Crossbows.co.uk Privacy Policy

This website Crossbows.co.uk is owned and operated by PJS (UK) Ltd (“we”, “us”). We value your privacy and handle your personal data securely and only as much as is required to fulfil our contract to process your order and have it delivered to you or collected by you.

What we collect and why

  • Order and account details (name, email, phone, billing/delivery addresses, order contents) — to take and fulfil customer orders, provide updates, and manage your account.
  • Age and identity verification data (primary) — clear images of your passport or driving licence and a selfie holding the same ID; used to meet our legal obligations for age-restricted goods and to evidence compliance.
  • Age corroboration (secondary) — where appropriate we may use AgeChecked to verify age using your name, date of birth and address only.
  • Courier delivery data (name, address, contact number/email) — to deliver your order and provide delivery notifications.
  • Website usage and cookies — to operate the site (e.g. basket, login) and improve user experience and site performance (see “Cookies”).
  • Marketing (optional) — if you opt in, we use your email to send news and special offers; you can unsubscribe at any time.

How we verify age

Primary method: We request a clear photo of your passport or driving licence and a selfie holding the same ID. You can upload these securely during checkout or in My Account > My ID. We record successful checks so that you are not asked again unnecessarily.

Secondary method: We may also use AgeChecked for additional assurance, which uses your name, date of birth and address only.

Security and storage: Uploads are protected via SSL/TLS in transit and stored on an encrypted filesystem on our dedicated server. Access is via strict role-based controls and access logging. ID images are stored separately from our main commerce database and subject to automated deletion via lifecycle rules as described below. These documents are never shared with anyone else unless we are legally required to disclose them (for example, to law enforcement).

Courier checks: For age-restricted items, the courier (DPD, Royal Mail, ParcelForce) will verify age at delivery and may request valid photo ID at the doorstep.

ID Images & Data Protection

Some customers prefer not to upload images of their ID. We understand, and we want to be clear about why we ask for them and how we protect them.

What we collect

For age-restricted purchases, our primary method is a clear photo of your passport or driving licence and a selfie holding the same ID (to match the photo to you). You can upload these securely during checkout or in My Account > My ID. Where appropriate, we may also run a secondary age corroboration check with AgeChecked using your name, date of birth and address only.

Why we collect it (purpose limitation)

  • Legal compliance: to meet UK legal obligations on the sale and delivery of age-restricted goods and to evidence that we completed appropriate checks.
  • Fraud prevention & safety: to protect customers and our business from misuse of age-restricted products.

How we protect your images

  • In transit: uploads are protected with SSL/TLS.
  • At rest: images are stored on an encrypted filesystem on our dedicated server and segregated from our main commerce database.
  • Access controls: access is strictly limited to trained staff on a need-to-know basis, and all access is logged.
  • Automated deletion: object-lifecycle rules enforce timely deletion (see retention below).
  • No sharing: ID images are never shared with any third party unless we are legally required to disclose them (for example, to law enforcement).

How long we keep ID images (retention)

Default retention: We keep ID images/selfies for 30 days from upload, then delete them automatically. This short window supports dispute/chargeback handling and basic fraud review while minimising risk.

Extended retention (case-by-case): If an order is flagged, a complaint or chargeback is raised, we receive a police or Trading Standards inquiry, or our legal counsel issues a legal hold, we will extend retention for the relevant items only until the matter is closed, then resume deletion. We document the reason under legitimate interests and/or defence of legal claims.

Your choices & alternatives

  • Use AgeChecked: if you would prefer not to upload images, contact us before ordering. Where suitable, we can attempt a secondary AgeChecked verification (name, date of birth & address only). If successful, we may not need ID images.
  • Age-verified delivery: all age-restricted items require an age check by the courier (DPD, Royal Mail, or ParcelForce) at the doorstep. This is in addition to our legal obligations to verify age before dispatch.
  • If verification is declined: we may not be able to process or dispatch your order.

Lawful bases

  • Legal obligation: verify age/identity and keep evidence of compliance.
  • Contract: process and deliver your order.
  • Legitimate interests: maintain appropriate verification records, prevent fraud, and establish, exercise or defend legal claims (including documented legal holds).

Your rights

You can request access to your personal data, ask us to correct inaccuracies, or request deletion. Some rights may not apply where we must keep data to meet a legal obligation or to establish, exercise, or defend legal claims. To exercise your rights, please contact support@pjsuk.ltd.uk.

Who we share data with

  • AgeChecked — for secondary age verification using name, date of birth and address only. We do not share your ID images with AgeChecked.
  • Couriers — DPD, Royal Mail, and ParcelForce receive delivery details to deliver your order and provide tracking/notifications. For age-restricted items, they verify age at delivery.
  • Payment providers — PCI DSS Level 1 compliant processors (e.g., card processors and PayPal). We do not store your full card details.

We do not sell your personal data. We do not share your ID images with any third party unless required by law.

Cookies

Cookies are used on this site where they are necessary for the site functionality. They aid navigation and keep track of the contents of your shopping cart. If you log in to an account, your logged-in status is recorded in a temporary cookie. If you select the ‘Remember Me’ option in checkout, a cookie will be used to remember your details.

We also make use of Google Analytics in order to better understand our customers and optimise our site for a better customer experience. Google Analytics sets cookies in order to function. We use Google Analytics in a mode which does not store personal details of website visitors — your IP address is anonymised.

You can turn off cookies by blocking them in your browser privacy settings. If you turn off cookies, you will be unable to place orders or benefit from the other features that use them.

Lawful bases

  • Contract — to take payment, fulfil your order, provide customer service, and manage your account.
  • Legal obligation — to verify age and identity for age-restricted goods and to maintain records demonstrating compliance.
  • Legitimate interests — to keep appropriate transaction/verification records, protect our business and customers, and defend legal claims.
  • Consent — for optional marketing emails. You can withdraw consent at any time via the unsubscribe link or by contacting us.

Data retention

Orders & accounts: Order records are retained to meet legal, tax, and accounting requirements.

ID images: Where supplied, ID images/selfies are retained for 30 days by default and then automatically deleted. If an order is flagged, there is a complaint/chargeback, we receive a police or Trading Standards inquiry, or our counsel issues a legal hold, we may extend retention for the relevant items only until the matter closes. We document the reason under legitimate interests/defence of legal claims, after which deletion resumes.

Security

Our website uses SSL/TLS to protect your data in transit. Our servers are dedicated to our company. ID images are stored on an encrypted filesystem, segregated from our commerce database, protected by role-based access with access logging, and removed via automated lifecycle deletion when the retention period ends.

Your rights

Subject to applicable law, you may have rights to access, rectify, erase, or restrict your personal data, and to object to processing. You can also lodge a complaint with the ICO. To exercise your rights, or for any questions, please contact us at support@pjsuk.ltd.uk.

Changes to this policy

If we decide to change our Privacy Policy, we will post the changes on this page so you know what information we collect and how we use it. If we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will tell you and you will have a choice as to whether or not we use your information in this different manner.

Last updated: 7 October 2025