Privacy Policy

TOCCAY Global Privacy Policy

Last updated: September 27, 2026

This Privacy Policy explains how TOCCAY SPORTS INTERNATIONAL LIMITED, a company registered in Hong Kong (“TOCCAY”, “we”, “us” or “our”), collects, uses, discloses and protects personal information when you visit toccaycycling.com, contact us, create an account or place an order.

TOCCAY is the controller or responsible organization for the personal information described here, except where another party acts as an independent controller under its own notice. Contact: support@toccaycycling.com.

1. Information we collect

  • Identity and contact information: name, billing and shipping address, email address, telephone number and account details.
  • Order and transaction information: products, configuration, order value, currency, payment status, returns, warranty requests and customer-service records. Full card details are handled by payment providers and are not stored by TOCCAY.
  • Device and usage information: IP address, browser, device identifiers, operating system, referral source, pages viewed, interactions and approximate location derived from IP.
  • Marketing information: subscription status, campaign interactions, advertising preferences and consent records.
  • Content you provide: messages, reviews, photographs, videos and information submitted for technical support, returns or warranty assessment.
  • Fraud and compliance information: risk signals, order verification results and information needed to comply with tax, customs, sanctions and legal obligations.

2. How we collect information

We collect information directly from you, automatically through the website and cookies, and from service providers such as Shopify, payment processors, fraud-prevention providers, carriers, analytics providers, advertising platforms and social networks when permitted by law.

3. Why we use information

  • Process orders, payments, delivery, returns, refunds, warranty and customer support.
  • Operate, secure, troubleshoot and improve the website and products.
  • Prevent fraud, abuse, unauthorized transactions and security incidents.
  • Comply with accounting, tax, customs, sanctions, regulatory and legal requirements.
  • Send service messages and, with the required permission, marketing communications.
  • Measure campaign performance, understand audiences and provide relevant advertising where permitted.
  • Establish, exercise or defend legal claims.

4. Legal bases for the EEA and United Kingdom

Where the GDPR or UK GDPR applies, we process information as necessary to perform a contract or take requested pre-contract steps; comply with legal obligations; pursue legitimate interests such as operating, securing and improving our business, preventing fraud and handling claims; or based on consent where required, including for certain cookies and direct marketing. You may withdraw consent at any time without affecting earlier lawful processing. We balance legitimate interests against your rights and expectations.

5. Cookies, analytics and advertising

We and our partners may use cookies, pixels, tags, local storage and similar technologies for essential functions, preferences, measurement and advertising. Where required by law, non-essential technologies are used only after consent. Available privacy or cookie controls let you change choices. Browser settings may also block cookies, but some functions may not work correctly.

Advertising partners may receive online identifiers and activity information to measure campaigns or show advertising. Depending on applicable U.S. state law, this may be considered “sharing”, “targeted advertising” or, in limited circumstances, a “sale” even when no money is exchanged. See the U.S. notice below for opt-out rights.

6. When we disclose information

We disclose information only as reasonably necessary to:

  • Shopify and providers supporting hosting, checkout, payment, fraud prevention, analytics, advertising, communications, customer support and IT security.
  • Warehouses, suppliers, bicycle-service partners, carriers, customs brokers and insurers involved in fulfilling or supporting an order.
  • Professional advisers, auditors, banks and authorities where needed for compliance, claims or lawful requests.
  • A buyer, investor or successor in a merger, financing, restructuring or sale, subject to appropriate confidentiality and legal requirements.

We do not sell personal information for money. We do not knowingly sell or share personal information of children for targeted advertising.

7. International transfers

TOCCAY operates internationally and providers may process information in Hong Kong, mainland China, the United States, Canada, Europe and other locations where they or their subprocessors operate. Privacy laws may differ from those in your country. Where required, we use recognized safeguards such as adequacy decisions, contractual protections, Standard Contractual Clauses, the UK International Data Transfer Addendum or other lawful transfer mechanisms.

8. Retention

We keep personal information only as long as reasonably necessary for the purposes described here, including order fulfilment, warranty support, fraud prevention, accounting, tax, customs, dispute resolution and legal compliance. Retention varies by record type and applicable limitation periods. We then delete, anonymize or securely isolate information unless continued retention is legally required.

