Last updated: 1 November 2026 · Version 1.0
This notice explains what we do with personal data when you visit our website, enquire about
our services, become a customer, or work with us as a supplier.
If you are a customer and want to know how we handle data inside the services we provide to
you — your Microsoft 365 tenant, your website, your backups — that is a different
relationship in law. There, you are the data controller and we act on your instructions. It is
covered by our Data Processing Agreement and our
Subprocessor list, not by this notice.
1. Who we are
PCQ Solutions Ltd is a company registered in England and Wales, number 04019429, with
its registered office at Cambrian House, Cambrian Place, Llanidloes, Powys, SY18 6BX.
We are registered with the Information Commissioner’s Office under registration number
Z1285873.
For the purposes of this notice, PCQ Solutions Ltd is the data controller.
Contact us about data protection:
dataprotection@pc-q.co.uk
PCQ Solutions Ltd, Cambrian House, Llanidloes, Powys, SY18 6BX
01686 411000
We are not required to appoint a Data Protection Officer, and have not appointed one. Data
protection enquiries are handled by Joe Lowe, Managing Director.
2. What we collect and why
2.1 If you visit our website
What we collect. Your IP address, browser type and version, operating system, the pages
you view, the time and date of your visit, and the site you came from. If you submit a form,
we collect whatever you put in it.
Our website carries a live chat facility provided by ISL Online. If you use it, the content
of your conversation and your technical details are processed by them on our behalf.
Why. To keep the website secure and available, to understand how it is used, and to
respond to you if you contact us.
Our lawful basis. Legitimate interests — running and protecting our website, and
responding to enquiries. For any non-essential cookies, your consent.
2.2 If you enquire about our services
What we collect. Your name, business name, email address, telephone number, service
address where relevant, and the content of your enquiry. For broadband and connectivity
enquiries we may also check line availability at an address, which involves passing the
address to a supplier.
Why. To respond to you, prepare a quotation, and check whether we can actually supply
what you are asking for.
Our lawful basis. Steps taken at your request before entering a contract. Where you are
not the contracting party — for example you are an employee of a prospective customer —
legitimate interests in responding to business enquiries.
If you don’t go ahead, we keep your enquiry for 12 months in case you come back to us,
then delete it.
2.3 If you become a customer
What we collect. Contact details for the people we deal with at your organisation; billing
and payment details including bank details for Direct Debit; service addresses; account
references and line identifiers; records of the services you take; correspondence with us;
support request history.
Why. To provide the services, bill for them, support you, and keep proper business records.
Our lawful basis. Performance of our contract with you. For billing records, legal
obligation. For service improvement, security and recovering money owed, legitimate interests.
2.4 If you contact our support team
What we collect. Your name, contact details, the content of your request, and records of
what we did about it. Where we attend remotely or on site, notes of the work carried out.
We do not record telephone calls. Where you leave a voicemail on a service we operate, the
recording is delivered to the relevant mailbox by email and is retained there.
Why. To resolve your request, keep a history so the next person picking it up knows what
has happened, and to improve our service.
Our lawful basis. Performance of our contract, or legitimate interests where you are an
employee of a customer rather than the contracting party.
2.5 If you are a supplier or business contact
What we collect. Name, role, business contact details, and records of our dealings.
Why. To manage the relationship and buy goods and services.
Our lawful basis. Performance of a contract, or legitimate interests in managing supplier
relationships.
2.6 If you apply for a job with us
What we collect. Your CV, contact details, employment history, qualifications, references
and any information you give us during the process.
Why. To assess your application.
Our lawful basis. Steps taken at your request before entering a contract, and legitimate
interests in recruiting.
How long. Six months after the role is filled if you are unsuccessful, unless you ask us to
keep your details for future vacancies.
2.7 Marketing
What we collect. Name, business email address, and your marketing preferences.
Why. To tell you about our services.
Our lawful basis. Consent, or legitimate interests where you are an existing customer and
we are telling you about services similar to those you already have.
You can opt out at any time — use the unsubscribe link in any email, or write to us at the
address above. We will act on it promptly and it will not affect the services you receive.
2.8 If you interact with us on social media
We maintain pages on Facebook, Instagram and LinkedIn.
What we collect. If you message us, comment, or post on our pages, we see what you send
and your public profile information. If you send us an enquiry that way, we may keep it as an
enquiry or support record.
Why. To respond to you and to promote our services.
Our lawful basis. Legitimate interests — responding to people who contact us and promoting
our business.
What we do not control. These platforms process your data under their own terms, for their
own purposes, and we have no control over that. The statistics they give us about our page
audience are produced by the platform from data it holds about you; for those statistics we and
the platform are jointly responsible, but only the platform can tell you how the underlying
data is processed. If you want to understand or object to that, you need to go to the platform
itself. We would also say plainly that a social media platform is not a private channel — if
your enquiry involves anything confidential, email or phone us instead.
