GDPR & CCPA Compliance Policy

1. Who We Are

TRAINTORQUIX is a trading brand operated by ZAID & IBRAHIM LIMITED. For the purposes of applicable privacy laws, TRAINTORQUIX may act as a data controller when it decides how and why personal information is collected and used.

2. Scope of This Policy

This policy applies to visitors, customers, account holders, newsletter subscribers and other individuals who interact with TRAINTORQUIX through our website, online store, customer support channels, marketing communications or related services.

3. Laws Covered by This Policy

This policy is designed to address key requirements under the UK GDPR, EU GDPR, California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable privacy laws where relevant. The CCPA, as amended by CPRA, gives California residents specific notice and request rights. UK and EU data protection law gives individuals rights including access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making.

4. Categories of Personal Information We May Collect

Category	Examples	Purpose
Identifiers	Name, email, telephone number, billing address, shipping address, account username	Orders, delivery, customer support, account management
Commercial information	Products viewed, products purchased, order history, returns, warranty claims	Order fulfilment, returns, warranty support, customer service
Payment-related information	Payment method, billing confirmation, transaction status, fraud checks	Payment processing, fraud prevention, refunds
Internet and device data	IP address, browser type, device type, cookies, pages visited	Website security, analytics, performance, advertising where enabled
Customer communications	Emails, support messages, reviews, enquiries	Customer support, dispute resolution, service improvement
Marketing preferences	Newsletter sign-up, consent status, opt-out choices	Marketing communications where permitted, preference management
Approximate location data	Country, region, city derived from IP or delivery details	Shipping options, tax calculation, fraud prevention, analytics

5. Sensitive Personal Information

TRAINTORQUIX does not intentionally collect sensitive personal information such as precise geolocation, government identification numbers, health records, biometric data, racial or ethnic origin, religious beliefs or union membership for ordinary website purchases. If such information is ever required for a specific lawful purpose, we will explain the purpose and handle it in accordance with applicable law.

6. Sources of Personal Information

We may collect information directly from you, automatically through website technologies, from payment providers, shipping carriers, fraud prevention tools, analytics providers, advertising platforms, customer service systems and marketplace or retail partners where applicable.

7. How We Use Personal Information

We use personal information to process and deliver orders, manage accounts, provide customer support, process payments and refunds, prevent fraud, handle warranty claims, improve our website, send marketing communications where permitted, comply with legal obligations and protect our rights and the rights of customers.

8. Legal Bases Under UK/EU GDPR

Where UK or EU GDPR applies, we rely on one or more legal bases: contract performance, legitimate interests, legal obligation, consent, and, where necessary, protection of vital interests or establishment, exercise or defence of legal claims.

9. Cookie and Tracking Technologies

We may use cookies, pixels, tags and similar technologies to operate the website, remember preferences, measure website performance, understand customer behaviour and support advertising or remarketing where enabled.

• Essential cookies: required for checkout, security, account login and shopping basket functions.
• Analytics cookies: help us understand website traffic, performance and customer behaviour.
• Marketing cookies: may support advertising, remarketing and measurement through platforms such as Google Ads, Google Analytics 4, Meta/Facebook Pixel, TikTok Pixel or similar tools if enabled.
• Cookie controls: customers can manage cookies through browser settings and, where provided, the website cookie banner or preference centre.

10. Sharing Personal Information

We may share personal information with service providers and business partners only where necessary for legitimate business purposes. This may include payment processors, shipping carriers, 3PL fulfilment providers, website hosting providers, email marketing platforms, analytics providers, advertising platforms, fraud prevention tools, professional advisers, tax/accounting providers and legal authorities where required by law.

11. Sale or Sharing of Personal Information

TRAINTORQUIX does not sell personal information for monetary payment. However, some U.S. privacy laws may treat certain advertising or cross-context behavioural advertising activities as “sharing” or “targeted advertising”. If we use such technologies, eligible customers may opt out through the website cookie tools, browser settings, a “Do Not Sell or Share My Personal Information” link if applicable, or by contacting us.

