GDPR Policy
Data Protection Policy (UK GDPR)
Last updated: 3 November 2026
1. Purpose
Summer Valley PCs is committed to protecting customers' personal information and complying with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
This policy explains how personal information is handled within the business and the measures taken to keep it secure.
2. Scope
This policy applies to personal information received through our website, telephone, email, in person or during computer repairs and technical support.
3. Personal Information We Process
Depending on the service provided, this may include names, addresses, telephone numbers, email addresses, device details, repair history, passwords supplied for repairs, diagnostic information and payment or invoicing records.
We only collect information necessary for legitimate business purposes.
4. Lawful Basis for Processing
We process personal information where necessary to:
- Provide repairs or technical support under a contract.
- Respond to enquiries and manage our legitimate business interests.
- Comply with legal and accounting obligations.
- Carry out activities for which consent has been obtained, where consent is required.
5. Protecting Customer Information
Customer information is treated confidentially. Access to personal files during repairs is limited to what is necessary to diagnose or complete the requested work.
Information is only shared where required by law, necessary to provide a service, or authorised by the customer.
6. Passwords and Device Security
Passwords supplied for repairs or testing are used only for those purposes, handled securely and not retained longer than necessary.
7. Storage of Information
Customer records are protected through appropriate technical and organisational security measures. Paper records are stored securely and disposed of confidentially when no longer required.
8. Data Retention
We retain personal information only as long as necessary to complete repairs, provide warranty or after-sales support, meet legal or tax obligations, and resolve disputes.
Information no longer required is securely deleted or destroyed.
9. Customer Rights
Under applicable data protection law, customers may have rights to access, correct or erase personal information, restrict or object to processing, request data portability and withdraw consent where processing relies on consent.
Requests are normally answered within one calendar month, subject to applicable legal exceptions.
Customers may complain to the Information Commissioner's Office (ICO).
10. Data Breaches
Suspected personal data breaches are investigated promptly. Where a breach is likely to result in a risk to individuals' rights and freedoms, the ICO will be notified without undue delay and, where feasible, within 72 hours of becoming aware of it.
Affected individuals will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms, where legally required.
11. Responsibility
Adrian Scott, owner of Summer Valley PCs, is responsible for maintaining appropriate data protection standards within the business.
12. Policy Review
This policy is reviewed periodically and updated when legislation or business practices change.
Contact
Summer Valley PCs
32 Aberdyberthi Street
Hafod
Swansea
SA1 2LL
Email: adrian@summervalleypcs.co.uk