2.9 If you bring a device to us for repair or data transfer
This applies whether you are a business or a member of the public.
What we collect. Your name and contact details, details of the device and the fault, and a
record of the work we carry out. Where you ask us to transfer or recover data, or where we need
to protect your data before working on a device, a copy of the data on that device. Where
the work requires us to sign in, the password or PIN you give us — written on paper, kept
physically with your device, and destroyed when the work is finished. We do not record it on
a computer or in our systems.
Why. To carry out the work you have asked us to do, and to be able to answer questions
about it afterwards.
Our lawful basis. Performance of our contract with you. Where you are not the person we
contract with, our legitimate interests in carrying out the work requested.
What is on your device. A device holds whatever its owner has put on it, which can include
health information, financial details, photographs and private correspondence. We do not go
looking. Our technicians open only what is necessary to carry out and check the work, and
everyone working for us is under a duty of confidence. The one exception is content we are
obliged by law to report, which is not within our discretion.
How long. The copy of your data is held on encrypted storage and deleted within 7 days
of your device being returned. The paper record of any password you gave us is destroyed when the work is complete.
The job record — what the fault was and what we did — is kept as part of your customer record.
We recommend changing your password after you collect your device.
3. Where your data comes from
Mostly from you directly. We also receive data:
- From your employer or the organisation you work for, where they are our customer and have
given us your details as a contact - From suppliers, where they tell us about an order, fault or service affecting you
- From publicly available sources such as Companies House and your own website
- From our website and the systems we use to deliver services
4. Who we share it with
We share personal data with:
Our suppliers and service providers, where they need it to deliver something to you or to
us. This includes connectivity suppliers who need service address details to place an order,
software vendors whose platforms we administer on your behalf, and our own business systems.
Our professional advisers — accountants, insurers and, if needed, lawyers.
Payment providers and our bank, to collect payments due.
Public authorities, where we are required by law to disclose information.
A purchaser, if we sell or reorganise our business, in which case your data would transfer
with it.
We do not sell personal data, and we do not share it for other organisations’ marketing.
A full list of the third parties who process customer data on our behalf when we deliver
services is published on our Subprocessor page.
5. International transfers
Most of the data we hold stays in the UK. Some of the platforms we use are operated by
companies based outside the UK, principally in the United States and the European Union.
Where personal data is transferred outside the UK, we rely on:
- UK adequacy regulations, where the destination country is covered by them; or
- the International Data Transfer Agreement, or the UK Addendum to the EU Standard
Contractual Clauses, together with a transfer risk assessment where required.
Our Subprocessor page identifies which suppliers involve a transfer and
the safeguard that applies.
6. How long we keep it
| What | How long |
|---|---|
| Website logs | 30 days |
| Copies of data from a device brought in for repair or transfer | 7 days after the device is returned |
| Device passwords or PINs given to us for workshop work | Held on paper with the device; destroyed on completion of the work |
| Workshop job records — the fault and the work done | Part of your customer record, 6 years after the relationship ends |
| Enquiries that do not become customers | 12 months |
| Customer records and correspondence | 6 years after the relationship ends |
| Invoices, accounting and tax records | 6 years from the end of the accounting period, as required by the Companies Act 2006 and HMRC |
| Support request history | 6 years after the relationship ends |
| Unsuccessful job applications | 6 months |
| Marketing preferences | Until you opt out, plus a record of the opt-out so we can honour it |
Where we no longer need personal data we delete it or anonymise it. Data held in backups is
deleted when the backup set reaches the end of its retention cycle.
7. How we protect it
We take appropriate technical and organisational measures to protect personal data. These
include access controls, multi-factor authentication, encryption in transit, endpoint
protection, security monitoring and backup.
Our Security page describes our approach in more detail.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data — that is what this notice is for
- Access the personal data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — have your data deleted, in certain circumstances
- Restrict processing — limit how we use your data, in certain circumstances
- Data portability — receive your data in a portable format, in certain circumstances
- Object to processing based on legitimate interests, and to direct marketing at any time
- Not be subject to automated decision-making that produces legal or similarly significant
effects. We do not make decisions of this kind.
To exercise any of these, write to us at dataprotection@pc-q.co.uk. We will respond
within one month. If your request is complex we may extend that by a further two months, and
we will tell you if so.
These rights are not absolute and some do not apply in all circumstances. If we cannot do what
you have asked, we will explain why.
If you are an employee or customer of one of our customers and your data is in a system we
administer on their behalf, we will usually need to direct your request to them, because it is
their data and they decide what happens to it. We will tell you who to contact.
9. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at
dataprotection@pc-q.co.uk — we would rather have the chance to put it right.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113
ico.org.uk/make-a-complaint
10. Changes to this notice
We review this notice at least annually, and whenever our processing changes materially. The
version and date at the top tell you when it was last updated. Where a change materially
affects you, we will tell you directly.