Privacy Notice

Welcome to the Paul David Enterprises t/a Boards Direct Privacy Notice.

Boards Direct respects your privacy and is committed to protecting your personal data. This privacy notice informs you how we collect, process, and store your personal data when you visit our website and use our services. It also outlines your rights regarding your data and how the law protects you.

1. Important Information and Who We Are

Purpose of this Privacy Notice

This privacy notice explains how Boards Direct collects and processes your personal data through your use of this website, including any data you provide when you create an account, sign in, or make a purchase.

This website is not intended for children, and we do not knowingly collect data from children.

Please read this notice along with any other notices provided when we collect personal data, so you are fully aware of how and why we use your data. This notice supplements other notices and is not intended to override them.

Controller

Paul David Enterprises t/a Boards Direct is the controller responsible for your personal data (referred to as "we," "us," or "our" in this privacy notice).

If you have any questions or would like to exercise your rights, please contact our Data Privacy Manager using the details below.

Contact Details:

• Name: Robin Smith (Managing Director)
• Postal Address: Unit 4 Poplars Court, Nottingham NG7 2RR, United Kingdom
• Telephone: 0800 612 5432
• Email: sales@boardsdirect.co.uk

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). However, we encourage you to contact us first so we can address your concerns directly.

Date Last Amended: 1st April 2026

2. Data We Collect About You

Personal Data means any information about an individual from which they can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: First name, last name, username, title, date of birth, and gender.
• Contact Data: Billing address, delivery address, email address, and telephone numbers.
• Financial Data: Bank account and payment card details.
• Transaction Data: Details about payments to and from you, and details of products and services purchased.
• Technical Data: IP address, browser type and version, operating system, and device information used to access the website.
• Profile Data: Your username, purchases, interests, preferences, feedback, and survey responses.
• Usage Data: Information on how you use our website and services.
• Marketing and Communications Data: Your preferences for receiving marketing from us and your communication preferences.
• Bot Protection Data: Risk scores and interaction signals generated by Google reCAPTCHA v3 to help us distinguish legitimate users from automated bots. See Section 4 for details.
• Aggregated Data: Statistical or demographic data derived from personal data, which does not directly identify you.

We do not collect any Special Categories of Personal Data (such as data about race, religion, or health) or information about criminal convictions.

3. How We Collect Your Data

We collect data from you through:

• Direct Interactions: When you fill in forms, correspond with us by email or post, or create an account.
• Automated Interactions: As you interact with our website, we collect Technical Data through cookies, server logs, and other similar technologies.
• Google reCAPTCHA v3: Our website uses Google reCAPTCHA v3 to protect our contact forms and checkout from automated abuse. reCAPTCHA v3 works silently in the background — it does not display a challenge to users but instead analyses your interactions with our website (including IP address, mouse movements, and browsing behaviour on our site) to generate a risk score. This data is transmitted to and processed by Google. By using our website you acknowledge this processing. Google’s Privacy Policy applies: policies.google.com/privacy.
• Third Parties: We may receive data about you from third-party providers, including payment services, delivery services, and analytics providers.

4. How We Use Your Data

We will only use your personal data when the law allows us to. The most common purposes for processing your data include:

• Contractual Necessity: To process your orders and payments, manage your account, and provide customer support.
• Legitimate Interests: To manage and improve our services, protect our website from fraud and abuse, and communicate with you.
• Legal Obligation: To comply with legal and regulatory requirements.

Specific purposes include:

• Registering you as a customer
• Processing and delivering your orders
• Managing payments and recovery of outstanding payments
• Managing our relationship with you, including notifications and surveys
• Protecting our website and forms from spam and automated abuse using Google reCAPTCHA v3 (on the basis of our legitimate interests in maintaining website security and preventing fraud)
• Conducting marketing and advertising
• Handling customer service and product enquiries

We do not rely on consent as the primary basis for processing data, except for direct marketing communications.

