GDPR & Data Protection

1. Our commitment

PC Workshop Ltd ("PC Workshop", "we", "us") takes data protection seriously — not just the details you type into this website, but the far more personal data that lives on the computers, laptops and Macs you trust us with. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains how, and how to exercise your rights. It sits alongside our Privacy Policy, which covers this website in detail.

2. Who is responsible

PC Workshop Ltd is the data controller for the personal data described here. You can reach us about anything on this page via our contact page, by emailing support@pcworkshop.co.uk, by calling 0191 285 9999, or in person at either workshop (Gosforth or Benton).

3. The personal data we hold

• Contact and account details — name, email address, phone number, and your website account, if you create one.
• Repair and job records — the device you brought in, the fault described, the work carried out, quotes, invoices and payments. We keep these as part of our business records.
• Data on your device — covered separately in section 4, because it matters most.
• Website data — one essential login cookie, and cookie-free aggregate visitor statistics that identify nobody. See the Privacy Policy's cookies section.

4. The data on your device

When you leave a machine with us, everything on it — documents, photos, emails, browsing history, saved passwords — stays yours. Our rules for handling it:

• We access files on your device only as far as the repair requires — for example, verifying that data survived a drive swap, or testing that an application fault is fixed.
• We never copy your files off your device except where the job requires it and you've agreed — typically a backup before risky work, or a data recovery job.
• Where we do hold a copy (backup or recovered data), it is stored on equipment in our workshops, not uploaded to third-party services, and securely deleted once you've confirmed safe receipt of your data.
• If the repair needs your login PIN or password, we use it only to carry out that job — and we recommend changing it once your device is back with you.
• Devices left for disposal or recycling have their storage securely wiped before they leave our hands.

5. Why we're allowed to process it

UK GDPR requires a lawful basis for every use of personal data. Ours are:

• Contract — most processing happens because you've asked us to do a job: repairing your device, building a PC, recovering data, or running your account.
• Legal obligation — we keep invoices and business records for the periods tax law requires.
• Legitimate interests — keeping service history so we can support a device we've worked on before, and keeping our systems secure.
• Consent — anything optional, like linking your website account to your repair history. You can withdraw consent at any time.

6. How long we keep it

• Job records, quotes, invoices and payment history: kept as business records for up to six years, in line with UK tax requirements.
• Website accounts: until you ask us to delete yours.
• Copies of your data held for a backup or recovery job: deleted once you've confirmed safe receipt — they are never kept as a matter of course.
• Contact form and chat messages: kept only as long as needed to deal with your enquiry.

7. How we protect it

Connections to this website and our customer systems are encrypted. Access to customer records is limited to staff who need it, behind individual logins. Devices and any data copies are kept in our workshops, which are secured outside opening hours. Where our systems use hosting providers, we choose reputable providers and apply appropriate safeguards.

8. Your rights

Under UK GDPR you have the right to:

• Be told how your data is used (this page and the Privacy Policy)
• Access a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased, where we no longer have a valid reason to keep it
• Restrict or object to processing in certain circumstances
• Receive your data in a portable format
• Withdraw consent for anything that relied on it
• Not be subject to automated decision-making with legal effects — we don't do any

To exercise any of these, contact us using the details in section 2. We'll respond within one month, and we may need to verify your identity before releasing anything.

9. Complaints

If you're unhappy with how we've handled your data, please tell us first — we'd rather fix it. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.