Privacy policy

Effective 30 October 2026

This policy explains what personal data PCI Booking collects through pcibooking.net and through enquiries made on it, why, who else handles it, how long we keep it, and your rights.

Who we are

PCI Booking LTD, 3rd Floor, Ulysses House, Foley Street, Dublin 1, D01 W2T2, Ireland, registered in Ireland under company number 621855 ("PCI Booking", "we"). For the personal data described in this policy, we are the controller.

What this policy does not cover. When our customers use PCI Booking to take, store or send card details, we handle that data on their behalf, under our agreements with them. In that case the customer is responsible for telling the people concerned how their data is used, and their own privacy policy applies. Our GDPR page explains how we work as a processor.

What we collect

When you send a form

Our forms are the contact form ("Talk to us"), the sandbox request form and the self-assessment form. They ask for:

• your name, work email address and phone number;
• your company name (sandbox form);
• your message (contact form).

With each form, we also record the page you sent it from and, if you arrived from one of our "Request pricing", "Request documents" or similar links, the reason in that link. The forms check that a person, not a bot, is sending them, using a spam check that gives each submission a score.

When you email or call us

What you send us: your name, contact details and the content of your message.

When you browse the site

• With your consent only: how you use the site (pages viewed, how you arrived, device and browser type, approximate location from your IP address, whether you sent an enquiry), through our analytics provider; and which company your visit comes from, through our visitor-identification provider. Our cookie policy lists the cookies involved. You decide through the cookie banner, and can change your mind with "Cookie settings" at the bottom of every page.
• Always: our hosting and network providers keep technical logs of requests to the site (IP address, browser, the page requested and the time), to deliver the site and protect it from attacks.

We do not collect special categories of data (such as health or religion) through the site, and the site is not meant for children.

Why we use it, and on what legal basis

Purpose	Legal basis
Replying to your enquiry, setting up a sandbox, preparing a quote or sending the documents you asked for	Steps you asked us to take before a possible contract; otherwise our legitimate interest in answering business enquiries
Following up with your company about our services	Our legitimate interest in developing business with companies that have shown an interest. You can object at any time, and we will stop
Understanding how the site is used, and which companies visit it	Your consent, given through the cookie banner. You can withdraw it at any time
Keeping the site and forms secure, and stopping spam	Our legitimate interest in protecting the site
Keeping records the law requires, and handling legal claims	Legal obligations; our legitimate interest in defending claims

We do not sell personal data, and we do not use it for automated decisions with legal or similar effects on you.

Who else handles it

We use these kinds of provider to run the site and handle enquiries. They act on our instructions:

Provider	What it does for us
Our CRM provider	Our forms run on it and enquiries are stored in it
Our visitor-identification provider	Identifies the companies behind visits, with your consent
Our analytics provider	Measures how the site is used, with your consent. Analytics loads only after you consent
Our spam-check provider	Checks that a person, not a bot, is sending a form
Our hosting provider	Hosts the website
Our network and security provider	Delivers the site and protects it from attacks

Our cookie policy lists the cookies set on the site and who sets them.

We may also share personal data with professional advisers, with authorities where the law requires it, or with a buyer if the business is sold, under the same protections.

Transfers outside the European Economic Area

Some of these providers handle data outside the EEA, in particular in the United States. Where they do, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework, for providers certified under it) or by the European Commission's standard contractual clauses.

How long we keep it

Data	Kept for
Enquiries and the contact details sent with them	As long as we need them to deal with your enquiry and any discussion that follows. If you do not become a customer, we delete them once that discussion has ended
Analytics data	14 months
Cookie choice	182 days
Technical logs	As set by our hosting and network providers

Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it;
• delete it;
• limit how we use it;
• give it to you, or another organisation, in a portable format;
• stop using it, where we rely on our legitimate interest, including for following up with your company.

Where we rely on your consent, you can withdraw it at any time, through "Cookie settings" for cookies, without affecting what we did before.

To use any of these rights, contact us (below). We reply within one month. You can also complain to the Data Protection Commission in Ireland (dataprotection.ie), or to the authority where you live or work.

Security

We protect personal data with technical and organisational measures. PCI Booking is certified to ISO/IEC 27001:2022 and assessed as a PCI DSS Level 1 service provider.

Changes to this policy

We update this policy when how we handle personal data changes. The date at the top shows the latest version.

Contact

Email support@pcibooking.net, or write to us at the address below.

PCI Booking LTD, 3rd Floor, Ulysses House, Foley Street, Dublin 1, D01 W2T2, Ireland. Registered in Ireland, company number 621855.