5. Data Sharing

We may share your personal data with internal group companies and external third parties who help us carry out our business functions, such as payment processors, delivery providers, and customer service platforms. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process it for specified purposes in accordance with our instructions.

External Third Parties

Name	Type of Service	Data Processed
Google (Analytics, Ads, reCAPTCHA)	Analytics, advertising, cloud storage, bot protection	Technical Data, Usage Data, IP address, browser data, reCAPTCHA risk scores, and occasional instances of customer name and email address on internally-shared documents.
Payvector	Payment processor	Customer name, address, and card information for the purpose of payment processing.
PayPal	Payment processor	Customer name, address, and card information for the purpose of payment processing.
Braintree	Payment processor	Customer name, address, and card information for the purpose of payment processing.
Tawk.to	Live chat service	Internal messaging that may include customer name and email address for the purpose of support.
Zoho Desk	Customer service management	Customer name, address, and ticket details for managing support and service requests.
Trustpilot	Review gathering	Customer name and email address for the purpose of requesting and gathering reviews.
Sage	Accountancy software	Customer details including name, address, and email address.
DPD	Delivery and logistics	Customer name, address, email address, and telephone number for the purpose of order delivery and tracking notifications.
HM Revenue & Customs / other regulators	Regulatory reporting	Such personal data as required by law for tax, accounting, and regulatory compliance.

6. International Transfers

We may transfer your personal data outside the United Kingdom (UK). Whenever we do so, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

• We will only transfer your personal data to countries that the UK government has deemed to provide an adequate level of protection for personal data.
• Where we use certain service providers, we may use specific contracts (such as the UK International Data Transfer Agreement or Addendum) which give personal data the same protection it has in the UK.
• Where we use providers based in the US, we may transfer data to them under the UK-US Data Bridge, which requires them to provide a similar level of protection to personal data transferred between the UK and the US.

Please contact us if you require further information on the specific mechanism used when transferring your personal data internationally.

7. Data Security

We have implemented appropriate technical and organisational measures to safeguard your personal data from accidental loss, unauthorised access, alteration, or disclosure. Access to your personal data is limited to those who need it for legitimate business purposes, and they are required to treat it confidentially. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. By law, we must keep basic customer information (including contact, identity, financial, and transaction data) for a minimum of six years after our business relationship ends, for tax purposes.

In some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your Legal Rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Access: You can request a copy of the personal data we hold about you.
• Correction: You can ask us to correct any inaccurate or incomplete data.
• Erasure: You can ask us to delete your data where there is no good reason for us continuing to process it.
• Object: You can object to processing based on legitimate interests or for direct marketing purposes.
• Restriction: You can request that we suspend processing of your data in certain circumstances.
• Portability: You can request the transfer of your personal data to you or a third party in a structured, machine-readable format.
• Withdraw Consent: You can withdraw consent to data processing at any time where consent is the legal basis for processing.

You will not normally be charged a fee to exercise your rights. We may need to verify your identity before responding to a request. We aim to respond to all legitimate requests within one month.

10. Cookies and Google reCAPTCHA

Our website uses cookies to improve your experience and to protect our site from abuse. For full details of the cookies we use, please see our Cookie Policy.

Our website uses Google reCAPTCHA v3 (operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to protect our forms and checkout from spam and automated bot activity. reCAPTCHA v3 analyses user interactions silently in the background and generates a risk score — no puzzle or tick-box is displayed to users. The data collected is processed by Google in accordance with Google’s Privacy Policy and Terms of Service. This processing is carried out on the basis of our legitimate interests in maintaining website security and preventing fraud.

11. Contact Us

If you have any questions about this privacy notice or would like to exercise your rights, please contact us:

• Email: sales@boardsdirect.co.uk
• Phone: 0800 612 5432
• Post: Unit 4 Poplars Court, Nottingham NG7 2RR

This privacy notice is effective as of 31st March 2026.