PALs are PII, and if you're collecting PII as a business, for the love of god, put a Privacy Policy on your website.
First, both service providers of BBC's website (Squarespace & Shopify) require a public Privacy Policy as a condition of using their service. Second, in Ontario, the Personal Information Protection and Electronic Documents Act requires it as a matter of law.
Thirdly, and perhaps most importantly, you let your customer's know how you're using their information, how long you're keeping it for, and how it will be safeguarded. I.e., if your using my PAL for purchase verification, you should be able to tell me you're destroying that information as soon as payment clears.
Also, BBC needs to be careful with Shopify, since they're definitely in breach of the shopify acceptable use policy since they're selling "certain parts" including flash suppressors, and threaded barrels for semi-automatic firearms and "certain firearms" which includes anything semi-auto with a threaded barrel.
At minimum, BBC should respond with an adequate
Privacy Policy.