Privacy Policy

1. Who we are

Professional Clothing Industry Association Worldwide Ltd, trading as PCIAW® (“PCIAW”, “we”, “us” or “our”), is the controller of personal information described in this notice unless a separate notice says otherwise.

Registered office: 1st Floor, North House 3, Bond Avenue, Bletchley, Milton Keynes, Buckinghamshire, England, MK1 1SW
Company number: 11086791
VAT number: GB 286 0247 94
Privacy contact: info@pciaw.org

This notice covers our website, member portal and directories, memberships, events, awards, publications, advertising, sponsorship, forms, ecommerce and other services. Where we collect information for a specific activity, a shorter notice at the point of collection may supplement this notice.

2. Information we collect and how we obtain it

Depending on your relationship with PCIAW, we may collect:

• Identity and business details: name, title, employer, role, company number, VAT number and professional profile information.
• Contact details: business or personal email, telephone number, postal address and communication preferences.
• Membership and account details: membership tier, organisation, authorised users, login records, directory profile and support history.
• Transaction details: orders, bookings, invoices, payment status, refunds, credits and limited payment-authorisation information. PCIAW does not receive or store complete card numbers where a payment processor handles them.
• Event and application details: attendee names, dietary or accessibility requirements, award entries, supporting files, speaker or exhibitor information and attendance records.
• Communications: enquiries, feedback, complaints, survey responses and records of calls, emails or meetings.
• Technical information: IP address, device and browser information, security logs, pages visited, referral source and cookie or consent choices.
• Special category information: only where needed, for example health, allergy or accessibility information for an event, and only with an appropriate legal condition and safeguards.

We obtain information directly from you; from your employer, colleagues or another authorised contact; through our website, member portal, forms and payment links; from event partners and suppliers; from public professional sources; and from service providers that support our operations. If another person gives us your details, we expect them to be authorised to do so and we provide privacy information as required.

3. Why we use personal information and our lawful bases

Purpose	Typical lawful basis
Process membership applications, administer accounts, deliver benefits and manage renewals	Contract; legitimate interests in administering a corporate membership; legal obligation where applicable
Take orders, payments and bookings; provide tickets, services, publications and invoices	Contract; legal obligation for tax and accounting; legitimate interests in fraud prevention and debt recovery
Run events, awards, exhibitions, steering groups and webinars	Contract; legitimate interests; consent or explicit consent where needed for optional or sensitive information
Operate member directories and route member-to-buyer enquiries	Contract; legitimate interests; consent where a person or organisation chooses optional publication
Answer enquiries, resolve complaints and maintain service records	Legitimate interests; contract; legal obligation
Protect accounts, prevent misuse, maintain security and diagnose faults	Legitimate interests; legal obligation
Measure and improve the website using non-essential analytics	Consent where PECR requires it; legitimate interests only where lawful and compatible
Send optional newsletters and electronic marketing	Consent where required; legitimate interests for appropriate business-to-business communications where PECR permits, always with an opt-out
Meet legal, regulatory and governance requirements or establish legal claims	Legal obligation; legitimate interests

When we rely on legitimate interests, we consider the purpose, necessity and impact on the individual. You may object to processing based on legitimate interests. We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects.

4. Platforms, payments and service providers

We use carefully selected providers to operate PCIAW. They may act as our processors, independent controllers or payment technology providers depending on the service:

• HubSpot: CRM, hosted forms or payment links, checkout, transaction records and order confirmations. HubSpot Checkout supplies payment technology; PCIAW remains responsible for the underlying goods or services. HubSpot and its payment processor may receive contact, billing, address, authorisation and transaction details.
• WooCommerce and WooPayments: website store, checkout, order administration and payment processing.
• Xero: accounting, invoice creation and financial record keeping. A Xero invoice may follow a HubSpot payment confirmation.
• WPForms: website forms, file uploads and save-and-resume functionality. A saved draft link is personal and should not be shared; form drafts are configured to expire after 30 days.
• Zapier and Mailjet (a Sinch service): automation of newsletter subscriptions and delivery of email communications, including delivery and engagement information.
• Google Analytics and Site Kit: consent-dependent website measurement and reporting.
• PCIAW cookie preferences: first-party controls for recording and applying cookie choices. Choices remain in your browser; no separate CookieYes service is used.
• Hosting, security, email, professional advisers, venues and event suppliers: infrastructure, communications, fraud prevention, professional support and delivery of contracted activities.

We share only what is reasonably necessary, use contractual and security controls where appropriate, and do not sell personal information or rent email lists. A provider’s own privacy information may also apply where it acts independently.

5. Membership, accounts and directories

Authorised supplier and buyer members can access the members’ hub and relevant directory features while their membership and account permissions remain active. Member-directory information is restricted to authorised members unless a listing is expressly described as public and the organisation has agreed to that publication.

Buyer contact addresses are not displayed to directory users; messages are routed through the website to the buyer’s nominated address. PCIAW does not publish a non-member directory. You can ask us to correct, suppress or remove directory information, although we may retain the minimum record needed to administer membership, honour suppression choices or meet legal obligations.

You are responsible for keeping login details confidential and for ensuring that people using your organisation’s access are authorised. We may suspend access where reasonably necessary to protect data, investigate misuse or enforce membership terms.

