Last updated: 13 September 2026
This policy explains how Tongkat Fitness collects, uses and protects your personal information when you visit our websites (tongkatfitness.com, tongkatfitness.uk, tongkatfitness.us and tongkatfitness.eu) or buy from us.
Who we are
Tongkat Fitness is the data controller for your personal information.
- Data controller: Ian Mitchell
- Post: Tongkat Fitness, Unit 113/98 Woodlands Road, Charing Cross, Glasgow, G3 6HB, United Kingdom
- Privacy questions: [email protected]
The information we collect
Information you give us
- When you create an account: your name, email address and password.
- When you place an order: your name, email address, phone number, billing and delivery addresses (and company name, if you add one), and the details of what you've ordered.
- When you contact us: your name, email address and anything you include in your message.
Information collected automatically
- Technical information: your IP address, browser and device type, and the pages you visit, used to run, secure and troubleshoot our websites.
- Your approximate location: your country, worked out from your IP address, so we can show the right prices, currency and delivery options.
We never see or store your full card details. Payments are handled securely by our payment provider.
How and why we use your information
- To process and deliver your order, including taking payment, sending order and delivery emails, and handling returns and refunds. We need this to fulfil our contract with you.
- To manage your account, including signing in and resetting your password. This is part of our contract with you.
- To keep records required by law, such as accounting and tax records.
- To run, secure and improve our websites, including detecting errors, preventing fraud and misuse, and measuring site performance. This is in our legitimate interests.
- To respond to your questions and requests.
We don't currently send marketing emails. If we do in future, we'll only send them with your consent, and you'll be able to unsubscribe at any time.
We don't sell your personal information.
Who we share it with
We only share your information with trusted service providers who help us run our business, and only what they need to do their job:
- PayPal: processes your payment.
- ShipStation and our fulfilment centres: your name, delivery address, phone number and order details, to pack and ship your order.
- Delivery couriers: your name, delivery address and phone number, to deliver your parcel.
- Resend: sends our order, delivery and account emails.
- KashFlow: our accounting software, for invoices and refunds.
- Cloudflare: protects and speeds up our websites.
- Amazon Web Services (London): hosts our websites, customer database and secure backups.
We may also share information if required by law, to protect our rights or the safety of others, or as part of selling or reorganising our business.
International transfers
Our websites and customer database are hosted in the United Kingdom. Some of our service providers, such as PayPal, Cloudflare and Resend, may process your information outside the UK and European Economic Area, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or standard contractual clauses.
How long we keep it
- Order, invoice and payment records: 6 years from the end of the financial year they relate to, as required for tax purposes.
- Your account: until you ask us to close it, or after 3 years of inactivity.
- Emails and messages to us: up to 2 years after we've dealt with your query.
- Website logs and monitoring data: up to 90 days.
Cookies
We only use cookies that our websites need to work. We don't use advertising or tracking cookies.
- Basket cookies: remember what's in your basket (up to 30 days).
- Sign-in cookies: keep you signed in to your account (up to 30 days).
- Region and language cookies: remember your country and language (up to 1 year).
We also use privacy-friendly performance monitoring that records site errors and page loading speeds, without identifying you. Our payment provider may set its own cookies when you check out.
You can block or delete cookies in your browser settings, but parts of our websites, like your basket and account, won't work without them.
How we protect it
We use appropriate technical and organisational measures to keep your information secure, including encrypted connections (HTTPS), access controls and encrypted backups. No method of sending information over the internet is completely secure, but we work hard to protect your data.
Your rights
Under UK data protection law, you have the right to:
- Access the personal information we hold about you.
- Correct information that's wrong or incomplete.
- Delete your information, where we don't need to keep it.
- Restrict or object to how we use your information.
- Data portability: receive your information in a portable format.
- Withdraw consent at any time, where we rely on it.
If you're unhappy with how we've handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at
ico.org.uk, or to the data protection authority in your country.
Children
Our products are for adults. Our websites aren't intended for anyone under 18, and we don't knowingly collect information from children.
Links to other websites
Our websites may link to other websites. We're not responsible for their privacy practices, so please read their privacy policies.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
