Last updated: 12 October 2026
PAC Supplies Global Limited respects your privacy. This policy explains how we use personal information when you visit pacsupplies.co.uk, contact us, place an order or request a personalised product.
We handle personal information under applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended.
This policy provides information about our practices. Using our website or placing an order does not, by itself, constitute consent to processing that requires separate consent.
PAC Supplies Global Limited is the controller of personal information used for the purposes described in this policy.
Company number: 10209766
Registered in: England and Wales
Registered office: Staple House, 5 Eleanors Cross, Dunstable, England, LU6 1SU
For privacy enquiries, requests or complaints, contact:
Email: sales@pacsupplies.co.uk
Telephone: 01582 260110
Correspondence address: Unit B, Batford Mill Industrial Estate, Lower Luton Road, Harpenden, Hertfordshire, AL5 5BZ, United Kingdom
Depending on your purchase or enquiry, we collect information such as:
Your name, email address and telephone number.
Billing and delivery addresses.
Company details where you purchase for a business.
Products ordered, payment status, transaction references and invoice details.
Enquiries, correspondence, delivery issues, returns and refunds.
Artwork, wording, names and contact details supplied for personalised products.
Emergency-contact or health-related information where supplied for a relevant product.
Account information where you create a website account.
Technical information needed to operate and protect the website, such as IP addresses, browser details and security logs.
Please provide only the information needed for your order. Do not include full payment-card details or unnecessary medical information in emails or order notes.
We usually receive information directly from you through orders, emails, website forms and other communications.
We may receive transaction or delivery information from payment providers, couriers or a marketplace through which you purchase.
A purchaser may provide another person’s information for delivery or personalisation. Where required, we will provide that person with the relevant privacy information within the applicable legal timescale, unless a lawful exception applies.
If you supply someone else’s details, you should be entitled to do so and inform them where appropriate. We remain responsible for establishing a lawful basis for our own use of their information.
Processing orders and providing customer support
We use information to respond to enquiries, prepare quotations, process purchases, produce personalised goods, arrange delivery and manage returns, refunds or complaints.
Where you are the customer, we normally rely on taking steps you request before entering a contract or performing our contract with you.
Where you represent a business customer, we generally rely on our legitimate interests in managing that business relationship.
Invoices, accounting and record-keeping
We use customer and transaction information to issue invoices, reconcile payments and maintain accounting records through Xero.
Our lawful bases are compliance with legal obligations where records are legally required, and our legitimate interests in maintaining accurate business records where appropriate.
Security and fraud prevention
We use relevant information to protect our website and business, investigate suspicious activity and prevent fraud. We rely on our legitimate interests in security and fraud prevention, or a legal obligation where applicable.
Disputes and legal claims
We may retain and use relevant information to establish, exercise or defend legal claims. We rely on our legitimate interests and any applicable legal obligations. Additional conditions apply where the information is special category data.
When relying on legitimate interests, we must consider your rights and reasonable expectations and avoid using more information than necessary.
Customer correspondence and personalisation instructions may be held in our business email system.
Customer, invoice and transaction information is also held in Xero, our accounting platform. Depending on the information supplied and the invoice prepared, invoice records may include personalisation details.
Information may also be held in the systems needed to process website orders, payments and deliveries.
Sensitive information requires particular care. It should not be copied into accounting records merely because it appears in an order email; only information necessary for the relevant purpose should be included.
Some products may involve information about a person’s health, disability or medical condition. Where this relates to an identifiable person, it may be special category personal information.
Processing this information requires both a lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9.
For optional health-related personalisation, we will ordinarily need a separate explicit-consent process before processing the information. Accepting this policy, placing an order or sending an email is not automatically sufficient explicit consent.
If information concerns another adult, the purchaser cannot automatically consent on that person’s behalf. Appropriate arrangements are also needed for children’s information.
We use personalisation information to fulfil the relevant request and for any other specifically justified lawful purpose. We do not use health information to target advertising or promotional communications.
Please supply only the details needed for the chosen product.
We offer PayPal, Apple Pay and Google Pay as payment options.
Payment information is handled through the relevant payment service and, where applicable, its underlying payment processor. Their privacy notices explain the processing for which they are responsible.
We receive information needed to confirm payments, reconcile transactions, issue refunds and investigate payment problems. This may include transaction references, payment status and limited payer information.
Please do not send payment-card numbers or security codes to us by email.
We do not currently send promotional emails or text messages.
