This privacy policy explains how we collect, use, share and store your personal data when you visit torqen.uk, buy from us, create an account, subscribe to our newsletter, contact us, or arrange to collect an order in person.

1. Who we are

Data controller: TORQEN Ltd, a private limited company registered in England and Wales, company number 09367435.

In this policy, "we", "us" and "our" mean TORQEN Ltd.

2. Changes to this policy

We may update this policy to reflect changes to our business or legal duties. We publish the current version on torqen.uk and update the date at the top. Where a change materially affects you, we will also tell you by email.

3. Personal data we collect

Data you give us

• Name, email, phone number
• Billing and delivery address
• Account login details, if you create an account
• Vehicle details you give us so we can check fitment
• Order details, returns, warranty queries and support messages
• Payment status and transaction references. We never see or store full card numbers

Data we collect from your device

• IP address, device type, browser type, operating system, language
• Pages viewed, links clicked, basket activity, referral source
• Cookie identifiers, see section 8

Data we receive from third parties

• PayPal: payment confirmation, fraud indicators, dispute and chargeback status
• Delivery partners: tracking events and delivery outcomes

4. If you do not provide personal data

We need some data to take payment, deliver goods and support you. Without it, you may not be able to place an order, receive delivery or get after-sales support. You can browse the website without giving us any personal data.

5. How we use personal data and our lawful bases

Contract

• Process orders, take payment and send order updates
• Deliver orders or prepare a pre-arranged collection
• Handle returns, refunds, guarantee and warranty claims
• Answer questions about your order, including fitment

Legitimate interests

• Run, maintain and improve torqen.uk
• Keep records of customer contact and orders
• Prevent fraud, misuse and attacks on our systems, see section 11
• Record calls for training, quality and dispute resolution, see section 9
• Protect our rights in disputes and complaints

We balance these interests against your rights. You can object at any time, see section 19.

Legal obligation

• Keep tax and accounting records
• Meet consumer law duties
• Respond to lawful requests from authorities and regulators

Consent

• Analytics cookies, see section 8
• Our newsletter and marketing messages, except where UK rules allow us to email existing customers about similar products

You can withdraw consent at any time. This does not affect processing that took place before you withdrew it.

6. Website platform and hosting

torqen.uk runs on PrestaShop software hosted on our own dedicated server at OVHcloud. We administer the server ourselves. Product images and other static files are delivered through KeyCDN, a content delivery network, which processes your IP address to serve those files.

7. Payments

Payment methods we offer

• Card payments (Visa, Mastercard, American Express), processed by PayPal
• PayPal account payments
• Bank transfer: Barclays for payments in GBP, or Wise for other currencies

PayPal processes card and PayPal payments under its own privacy notice and runs its own fraud checks. We receive confirmation of payment and a transaction reference, not your card details.

If you pay by bank transfer, our bank and your bank or payment service process the transfer details, such as account name, account or IBAN details, reference and amount. We use the reference to match your payment to your order.

8. Cookies and Google Analytics

• Strictly necessary cookies: basket, checkout, login and security. These do not need consent
• Analytics cookies: site performance and usage, through Google Analytics

We only set analytics cookies if you consent through our cookie banner. If you consent, Google Analytics collects information such as pages viewed, session activity, device and browser details and referral source. We do not run advertising pixels. If that changes, we will update this policy and our cookie banner first.

You can change your choice at any time through the cookie settings on the site or your browser settings. If you block strictly necessary cookies, parts of the site will not work.

9. Call recordings

We record calls to and from our business landline, and tell you at the start of the call.

• What we collect: your phone number, call audio and information you share on the call
• Lawful basis: legitimate interests in training, quality and resolving disputes, and contract where the call relates to an order
• Retention: 90 days, then deletion, unless we need a recording for an open complaint, dispute, fraud investigation or legal claim
• Your choices: if you prefer not to be recorded, contact us by email or WhatsApp instead

10. WhatsApp, social media and email

If you message us on WhatsApp, Facebook Messenger or Instagram, we process the message content and any files you send so we can support you. These services are provided by Meta, which processes data under its own terms, including outside the UK.

We host our business email on our own dedicated server at OVHcloud.

