We do not go looking. Our technicians open only what is necessary to carry out and check the work, and everyone working for us is under a duty of confidence. The one exception is content we are obliged by law to report, which is not within our discretion.

How long. The copy of your data is held on encrypted storage and deleted within 30 days of your device being returned. The paper record of any password you gave us is destroyed when the work is complete. The job record — what the fault was and what we did — is kept as part of your customer record.

We recommend changing your password after you collect your device.

2.10 If you are a home customer

When you use our services for your home, we are the controller of the personal data involved, including the data held inside the services themselves. Depending on what you take from us, that means:

• Broadband, phone and mobile: your service address, line and account details, and the records your network provider keeps of how the service is used, which we see when we need to bill you or fix a fault.
• Care & Support: the monitoring and security software on your computer reports device details, software and update status and security alerts to us. When you ask for help we may connect to your computer remotely, and can then see what is on its screen. Connections made through our management software are logged; an occasional one-off session started from our website chat is not.
• Your @pc-q.net mailbox: the email stored in it, held on our mail server.
• Home backup: if you take our Livedrive backup service, copies of the files you choose to back up, held by Livedrive.

Why. To provide the services you have asked for.

Our lawful basis. Performance of our contract with you.

How long. For as long as you have the service. If you leave our broadband you can keep your @pc-q.net mailbox for a monthly fee; otherwise the mailbox and its contents are deleted within 60 days of it closing. Monitoring data and backups are deleted within the same timescales we give business customers: 60 days from live systems and 90 days from backups. Your customer and support records are kept as set out in section 6.

The suppliers who process this data for us are listed on our Subprocessor page.

2.11 If you use a WiFi hotspot we run

We install and manage public and guest WiFi for venues and businesses. Where we run a network on behalf of a venue or business, that business is responsible for your data and we act on its instructions. Where we run a hotspot in our own right, we are the controller.

What we collect. Your device’s network identifier (its MAC address), when and for how long you connected, and anything you enter on the login page, such as an email address.

Why. To give you access, keep the network secure, and deal with misuse.

Our lawful basis. Legitimate interests in running a safe, working network.

How long. Only as long as needed to run the network and investigate misuse, after which connection records are deleted. Most of these systems are hosted on the Plasma Cloud platform, listed on our Subprocessor page.

2.12 How we use AI

We use an AI assistant, Anthropic’s Claude, to help us run the business. It works with the records we hold about you as a customer, supplier or contact:

• Support requests. It reads incoming support emails and voicemail transcripts, sorts them, closes obvious spam and can draft replies for our staff.
• Customer and account records. It reads and updates contact details, support history and device records in our service desk, and reads billing contacts and invoices in our accounting system, to help us prepare invoices, reports and account reviews.
• Our own email and files. When someone on our team asks it to help with a task, it can search and read email and documents in our own Microsoft 365, including our correspondence with you.

It does not make decisions about you on its own. A person reviews anything we send you, and any decision that matters to you, such as about your account, your charges or the services you receive, is made by a person.

Our lawful basis. Legitimate interests in running an efficient business and support service. You can object to this use by telling us at [email protected].

Anthropic processes this data for us in the United States, under its commercial terms and data processing agreement and the safeguards in section 5. Model training is switched off, so your data is not used to train Anthropic’s models.

---

3. Where your data comes from

Mostly from you directly. We also receive data:

• From your employer or the organisation you work for, where they are our customer and have given us your details as a contact
• From suppliers, where they tell us about an order, fault or service affecting you
• From publicly available sources such as Companies House and your own website
• From our website and the systems we use to deliver services

---

4. Who we share it with

We share personal data with:

Our suppliers and service providers, where they need it to deliver something to you or to us. This includes connectivity suppliers who need service address details to place an order, software vendors whose platforms we administer on your behalf, and our own business systems.

Our professional advisers — accountants, insurers and, if needed, lawyers.

Payment providers and our bank, to collect payments due — HSBC (our bank), Eazy Collect (Direct Debit collection), PayPal, and EVO Payments (card payments).

Our email service — EmailOctopus (Three Hearts Digital Ltd, UK), which we use to send announcements and updates by email to our customers and to people who have signed up on our website. It holds your name and email address on servers in the EU (Amazon Web Services, Ireland). Marketing emails always include an unsubscribe link.

Debt collection agencies and solicitors, if an account remains unpaid after a final reminder, so they can recover the debt on our behalf. We do this to perform our contract with you and in our legitimate interest in recovering money we are owed.

Public authorities, where we are required by law to disclose information.

A purchaser, if we sell or reorganise our business, in which case your data would transfer with it.

We do not sell personal data, and we do not share it for other organisations’ marketing.

A full list of the third parties who process customer data on our behalf when we deliver services is published on our Subprocessor page.

---

5. International transfers

Most of the data we hold stays in the UK. Some of the platforms we use are operated by companies based outside the UK, principally in the United States and the European Union.

Where personal data is transferred outside the UK, we rely on:

• UK adequacy regulations, where the destination country is covered by them; or
• the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.

Our Subprocessor page identifies which suppliers involve a transfer and the safeguard that applies.

---

6. How long we keep it

What	How long
Website logs	30 days
Copies of data from a device brought in for repair or transfer	30 days after the device is returned
Device passwords or PINs given to us for workshop work	Held on paper with the device; destroyed on completion of the work
Workshop job records — the fault and the work done	Part of your customer record, 6 years after the relationship ends
Enquiries that do not become customers	12 months
Customer records and correspondence	6 years after the relationship ends
Invoices, accounting and tax records	6 years from the end of the accounting period, as required by the Companies Act 2006 and HMRC
Support request history	6 years after the relationship ends
Unsuccessful job applications	6 months
Marketing preferences	Until you opt out, plus a record of the opt-out so we can honour it

Where we no longer need personal data we delete it or anonymise it. Data held in backups is deleted when the backup set reaches the end of its retention cycle.

---

7. How we protect it

We take appropriate technical and organisational measures to protect personal data. These include access controls, multi-factor authentication, encryption in transit, endpoint protection, security monitoring and backup.

Our Security page describes our approach in more detail.

---

8. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data — that is what this notice is for
• Access the personal data we hold about you
• Rectification — have inaccurate data corrected
• Erasure — have your data deleted, in certain circumstances
• Restrict processing — limit how we use your data, in certain circumstances
• Data portability — receive your data in a portable format, in certain circumstances
• Object to processing based on legitimate interests, and to direct marketing at any time
• Not be subject to automated decision-making that produces legal or similarly significant effects. We do not make decisions of this kind.

To exercise any of these, write to us at [email protected]. We will respond within one month. If your request is complex we may extend that by a further two months, and we will tell you if so.

These rights are not absolute and some do not apply in all circumstances. If we cannot do what you have asked, we will explain why.

If you are an employee or customer of one of our customers and your data is in a system we administer on their behalf, we will usually need to direct your request to them, because it is their data and they decide what happens to it. We will tell you who to contact.

---

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected] — we would rather have the chance to put it right.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 0303 123 1113 ico.org.uk/make-a-complaint

---

10. Changes to this notice

We review this notice at least annually, and whenever our processing changes materially. The version and date at the top tell you when it was last updated. Where a change materially affects you, we will tell you directly.

---