Falcon Turbo Developments LTD (trading as Falcon Turbos, hereinafter referred to as “we”, “us”, or “our”) is a specialist turbocharger engineering and remanufacturing company based in Sheffield, United Kingdom.

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, Falcon Turbo Developments LTD acts as the Data Controller for the personal data collected through our website, workshop counter, messaging platforms, and sales operations.

We collect and process personal data across several key touchpoints:

• A. E-Commerce Checkout & Order Fulfillment:
  • Contact & Billing Details: Full name, billing address, shipping address, email address, telephone number.
  • Vehicle Identification & Engineering Data: Vehicle Registration Mark (VRN), Vehicle Identification Number (VIN), engine code, turbocharger part numbers, and vehicle modification specifications.
  • Purpose: To verify exact component compatibility, calibrate wastegates/actuators, provide fitting guides, maintain warranty audit logs, and fulfill statutory tax retention obligations.
  • Payment Data: We do not store or process raw credit/debit card numbers or security CVV codes. Payment details are tokenised directly by our PCI-DSS Level 1 compliant payment gateways.
• B. Workshop Counter & Trade Desk:

  For in-person collections, turbo testing, or walk-in purchases, we collect contact and vehicle details necessary to generate invoices, process core surcharge deposits, and document warranty cover.

• C. Direct Customer Inquiries & Messaging Platforms:
  • Contact Forms & Email: Name, email address, telephone number, and technical inquiry details submitted through our contact forms.
  • Social Media (Facebook Messenger & Instagram): Initial brand interactions and general inquiries.
  • WhatsApp Business: WhatsApp is our designated messaging channel for formal price quotes, technical specifications, core exchange photos, and warranty communication. Any customer data shared over WhatsApp is held under end-to-end encryption and processed strictly to respond to your technical inquiry or service request.
• D. Website Comments & Media Uploads:
  • Comments: When visitors leave comments on the site, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string to aid automated spam detection.
  • Gravatar Service: An anonymised string created from your email address (a hash) may be provided to the Gravatar service to verify usage. The Gravatar service privacy policy is available at automattic.com/privacy. Upon comment approval, your profile picture becomes publicly visible alongside your comment.
  • Media Uploads: If you upload images to the site (e.g., diagnostic photos or turbo identification tags), avoid uploading files with embedded location data (EXIF GPS). Website visitors could download and extract location metadata from published files.

Under UK GDPR Article 6, we process your personal data under the following legal bases:

• 1. Performance of a Contract: Fulfilling online purchases, workshop repairs, warranty assessments, delivering physical goods, and refunding old core surcharge deposits.
• 2. Legal Obligation: Maintaining accounting, VAT, and corporate transaction records for HM Revenue & Customs (HMRC) and complying with UK consumer protection laws.
• 3. Legitimate Interests: Verifying trade credit applications, preventing e-commerce fraud, securing our IT infrastructure, and providing dedicated B2B trade account support.
• 4. Consent: Non-essential website analytical cookies, marketing newsletters, or third-party tracking pixels (which you may withdraw at any time).

We never sell, rent, or trade your personal information. We only share data with vetted third-party service providers and statutory bodies to operate our business:

Our website uses cookies and tracking technologies to ensure optimal performance:

• 5.1 Essential Session Cookies: Required for the operation of the shopping cart, checkout, account login sessions, and site security. (These do not require prior consent under PECR).
• 5.2 Account & Comment Cookies:
  • If you leave a comment, you may opt-in to saving your name, email address, and website in cookies for 1 year for convenience.
  • If you visit our login page, a temporary cookie verifies browser cookie support (contains no personal data and expires on browser close).
  • Active login sessions set cookies lasting 2 days (or 2 weeks if “Remember Me” is selected); display option cookies persist for 1 year.
• 5.3 Analytics Cookies (Google Analytics & SEO Tools): We use Google Analytics and SEO reporting tools to monitor aggregate user journeys, bounce rates, and browser compatibility. These cookies are only activated when you give consent via our cookie banner.
• 5.4 Embedded Content from Other Websites: Articles or product pages on this site may include embedded content (e.g., YouTube videos, technical schematics, or social feeds). Embedded content behaves exactly as if the visitor visited the source website directly. These external providers may collect your IP address, set tracking cookies, and monitor your interactions if you have an active account with them.

