Privacy Policy

Version 1.0 路 Effective date: 16 October 2026

1. Who we are

TCJA Products Ltd ("we", "us"), company number 16207219, registered office 128 City Road, London, EC1V 2NX, provides online store management services. We are registered with the Information Commissioner's Office as a data controller in respect of our business contact data and website visitors' data, and act as a processor in respect of certain customer data of our Clients' storefronts.

2. Data we collect

• Business contact data: name, company, email address, phone number and correspondence of Client contacts and website enquirers.
• Store operations data: in operating a Client's storefront we may process customer order data (name, delivery address, contact details, order contents) on behalf of, and under the instructions of, the Client as controller.
• Technical data: server logs (IP address, user agent, pages requested) collected for security and performance purposes.

3. Purposes and legal bases

• Providing and administering our services —performance of a contract.
• Responding to enquiries —legitimate interests / steps prior to entering a contract.
• Operating Client storefronts and processing orders —performance of our processing agreement with the Client.
• Keeping our services secure —legitimate interests.
• Compliance with legal obligations —legal obligation.

4. Sharing of data

We share personal data only with: (a) service providers acting on our instructions (hosting, email and backup providers); (b) the Client who owns the relevant storefront, in respect of its customers' order data; (c) professional advisers where necessary; and (d) authorities where required by law. We do not sell personal data.

5. International transfers

Where personal data is transferred outside the UK, we rely on adequacy regulations or standard contractual clauses approved for UK use, together with appropriate technical safeguards.

6. Retention

Business correspondence is retained for up to 24 months after the end of the relevant engagement. Store operations data is retained for the duration of the service plus 6 years where required for tax and accounting purposes, unless the Client instructs earlier deletion. Server logs are retained for 90 days.

7. Your rights

Under the UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to the Information Commissioner's Office (ico.org.uk). Requests relating to storefront customer data will be routed to the relevant Client as data controller; requests relating to our own records should be sent to [email protected].

8. Security

We apply appropriate technical and organisational measures, including encryption in transit (TLS), access controls on a least-privilege basis, regular backups and staff confidentiality obligations.

9. Cookies

This website uses only strictly necessary cookies for security and session integrity. No analytics or advertising cookies are set without consent.