• Lawful basis: contract, for support linked to an order, and legitimate interests, for customer support and record-keeping
• Retention: messages are kept for 12 months after the last message, then deleted, unless we need them for an open issue or legal claim

Do not send card details by WhatsApp, social media or email.

11. Fraud prevention

11.1 Where an order shows signs of fraud risk, we may ask you to verify your identity or address before we release it, for example with a photo driving licence, passport or recent utility bill, or by confirming details with the card or account holder.

11.2 Our lawful basis is our legitimate interest in preventing fraud and protecting our customers from misuse of their payment details. If you prefer not to provide verification, we may decline the order and refund any payment taken.

11.3 We delete verification documents within 90 days of completing the check, or straight away if we decline the order. We keep a record of the check and its outcome for up to 7 years.

11.4 We use PayPal’s automated fraud screening. Where it flags an order, a member of our team reviews it. We do not make decisions with legal or similarly significant effects on you by automated means alone. Contact us if you think an order was blocked in error.

12. CCTV

If you collect an order or visit our premises, our CCTV may record you, your vehicle, and the time and location of your visit. We use CCTV for safety, crime prevention and incident investigation.

• Lawful basis: legitimate interests in protecting people and property, and investigating incidents
• Sharing: we may share footage with the police, insurers, advisers or other parties involved in an incident, where lawful
• Retention: 14 days, then automatic overwrite, unless we need footage for an active investigation or dispute
• Your rights: you can request footage that includes you. Give us the date, time and location so we can find it within the 14-day window

13. Who we share personal data with

• OVHcloud: server hosting for our website and email
• KeyCDN: delivery of images and static files
• PayPal, Barclays and Wise: payments and refunds
• Delivery and logistics partners, including freight carriers and customs brokers
• Manufacturers and suppliers who ship an order direct to you, or who inspect a part under a warranty claim
• Google Analytics, only if you consent to analytics cookies
• Meta, where you contact us through WhatsApp, Facebook Messenger or Instagram
• Professional advisers: accountants, insurers and lawyers
• Authorities and regulators where the law requires it
• A buyer or successor, if we sell or restructure all or part of our business

Our newsletter runs on software we built and host ourselves. We do not sell personal data.

14. International transfers

Some suppliers, including PayPal, Google, Meta, Wise, KeyCDN and overseas manufacturers who ship direct, may process personal data outside the UK. Where the law requires it, we rely on UK adequacy regulations or recognised safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified. Email support@torqen.uk for details of the safeguards that apply.

15. How long we keep personal data

• Orders, invoices and tax records: 6 years after the end of the relevant financial year
• Customer support records: 24 months after the case closes
• Account data: while your account stays open, then 24 months after closure, unless we need it for legal reasons
• Newsletter and marketing lists: until you unsubscribe, or 24 months after your last meaningful interaction
• Call recordings: 90 days, see section 9
• WhatsApp and social media messages: 12 months, see section 10
• Fraud verification documents: 90 days, see section 11
• CCTV: 14 days, see section 12
• Analytics cookie data: up to 14 months
• Security logs: 12 months

If we need data for a live dispute, fraud investigation or legal claim, we keep it for as long as that purpose requires. After these periods we delete or anonymise the data.

16. Security

We use access controls, encrypted connections and other measures to protect personal data. No online service is risk-free. Use a strong password for your account and keep it private.

17. Marketing choices

You can opt out of marketing at any time using the unsubscribe link in any email, through your account settings, or by contacting us.

18. Third-party websites

Our site links to third-party sites, including manufacturers and social media. Their privacy practices differ. Read their privacy information before you give them personal data.

19. Your rights

Under UK data protection law, you can:

• ask for access to your personal data
• ask us to correct inaccurate data
• ask us to delete data in some cases
• ask us to restrict processing in some cases
• object to processing based on legitimate interests, and to direct marketing at any time
• ask for data portability in some cases
• withdraw consent at any time where we rely on consent

Email support@torqen.uk or write to us at the address in section 1. We may ask for proof of identity, which we delete once we have answered. We reply within one month, extendable by two further months for complex requests, in which case we will tell you why.

20. Complaints

Contact us first and we will try to resolve your concern. You can also complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk.

21. Children

We only sell to adults aged 18 or over, and our website is not intended for children. If you think a child has given us personal data, contact us and we will delete it.