Plug-In Solar privacy notice

1. Who controls your information

The Solar Centre Ltd is the data controller

The Solar Centre Ltd, company number 05749088, of 44–46 Coldharbour Lane, Harpenden, Hertfordshire, AL5 4UN controls personal information used by this microsite.

For privacy questions or to exercise a data-protection right, email pi@thesolarcentre.co.uk or telephone 01727 743200.

2. Information we use

Information you provide and limited technical records

• Identity and contact details, including name, email address, telephone number and account details.
• Order information, products, delivery or collection address, instructions, prices, VAT and order history.
• Safety confirmations recorded at checkout, including the copy version and time of acknowledgement.
• Support correspondence, fault reports, photographs and warranty information you choose to provide.
• Security and technical information needed to protect sessions, prevent fraud and operate the site. Raw checkout, sign-in and session tokens are not stored; one-way hashes are stored instead.
• Privacy-reduced basket events used for genuine 48-hour trending counts. We do not store a raw IP address or user-agent string in that event record.

3. Why we use it

Purposes and lawful bases

• Contract: to price checkout, take payment, deliver or prepare collection, send confirmations, manage returns and support your order.
• Legal obligation: to keep tax and accounting records, respond to consumer-rights requests, meet product-safety duties and assist lawful authorities where required.
• Legitimate interests: to secure the microsite, prevent fraud, diagnose faults, improve checkout and show genuine aggregated basket interest, balanced against your rights.
• Consent: where optional cookies or direct marketing require it. Transactional order and account-security messages are not marketing.

4. Who receives it

Service providers needed to complete the order

We share only what is necessary with service providers acting for us or providing their own regulated service. These may include Stripe for hosted payment and receipts; Mailgun for transactional email; delivery and collection partners; Cloudflare for hosting, security and database services; IT, support and professional advisers; and public bodies where the law requires it.

Stripe processes payment information under its own privacy notice. Card details are entered on Stripe’s service and are not stored in our Plug-In Solar database.

We do not sell your personal information.

5. International transfers

Safeguards follow UK data-protection law

Some technology providers may process information outside the United Kingdom. Where this happens, we require an approved transfer mechanism and appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, together with relevant security measures.

6. How long we keep it

Retention is limited by purpose

• Expired checkout drafts are held for no longer than needed to recover checkout and investigate failed payments, then deleted or anonymised under the operational retention schedule.
• Single-use sign-in links expire after one hour; reset links expire after 24 hours; customer sessions expire after 30 days unless replaced or ended sooner.
• Privacy-reduced basket events are used only for the trailing 48-hour signal and are scheduled for deletion after seven days.
• Order, payment, refund and tax records are normally kept for six years after the relevant accounting period, or longer where a warranty, product-safety matter, dispute or law requires it.
• Account and saved-item data is kept while the account is active and then deleted or anonymised, except where a legal or order record must be retained.

7. Your rights

You can ask us about your information

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or an objection to processing. You may withdraw consent where consent is the basis, without affecting earlier lawful use. We may need to verify your identity before responding.

You can complain to the Information Commissioner’s Office at ico.org.uk or telephone 0303 123 1113. We would appreciate the opportunity to address the issue first.

8. Cookies and account security

Essential storage keeps checkout working

Essential cookies store opaque session and checkout credentials, basket state and security preferences. Google Analytics is optional and loads only after you choose Accept analytics. It measures page visits, product views, basket additions, checkout and purchases. Google receives technical visit information and purchase amounts and product details; our tracking does not send your name, email, address, payment details or checkout and sign-in tokens. We keep advertising storage and personalisation off.

Your choice is saved in this browser as ps-analytics-consent-v1. Analytics cookies use the ps_ga prefix, are limited to this site and expire after up to one year. You can reject analytics or withdraw consent at any time using Cookie settings at the bottom of each page. Rejecting analytics does not stop the basket or checkout working. Withdrawing consent removes this site’s analytics cookies. See Google’s privacy notice for its processing information.

Keep emailed sign-in links private. They are single-use credentials and expire automatically.

Partner referrals

Optional garden centre referral tracking

When you follow a garden centre’s link or QR code, we ask before setting the optional ps_referral cookie. If you allow it, we remember the referring centre and link eligible orders to it so we can calculate and reconcile commission. Your price stays the same. We do not give the centre your name, email or full address through this scheme.

We use the delivery postcode as an initial location check. Collection orders and uncertain locations need a separate check of your home postcode. We send only the postcode to Postcodes.io to obtain an approximate location. Distance is measured in a straight line between postcode locations.

The scheme may have no referral expiry, or the centre may have a set referral period. The cookie lasts up to 400 days; your browser may remove it sooner. It does not follow you across devices or after deletion. Allowing a different centre’s referral replaces the previous referral. Use “Withdraw referral consent” below to stop future attribution and remove the cookie. Existing order and commission accounting records remain subject to our normal accounting retention period.

Declining or withdrawing this consent does not stop you browsing or buying. Referral consent is separate from analytics and marketing consent.

9. Updates

We publish material changes here

The version date at the top identifies this notice. We will update it when the checkout, processors or purposes materially change. The Plug-In Solar terms separately explain the sales contract.