12. GDPR Rights for UK and EU Customers

If UK or EU data protection law applies to you, you may have the following rights:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Rights relating to automated decision-making and profiling
• Right to withdraw consent where processing is based on consent
• Right to complain to a supervisory authority such as the UK Information Commissioner’s Office or the relevant EU authority

13. California CCPA/CPRA Rights

California residents may have the following rights, subject to legal limits and verification requirements:

• Right to know what personal information is collected, used, disclosed, sold or shared
• Right to access personal information
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing of personal information
• Right to limit use and disclosure of sensitive personal information, where applicable
• Right not to be discriminated against for exercising privacy rights

14. Other U.S. State Privacy Rights

Residents of other U.S. states may have privacy rights under applicable state laws, including rights to access, correct, delete, obtain a copy of personal information and opt out of targeted advertising or certain profiling. TRAINTORQUIX will honour applicable rights where required by law.

15. Canada, Australia and Rest of World Customers

Customers outside the USA, UK and EU may have local privacy rights under their own national or regional laws. Where such laws apply, TRAINTORQUIX will respond to valid privacy requests in accordance with applicable legal requirements.

16. How to Exercise Your Rights

To make a privacy request, contact us at info@traintorquix.com and include your name, email address, country or state of residence, order number if relevant, and the request you wish to make. We may need to verify your identity before acting on your request.

17. Identity Verification and Authorized Agents

To protect customer information, we may ask for information reasonably necessary to verify your identity. California residents may use an authorized agent where permitted by law. We may request proof of authorization before responding to an agent.

18. Response Times

We aim to respond to privacy requests within the timeframe required by applicable law. Some requests may take longer where permitted by law, for example if the request is complex or we need additional verification.

19. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy, including order fulfilment, customer service, warranty support, fraud prevention, accounting, tax, legal compliance, dispute resolution and business recordkeeping.

20. International Data Transfers

Your information may be processed in countries outside your country of residence. Where required by law, we use appropriate safeguards such as contractual protections, data processing agreements, standard contractual clauses, adequacy mechanisms or other lawful transfer tools.

21. Data Security

We use reasonable administrative, technical and physical safeguards to protect personal information. These may include SSL encryption, access controls, secure payment gateways, account authentication, restricted access and service provider due diligence. No online system is completely secure, so customers should also protect their passwords and devices.

22. Data Breach Response

If we become aware of a data security incident that requires notification, we will take appropriate steps to investigate, contain and notify affected individuals or regulators where required by applicable law.

23. Children’s Privacy

Our website is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided information to us, contact us and we will take appropriate action.

24. Automated Decision-Making and Profiling

We do not use personal information to make decisions that produce legal or similarly significant effects without human involvement. We may use automated tools for fraud prevention, payment security, analytics, marketing segmentation and website personalisation where permitted by law.

25. Financial Incentives and Loyalty Programs

If TRAINTORQUIX offers discount codes, loyalty rewards, referral benefits or promotional incentives, participation will be voluntary. If a privacy law requires a notice of financial incentive, we will provide additional information at the point of sign-up.

26. Third-Party Links and Platforms

Our website may link to third-party websites, payment providers, delivery tracking pages, marketplaces, social media platforms or advertising partners. Their privacy practices are governed by their own policies, not this policy.

27. Updates to This Policy

We may update this policy from time to time. The latest version will be posted on our website with a revised effective date. Continued use of the website after changes are posted means the updated policy applies.

28. Contact Us

For privacy questions or data rights requests, contact:

TRAINTORQUIX / ZAID & IBRAHIM LIMITED

Email: info@traintorquix.com

Website: www.traintorquix.com

29. Source Notes for Internal Review

This policy was expanded using your previous GDPR & CCPA draft and should be checked against your live website tools before publishing, including your actual payment provider, email provider, analytics tools, ad pixels, fulfilment partners and cookie banner settings.

Reference Sources

• California Attorney General: CCPA consumer privacy rights and CCPA regulations.
• UK Information Commissioner’s Office: UK GDPR individual rights guidance.
• European Commission: GDPR data protection rules and international transfer safeguards.