We may contact you about an enquiry, order, payment, delivery, return, product-safety matter or other necessary customer-service issue. These communications are separate from promotional marketing.
If we introduce promotional communications in future, we will provide the required information and obtain consent where necessary before sending them.
Our website may use cookies and similar technologies to support functions such as shopping baskets, account sessions and security.
Any analytics, advertising or other optional technologies must be used in accordance with applicable law. Where consent is required, these technologies must not operate before valid consent is obtained.
Information about any optional technologies in use, their purposes, providers and duration must be made available through the website’s cookie information or consent controls.
You can also manage cookies through your browser settings. Blocking cookies needed for essential website functions may affect those functions.
Your decision to visit the website does not, by itself, constitute consent to optional tracking.
Where necessary, we share relevant information with:
Xero, for invoicing and accounting.
Business email and communications providers.
Payment services and their underlying processors.
Couriers and delivery partners.
Website hosting, maintenance, security and IT providers.
Suppliers or production partners involved in fulfilling your order.
Accountants, legal advisers and other professional advisers.
Public authorities where disclosure is legally required or otherwise lawful.
Only information appropriate to the relevant purpose should be shared.
Providers acting as processors on our behalf must be subject to appropriate contractual safeguards. Other organisations may act as independent controllers and have their own privacy notices.
Email, accounting, payment or other service providers may process information outside the United Kingdom.
Where this involves a restricted international transfer, an appropriate legal mechanism must apply. This may include UK adequacy regulations or approved contractual safeguards, together with any required assessment and additional protections.
We do not rely on your acceptance of this policy as consent to an international transfer.
Contact us for information about the safeguards applicable to a particular transfer and how to obtain a copy, subject to appropriate redaction.
We retain information only for as long as necessary for the purpose for which it is held.
The relevant retention period depends on:
Tax, accounting and other legal record-keeping requirements.
The time needed to complete an order and provide after-sales support.
Applicable time limits for legal claims.
Whether a complaint, payment issue or dispute remains unresolved.
The sensitivity of the information.
Whether a less detailed record can fulfil the same purpose.
Accounting records may need to be retained longer than artwork or personalisation instructions. The requirement to retain an invoice does not automatically justify retaining every associated email, medical detail or artwork file.
Information no longer needed should be securely deleted or anonymised. You can contact us for the retention period or criteria applicable to a particular record.
We are required to apply appropriate technical and organisational safeguards to protect personal information from unauthorised access, loss, alteration or disclosure.
These safeguards must reflect the nature and sensitivity of the information, including any health information provided for personalised products.
No online system can guarantee absolute security. This does not reduce our legal responsibilities to protect information and respond appropriately to personal data breaches.
Depending on the circumstances, you may have the right to:
Access your personal information and receive a copy.
Correct inaccurate or incomplete information.
Request deletion.
Restrict how information is used.
Object to processing based on legitimate interests.
Receive qualifying information in a portable format.
Withdraw consent where we rely on it.
Exercise applicable rights concerning automated decision-making.
These rights are subject to legal conditions and exceptions. For example, we may need to retain accounting information required by law.
Withdrawing consent does not affect processing lawfully carried out before withdrawal. If consent is necessary for optional personalisation, withdrawing it may mean we cannot complete that element of the order.
You have an unconditional right to object to the use of your personal information for direct marketing.
Contact sales@pacsupplies.co.uk to exercise your rights. We may request proportionate information to verify your identity or clarify your request.
We normally respond within one month, subject to any lawful extension or adjustment. Requests are generally free of charge; any lawful exception will be explained.
Adults may purchase products containing information about children. Such information requires particular care and an appropriate lawful basis.
Where health information is involved, an additional special-category condition is required. Parental involvement does not remove our own data protection responsibilities.
Contact us if you believe a child’s information has been supplied or handled inappropriately.
If we use solely automated decisions producing legal or similarly significant effects, we will provide the information and safeguards required by law.
Payment providers may carry out their own automated fraud or payment checks. Their privacy notices explain the processing for which they are responsible.
If you have concerns about your personal information, email sales@pacsupplies.co.uk with the subject “Privacy complaint”.
We will investigate and respond in accordance with applicable requirements.
You may also complain to the Information Commissioner’s Office (ICO):
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
You do not need our permission to contact the ICO.
We may update this policy to reflect changes in our practices or the law. The date above identifies the latest revision.
Where required, we will explain material changes and obtain fresh consent before beginning processing that requires it. Updating this policy does not itself authorise a new use of your information.