Last reviewed: 1 October 2026 · In force since: 16 August 2022
1. Who is the data controller
G.A.G Group Ltd, a limited company registered in England & Wales (company number 14300746), with registered office at 61 Bridge Street, Kington, Herefordshire HR5 3DJ, is the data controller for personal data processed via this website and in connection with our services.
2. What personal data we collect
- Order data: name, delivery address, billing address, email, phone number, order history. Needed to fulfil orders and provide customer support.
- Payment data: we do not store full card details. Card payments are processed by our payment provider; we receive only confirmation and the last 4 digits of the card used.
- Enquiry data: any information you give us when you contact us by email or via our contact form.
- Technical data: IP address, browser type and standard access logs when you visit the site. We do not use analytics cookies.
3. Why we process it
- To fulfil orders and construction contracts (legal basis: performance of a contract).
- To comply with legal obligations — HMRC record-keeping, Companies House filings, Anti-Money-Laundering checks (legal basis: legal obligation).
- To reply to your enquiries (legal basis: legitimate interests).
4. Who we share it with
- Our carriers (Royal Mail, Parcelforce, DPD, UPS, Palletways/Palletline) — name and delivery address only.
- Our payment provider — billing name and address for card verification.
- Our bank (Mistertango) — where required for AML / know-your-customer checks.
- HMRC and other regulators — where legally required.
We do not sell your data. We do not share it for marketing purposes.
5. How long we keep it
Order and invoice records: 7 years, as required by HMRC. Enquiry correspondence: 2 years, then deleted. Technical access logs: 90 days.
6. Your rights
You can ask to see what we hold about you, correct it, delete it (where we don’t have an overriding legal reason to keep it), or restrict our processing of it. Email [email protected] and we’ll respond within 30 days.
If you’re unhappy with how we’ve handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk.
7. Cookies
This site uses one strictly-necessary cookie for your shopping basket session. We do not use advertising, analytics or tracking cookies.
8. Changes
If we materially change this policy we will update the ‘last updated’ date above and, for existing customers with an account, notify by email.