• 6.1 Application of UK GDPR and EU GDPR: Falcon Turbo Developments LTD is headquartered in the United Kingdom and complies primarily with the UK GDPR and the Data Protection Act 2018. Where we market goods to, or process the personal data of, individuals residing in the European Union (EU) or European Economic Area (EEA), we also comply with the principles of the EU GDPR (Regulation (EU) 2016/679).
• 6.2 Data Transfers Between the EU and the UK:
  • Adequacy Decisions: Transfers of personal data between the EU/EEA and the United Kingdom are governed by mutual adequacy decisions adopted by the European Commission and the UK Government. This confirms that the UK provides an essentially equivalent level of data protection to that guaranteed within the EU.
• 6.3 Customs Declarations & Global Courier Logistics: When you purchase goods for delivery outside the United Kingdom (including the EU and Rest of World), we share necessary personal data (recipient name, delivery address, telephone number, email, package contents, and commercial invoice value) with:
  • International Freight & Courier Partners: (e.g., DHL Express, DPD, FedEx, UPS, Royal Mail / Parcelforce worldwide partners).
  • Customs & Border Authorities: To generate export documentation, commercial customs invoices, and facilitate cross-border import clearance in accordance with international trade laws and statutory customs regulations.

  Lawful Basis: Performance of a Contract (Article 6(1)(b)) and compliance with Legal Obligations (Article 6(1)(c)) regarding customs declarations.

• 6.4 Rest of World Transfers & Appropriate Safeguards: Where personal data is transferred to service providers, cloud infrastructure, or logistics partners located outside the UK or EEA in countries lacking a formal adequacy decision:
  • We ensure adequate safeguards are in place, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or certified data transfer frameworks (such as the UK Extension to the EU-US Data Privacy Framework).
  • Where specific statutory mechanisms are not available, transfers necessary to fulfill an international delivery or warranty exchange rely on the statutory derogation for the performance of a contract concluded in your interest (UK/EU GDPR Article 49(1)(b)).
• 6.5 EU Representative Disclosure (Article 27): In accordance with Article 27(2) of the EU GDPR, Falcon Turbo Developments LTD is exempt from appointing an EU Representative as our processing of EU customer data is strictly related to commercial order fulfillment, does not involve large-scale processing of special category data, and poses minimal risk to the rights and freedoms of individuals.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• 7.1 Order & Invoicing Records: Retained for a minimum of 6 years following the end of the financial year, in compliance with HMRC statutory accounting requirements.
• 7.2 Vehicle & Warranty Audit Records: Retained for the full 12-month warranty duration, plus an additional 12 months to address any late defect queries.
• 7.3 Core Exchange Deposits: Retained until the 60-day return window concludes and surcharge reconciliation is finalised.
• 7.4 Customer Accounts: Maintained until you request account deletion, provided no active warranty or unresolved financial records remain.
• 7.5 Comments & Inquiry Logs: User comments and associated metadata are retained indefinitely to recognise and approve subsequent comments automatically. WhatsApp and email inquiries are reviewed and purged periodically once technical questions are resolved.

We implement strict technical and organisational controls to protect your data against accidental loss, unauthorized access, alteration, or disclosure:

• 8.1 Encryption in Transit: All web traffic is encrypted using 256-bit Secure Sockets Layer (SSL) / Transport Layer Security (TLS).
• 8.2 Payment Tokenisation: Payment card data is processed directly via tokenised gateway interfaces and is never stored on our local web servers.
• 8.3 Access Controls: Access to administrative backends, WooCommerce systems, and trade accounts is restricted to authorized staff via strong passwords and Multi-Factor Authentication (MFA).

In the unlikely event of a suspected personal data breach, Falcon Turbos follows established technical standard operating procedures:

1. Incident Containment: Our technical team will immediately contain the incident, assess the risks to affected individuals, and isolate affected systems.
2. Regulatory Notification: Where a breach poses a risk to individual rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, in accordance with UK GDPR requirements.
3. Individual Notification: If the breach poses a high risk to affected individuals, we will notify those affected directly without undue delay with clear guidance on protective steps.

Under UK GDPR, you have the following rights regarding the personal data we hold about you:

• 10.1 Right of Access: You may request a copy of the personal data we hold about you (Subject Access Request).
• 10.2 Right to Rectification: You can request the correction of inaccurate or incomplete personal information.
• 10.3 Right to Erasure (“Right to be Forgotten”): You can request the deletion of your personal data where it is no longer required for its original purpose (excluding records we are legally required to retain for HMRC, fraud prevention, or warranty disputes).
• 10.4 Right to Restriction of Processing: You can request that we suspend processing your data under certain conditions.
• 10.5 Right to Data Portability: You can request that your personal data be provided in a structured, machine-readable format.
• 10.6 Right to Object: You can object to data processing grounded in our legitimate interests or direct marketing.

If you have any concerns regarding how we handle your personal data, please contact us first so we can resolve the issue promptly.

You also have the statutory right to lodge a formal complaint with the UK supervisory authority:

For Customers in the EU/EEA: If you reside in the European Union, you have the right to lodge a complaint directly with your local national Data Protection Authority (DPA) (e.g., CNIL in France, BfDI in Germany, DPC in Ireland) in addition to our lead supervisory body, the UK Information Commissioner’s Office (ICO).