Privacy Policy

1. Data Controller

PNL Metals Ltd
Buttermilk Hall Farm

Buntingford

SG99RH

We are the Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR).

2. Personal Data We Collect

We may collect the following types of personal data:

2.1 Identification & Verification

Full name
Address
Photo identification (e.g., driving licence, passport)
Vehicle registration numbers
Date of birth (if provided for ID purposes)

2.2 Transaction Information

Records of materials bought or sold
Payment details (bank transfer information—no card details are stored)

2.3 Site Security Information

CCTV footage (for crime prevention and safety)
ANPR data (Automatic Number Plate Recognition), if used
Visitor logs

2.4 Communication Data

Emails and messages sent to us
Phone call information (not recorded unless stated)

3. How We Use Your Personal Data

We use your information for:

3.1 Legal & Regulatory Compliance

Complying with the Scrap Metal Dealers Act
Preventing fraud and theft
Providing records to law enforcement when legally required

3.2 Business Operations

Processing transactions
Issuing payments or receipts
Managing customer accounts

3.3 Safety & Security

Monitoring site for security using CCTV
Investigating incidents or accidents

3.4 Communication

Responding to enquiries
Contacting you regarding transactions or issues

We only process personal data where we have a lawful basis to do so (e.g., legal obligation, contract necessity, legitimate interest).

4. Legal Bases for Processing

We rely on the following GDPR legal bases:

Legal obligation – e.g., ID checking as required by law
Contract performance – when buying or selling materials
Legitimate interests – site security, business administration
Consent – only when explicitly obtained (e.g., marketing)

5. How Long We Keep Your Data

We retain personal data only for as long as necessary:

ID verification records: up to 3 years (or as legally required)
Transaction records: 6 years for accounting purposes
CCTV footage: typically 30 days, unless needed for investigation
Communication data: as long as reasonably required to handle enquiries

6. Sharing Your Personal Data

We may share your data with:

Law enforcement or regulatory authorities (when legally required)
Banks and payment service providers
Insurance companies (in the event of an incident or claim)
IT service providers who support our systems
Professional advisers (auditors, accountants, legal counsel)

We do not sell your data to third parties.

7. Data Security

We take appropriate technical and organisational measures to protect personal data, including:

Secure electronic storage
Restricted access to sensitive information
CCTV storage in secure systems
Staff training on data protection

8. Your Data Protection Rights

Under UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate information
Erase your data (in certain circumstances)
Restrict processing
Object to processing based on legitimate interests
Data portability
Withdraw consent (where consent is used)

To exercise your rights, contact:
tom@pnlmetals.com

9. CCTV Usage

We operate CCTV for security, safety, and crime prevention.
Signage is displayed on site to notify visitors.
Footage may be shared with law enforcement when legally required.

10. Transfers Outside the UK

We generally do not transfer personal data outside the UK.
If this becomes necessary, we will ensure appropriate safeguards are in place (e.g., adequacy decisions or contractual clauses).

11. Complaints

If you have concerns about how we handle your data, please contact us first.
You may also complain to the Information Commissioner’s Office (ICO):

www.ico.org.uk

12. Changes to This Policy

We may update this Privacy Policy from time to time.
The latest version will always be available on request or displayed on our premises.

Privacy Policy

This website uses cookies.