Privacy Policy
Last updated: 31 October 2026
This policy explains how Tongkat Fitness collects, uses and protects your personal information when you visit our websites (tongkatfitness.com, tongkatfitness.uk, tongkatfitness.us and tongkatfitness.eu) or buy from us.
Who we are
Tongkat Fitness is the data controller for your personal information.
Data controller: Ian Mitchell
Post: Tongkat Fitness, Unit 113/98 Woodlands Road, Charing Cross, Glasgow, G3 6HB, United Kingdom
Privacy questions: privacy@tongkatfitness.com
The information we collect
Information you give us
When you create an account: your name, email address and password.
When you place an order: your name, email address, phone number, billing and delivery addresses (and company name, if you add one), and the details of what you've ordered.
When you contact us: your name, email address and anything you include in your message.
Information collected automatically
Technical information: your IP address, browser and device type, and the pages you visit, used to run, secure and troubleshoot our websites.
Your approximate location: your country, worked out from your IP address, so we can show the right prices, currency and delivery options.
Analytics and advertising information: if you allow analytics or advertising cookies, Google Analytics and Google Ads record how you use our websites, such as the pages you view, the products you add to your basket and your purchases (including order value), along with your device type and approximate location.
We never see or store your full card details. Payments are handled securely by our payment provider.
How and why we use your information
To process and deliver your order, including taking payment, sending order and delivery emails, and handling returns and refunds. We need this to fulfil our contract with you.
To manage your account, including signing in and resetting your password. This is part of our contract with you.
To keep records required by law, such as accounting and tax records.
To run, secure and improve our websites, including detecting errors, preventing fraud and misuse, and measuring site performance. This is in our legitimate interests.
To respond to your questions and requests.
We don't currently send marketing emails. If we do in future, we'll only send them with your consent, and you'll be able to unsubscribe at any time.
We don't sell your personal information.
Who we share it with
We only share your information with trusted service providers who help us run our business, and only what they need to do their job:
PayPal: processes your payment.
ShipStation and our fulfilment centres: your name, delivery address, phone number and order details, to pack and ship your order.
Delivery couriers: your name, delivery address and phone number, to deliver your parcel.
Resend: sends our order, delivery and account emails.
KashFlow: our accounting software, for invoices and refunds.
Google (Google Analytics and Google Ads): measures how our websites are used and which of our adverts lead to purchases, when you allow analytics or advertising cookies.
Cloudflare: protects and speeds up our websites.
Aypex: hosts our websites and customer database in the United Kingdom.
Amazon Web Services (London): stores our encrypted backups and files.
We may also share information if required by law, to protect our rights or the safety of others, or as part of selling or reorganising our business.
International transfers
Our websites and customer database are hosted in the United Kingdom. Some of our service providers, such as PayPal, Google, Cloudflare and Resend, may process your information outside the UK and European Economic Area, including in the United States. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or standard contractual clauses.
How long we keep it
Order, invoice and payment records: 6 years from the end of the financial year they relate to, as required for tax purposes.
Your account: until you ask us to close it, or after 3 years of inactivity.
Emails and messages to us: up to 2 years after we've dealt with your query.
Website logs and monitoring data: up to 90 days.
Analytics data (Google Analytics): up to 14 months.
Cookies
We use cookies that our websites need to work and, with your permission, analytics and advertising cookies. Our Cookie Policy lists each one and explains how to control them.
Basket cookies: remember what's in your basket (up to 30 days).
Sign-in cookies: keep you signed in to your account (up to 30 days).
Region and language cookies: remember your country and language (up to 1 year).
Cookie choice: remembers what you chose in our cookie banner (6 months).
Analytics cookies (Google Analytics): help us understand how visitors use our websites (up to 2 years).
Advertising cookies (Google Ads): measure which of our adverts lead to purchases (up to 90 days).
If you're in the UK, the European Economic Area or Switzerland, we only set analytics and advertising cookies if you accept them in our cookie banner. Elsewhere, they're on unless you turn them off. You can change your choice at any time with Cookie settings at the bottom of every page.
We also use privacy-friendly performance monitoring that records site errors and page loading speeds, without identifying you. Our payment provider may set its own cookies when you check out.
You can block or delete cookies in your browser settings, but parts of our websites, like your basket and account, won't work without them.
How we protect it
We use appropriate technical and organisational measures to keep your information secure, including encrypted connections (HTTPS), access controls and encrypted backups. No method of sending information over the internet is completely secure, but we work hard to protect your data.
Your rights
Under UK data protection law, you have the right to:
Access the personal information we hold about you.
Correct information that's wrong or incomplete.
Delete your information, where we don't need to keep it.
Restrict or object to how we use your information.
Data portability: receive your information in a portable format.
Withdraw consent at any time, where we rely on it.
To use any of these rights, email privacy@tongkatfitness.com. We'll respond within one month.
If you're unhappy with how we've handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority in your country.
Children
Our products are for adults. Our websites aren't intended for anyone under 18, and we don't knowingly collect information from children.
Links to other websites
Our websites may link to other websites. We're not responsible for their privacy practices, so please read their privacy policies.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.