6. Cookies and similar technologies

Cookies and similar storage or access technologies support essential functions, remember preferences, protect the site and—with permission—help us understand performance. Strictly necessary technologies operate where required to provide the site or a service you request. Analytics, advertising or other non-essential technologies are used only in accordance with the choices available through our consent controls.

You can select Cookie Settings or Reject optional on the consent banner, reopen the Cookie settings control, or change browser settings. Rejecting non-essential cookies does not prevent access to core content, although optional features may work differently. The Cookie settings panel separates necessary functions, analytics and external media. Optional services remain blocked until you opt in. You can accept all, reject optional services or save a category selection. Reopen Cookie settings from the footer or the on-screen control.

Our first-party pciaw_consent cookie stores the categories selected, policy version and time of your choice for 180 days on this browser. Invalid or expired choices return to optional services being off. Necessary login, security, cart, payment and requested form functions continue to operate.

Analytics includes Google Analytics, WooCommerce shop attribution and WPForms form analytics. External media includes YouTube, Vimeo, Google Maps and archived Brightcove or Gerber content. These providers may receive your IP address and use their own cookies when you allow their content. Google advertising storage and personalisation remain disabled. Automatic capture of unfinished WPForms entries is disabled; forms you submit and explicit Save & Resume remain available.

Changing your choice reloads the page to stop or enable optional services. Withdrawing consent removes known optional cookies accessible on pciaw.org and prevents future optional loading. We cannot remove cookies held on another provider’s domain; use your browser settings to remove those. External payment pages, such as HubSpot checkout, have their own privacy and cookie controls. Cookie controls updated 10 September 2026.

7. Newsletters and direct marketing

Public newsletter forms use a separate, unticked opt-in. Consent is not bundled with accepting this notice. We retain evidence of who consented, when, how and what they were told while we rely on that consent.

For corporate subscribers, PCIAW may send relevant business-to-business communications where PECR permits and legitimate interests is appropriate after the required assessment. Individual subscribers, including sole traders and some partnerships, receive the additional protections required by PECR. Every marketing email includes an unsubscribe route.

You can unsubscribe at any time using the link in an email or by contacting info@pciaw.org. We may keep a minimal suppression record so that your choice continues to be respected. Transactional, membership-administration and service messages are separate from optional marketing.

8. How long we keep information

Record	Typical retention approach
Membership and account records	For the membership and normally up to six years afterwards where needed for contracts, claims, tax or governance; unnecessary profile data is removed sooner
Orders, invoices and accounting records	Normally six years after the relevant financial period, or longer where law requires
Event operational details	Removed when no longer needed after the event; dietary and access details are normally deleted or anonymised within three months unless a legal need applies
Enquiries and prospects	Normally up to 24 months after the last meaningful contact, unless a longer period is justified
Newsletter records	Until you unsubscribe or the purpose ends; minimal suppression data may be retained afterwards
Form save-and-resume drafts	Configured to expire after 30 days
Award applications and judging records	Normally retained for up to six years after the relevant awards cycle where necessary to administer the award, maintain governance records, resolve disputes, evidence permissions, or establish or defend legal claims. Supporting files and personal contact information are minimised or securely deleted sooner where no longer required.
Incomplete or abandoned award applications	Normally deleted within 30 days of the last activity unless a short additional period is reasonably required to provide applicant support.
Award technical identifiers	IP address, browser and device information, and generated user identifiers are retained only for the period reasonably needed for security, abuse prevention or troubleshooting and are not part of the long-term awards archive.
Published award history	A limited record of winners, finalists, categories, organisations and approved public material may be retained as part of PCIAW’s historical awards archive.
Security logs and consent records	For the period reasonably needed to evidence choices, investigate incidents and protect the service

These periods are guides, not permission to keep everything for the maximum time. We review, minimise, anonymise or securely delete information when it is no longer needed.

9. International access and transfers

PCIAW serves an international audience and some providers or event partners may process information outside the UK. Where UK data protection law treats this as a restricted transfer, we use a lawful mechanism: UK adequacy regulations, or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with the required data protection test, unless a permitted exception applies.

People outside the UK may have additional rights under local law. We will respond to those rights where they apply. You may ask for information about the relevant transfer safeguard by contacting us.

10. Your rights and data protection complaints

Depending on the circumstances, UK data protection law gives you rights to be informed; obtain access; correct inaccurate information; request erasure or restriction; object to processing, including direct marketing; receive portable information; withdraw consent; and obtain safeguards concerning qualifying automated decisions. Rights are not absolute, and we will explain if an exemption or limitation applies.

To exercise a right or make a data protection complaint, email info@pciaw.org with “Data protection complaint” in the subject, or write to the registered office above. Please describe what happened, the information involved, what outcome you seek and how we can contact you. We may request proportionate proof of identity or authority.

We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you appropriately informed and tell you the outcome. If you remain dissatisfied, you may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. If you are elsewhere, you may also be able to contact your local supervisory authority.

11. Security, children, changes and contact

We use proportionate technical and organisational measures, including access controls, encrypted transmission, account controls, monitoring and incident procedures. No internet service can promise absolute security. Please keep passwords and personal save-and-resume links confidential and contact us promptly if you suspect misuse.

Our business services are not directed at children. If we learn that information about a child has been collected without an appropriate basis, we will take steps to address it. Where a specific event legitimately involves a child, we use an appropriate notice and consent or authority process.

We update this notice when our services, suppliers or the law materially change. The review date at the top shows the latest version. Questions can be sent to info@pciaw.org.