Privacy Policy

A1 PPE is the data controller for personal data collected through this website. We are based at Ground Floor, International House, Pant Industrial Estate, Dowlais, Merthyr Tydfil, CF48 2SR.

• Account data — name, email address and password (stored hashed).
• Order data — billing and delivery address, telephone number, items ordered, order value and order history.
• Payment data — handled entirely by Stripe. We receive confirmation of payment and the last four digits and card type only; we never see or store your full card number.
• Enquiry data — the name, contact details, company and message you submit through our contact or bulk-order forms.
• Technical data — IP address, device and browser information, and pages visited, collected in server logs for security and reliability.

• To take payment for, fulfil and deliver your order, and to handle returns and refunds.
• To send transactional emails such as order confirmations and despatch notifications.
• To respond to contact and bulk-order enquiries and provide quotations.
• To maintain your account, order history and saved addresses.
• To keep accounting and VAT records as required by law.
• To protect the site against fraud, abuse and technical faults.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

• Contract — processing orders, deliveries, returns and account management.
• Legal obligation — retaining transaction and tax records.
• Legitimate interests — responding to enquiries, securing the site and preventing fraud.
• Consent — where you opt in to marketing. You can withdraw consent at any time.

We share the minimum data necessary with the following categories of processor:

• Stripe — payment processing.
• Delivery carriers — name, delivery address and contact details so your order can be delivered.
• Hosting and database providers — secure storage and operation of this website.
• Email provider — sending transactional order and enquiry emails.

We may also disclose data where required by law or to establish, exercise or defend legal claims. Where a provider processes data outside the UK, transfers are covered by UK adequacy regulations or standard contractual clauses with the UK addendum.

This site uses only cookies and local storage that are strictly necessary to make it work: keeping you signed in, remembering your basket and recently viewed items, and allowing Stripe to process payment securely. We do not use advertising cookies or third-party tracking or analytics cookies, so no cookie consent banner is required. You can clear or block cookies in your browser, though parts of the site — including checkout — will stop working.

• Order and transaction records: six years from the end of the relevant financial year, to meet HMRC record-keeping requirements.
• Account data: kept for as long as your account is open, then deleted on request or after a prolonged period of inactivity.
• Enquiry correspondence: up to 24 months after the enquiry is closed.
• Server and security logs: a short rolling period, typically no more than 90 days.

The site is served over HTTPS. Passwords are stored using industry-standard hashing and card details never reach our systems. Access to order and customer records is limited to authorised A1 PPE staff, enforced by role-based access controls and row-level database security.

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• request erasure where we no longer need the data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent to marketing at any time.

To exercise any of these rights, email info@a1ppe.uk. We respond within one month.

Privacy queries: info@a1ppe.uk · Phone 01685 701460

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.