9. Security

We use reasonable administrative, technical and physical safeguards designed for the nature of the information and associated risks. No internet transmission or storage system is completely secure. If a legally reportable breach occurs, we will notify affected individuals and authorities as required.

10. Your global privacy choices

Depending on where you live, you may request access, correction, deletion, restriction, portability or withdrawal of consent; object to processing or direct marketing; opt out of targeted advertising, sale or sharing; or appeal a denied request. Rights are subject to legal exceptions.

Send requests to support@toccaycycling.com with the subject “Privacy Request”. Describe the request and the country or U.S. state where you live. We may verify identity and authority before responding. Authorized agents may submit requests where local law permits. We will not unlawfully discriminate against you for exercising privacy rights.

11. Hong Kong notice

Under Hong Kong's Personal Data (Privacy) Ordinance, TOCCAY follows applicable data-protection principles concerning purpose and manner of collection, accuracy and retention, use, security, openness, and access and correction. You may request access to or correction of your personal data. We will not use personal data for direct marketing without meeting applicable notice and consent requirements, and you may opt out free of charge at any time.

12. United States state privacy notice

Residents of California and other states with applicable comprehensive privacy laws may have rights to know or access, correct, delete and obtain a portable copy of personal information, and to opt out of sale, sharing, targeted advertising or certain profiling. You may also have the right to limit certain uses of sensitive personal information and to appeal a denied request, where applicable.

During the preceding 12 months, we may have collected the categories described in Section 1: identifiers; customer records; commercial information; internet or electronic activity; approximate geolocation; and inferences from shopping or marketing activity. We collect these categories from the sources in Section 2, use them for the purposes in Section 3, and disclose them to the recipients in Section 6.

TOCCAY does not sell personal information for money. Advertising-related disclosures of identifiers and internet activity may be treated as sale, sharing or targeted advertising under some state laws. You may opt out using an available cookie/privacy control or by emailing support@toccaycycling.com. Where legally required and technically detected, we treat a recognized opt-out preference signal, such as Global Privacy Control, as an opt-out request for that browser or device.

We use or disclose sensitive personal information only for permitted purposes such as payment, fulfilment, security, fraud prevention and legal compliance, and not to infer characteristics about you.

13. EEA and United Kingdom rights

If GDPR or UK GDPR applies, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests or for direct marketing; withdraw consent; and request human review where a solely automated decision produces legal or similarly significant effects. You may complain to the data-protection authority where you live or work, or where an alleged infringement occurred.

14. Canada

Where Canadian private-sector privacy law applies, you may request access to and correction of personal information and challenge our compliance. We collect, use and disclose personal information for identified reasonable purposes, obtain meaningful consent where required, limit collection and retention, and use appropriate safeguards. You may complain to the Office of the Privacy Commissioner of Canada or the applicable provincial regulator.

15. Australia

Where the Australian Privacy Act and Australian Privacy Principles apply, you may request access to and correction of personal information or make a privacy complaint. Contact us first so we can investigate. You may also contact the Office of the Australian Information Commissioner. Overseas recipients may be located in the regions described in Section 7.

16. Children

The website is intended for a general adult audience and is not directed to children under 16. We do not knowingly collect personal information from children under 13, or a higher minimum age where local law requires parental authorization. Contact us if you believe a child has provided information improperly.

17. Marketing choices

You may unsubscribe using the link in a marketing email or by contacting support@toccaycycling.com. We may still send non-promotional messages concerning orders, security, warranty or legal matters. Opting out does not affect processing already permitted by law.

18. Third-party sites

Third-party websites, social networks and services have their own privacy practices. Review their notices before providing information. We are not responsible for their independent practices.

19. Changes to this policy

We may update this policy to reflect changes in practices, providers or law. The “Last updated” date identifies the current version. We will provide additional notice of material changes where required.

20. Contact and complaints

TOCCAY SPORTS INTERNATIONAL LIMITED
Registered in Hong Kong
Privacy contact: support@toccaycycling.com
Website: toccaycycling.com

Please include enough information for us to understand and respond to a privacy request or complaint. We aim to respond within the period required by applicable law.