Website Privacy Policy

The data controller responsible for personal information processed through torro.co.uk is:

B.A.M Worldwide Ltd (trading as TORRO)
Unit 4B, New York Way
New York Industrial Park
Newcastle Upon Tyne
NE27 0QF
United Kingdom

Website: https://torro.co.uk
Email: customercare@torro.co.uk

For questions about this Privacy Policy, how we handle your personal information or how to exercise your data protection rights, please contact us using the details above.

This policy primarily relates to information collected through torro.co.uk and associated customer interactions. Other TORRO regional websites may operate under separate privacy notices or additional local requirements.

The information we collect depends on how you interact with TORRO.

Information You Provide Directly

When you place an order, create an account, subscribe to marketing communications or contact us, we may collect:

• Identity information: Your name and, where relevant, information needed to verify your identity.
• Contact information: Email address, telephone number, billing address and delivery address.
• Order information: Products purchased, order history, transaction details, delivery preferences, returns and refunds.
• Payment information: Payment method, payment confirmation, transaction references and limited payment details made available by our payment service providers.
• Account information: Account identifiers, login-related information and customer preferences.
• Customer service information: Enquiries, correspondence, complaints, warranty claims and other information you choose to provide.
• Marketing preferences: Newsletter subscriptions, consent records, communication preferences and unsubscribe requests.
• Reviews and feedback: Product reviews, survey responses, competition entries and other feedback submitted voluntarily.

Payment card details are handled through authorised payment service providers. We do not require customers to provide full payment card details directly to our Customer Care team.

Information Collected Automatically

When you visit our website, we may collect technical and usage information, including:

• IP address and approximate geographical location.
• Browser type, operating system and device information.
• Device and online identifiers.
• Pages viewed, links clicked and website navigation activity.
• Products viewed, searched for or added to your shopping basket.
• Referring websites, advertising campaigns and search information.
• Website interaction, session and performance information.
• Dates, times and frequency of visits.
• Cookies and similar tracking identifiers, subject to applicable consent requirements.

Some of this information may be collected through cookies, pixels or other technologies provided by TORRO or our service providers.

For further information, please see our Cookie Policy.

Information Received from Third Parties

Where relevant to our services, we may receive personal information from:

• Ecommerce and payment service providers.
• Delivery couriers and fulfilment providers.
• Advertising, analytics and affiliate marketing services.
• Customer service, reviews and email marketing platforms.
• Social media platforms when you interact with TORRO.
• Fraud prevention and security services.
• Other organisations involved in fulfilling your order or responding to an enquiry.

This information may include transaction confirmations, delivery updates, referral information, advertising interactions, customer feedback or information needed to investigate suspected fraud.

We use information obtained from third parties only where we have an appropriate lawful basis and where its use is consistent with applicable data protection requirements.

We collect and process personal information for defined purposes, including providing our products and services, fulfilling orders, managing customer relationships and operating our business.

The lawful basis we rely on depends on the activity and circumstances.

Processing Orders and Deliveries

We use personal information to:

• Accept and process orders.
• Process payments and refunds.
• Arrange delivery and provide tracking information.
• Communicate important information about your purchase.
• Manage returns, exchanges and warranty claims.
• Provide relevant after-sales support.

Lawful basis: Performance of a contract, compliance with legal obligations and, where appropriate, legitimate interests.

We require certain information, such as contact details, delivery information and payment details, to complete a purchase. Without this information, we may be unable to fulfil your order.

Customer Accounts

Where you create an account, we use your information to:

• Establish and maintain your account.
• Provide access to order history and account features.
• Remember account preferences.
• Support account security.
• Respond to account-related enquiries.

Lawful basis: Performance of a contract and legitimate interests in providing secure and effective account services.

Customer Service and Complaints

We use personal information to respond to enquiries, manage complaints, investigate product concerns and assist with returns and warranty claims.

We may retain records of our communications to help resolve ongoing issues, provide consistent customer service and establish how a matter was handled.

Lawful basis: Performance of a contract, compliance with legal obligations and legitimate interests in providing effective customer support and managing disputes.

Fraud Prevention and Website Security

We may process personal information to:

• Detect and prevent fraudulent transactions.
• Protect customer accounts from unauthorised access.
• Monitor unusual or potentially malicious activity.
• Maintain website and system security.
• Investigate security incidents.
• Protect TORRO, our customers and other users from unlawful activity.

This may involve examining transaction information, IP addresses, device information and other relevant security indicators.

Lawful basis: Legitimate interests in maintaining the security and integrity of our services, and compliance with legal obligations where applicable.

Where we rely on legitimate interests, we assess the necessity of the processing and its potential impact on individuals.

Business Analysis and Improvement

We analyse relevant information to understand how our business and website perform.

This may include:

• Identifying popular products and purchasing trends.
• Understanding customer demand.
• Improving our product range.
• Managing inventory and forecasting stock requirements.
• Improving website navigation and functionality.
• Evaluating customer satisfaction.
• Measuring operational performance.

Where possible, we use aggregated or anonymised information for these purposes.

Lawful basis: Legitimate interests in operating, developing and improving our business, or consent where required for the collection of information through optional tracking technologies.

Legal and Regulatory Requirements

We may process personal information where necessary to comply with applicable laws or regulatory obligations, including:

• Tax and accounting requirements.
• Consumer protection legislation.
• Product safety and recall obligations.
• Applicable legal requests and court orders.
• Data protection obligations.
• Other statutory recordkeeping requirements.

Lawful basis: Compliance with a legal obligation.

We may use your personal information to provide information about TORRO products, promotions, product launches, special offers and other relevant marketing communications.

These may include email marketing, SMS marketing and other communication channels where appropriate.

We send electronic direct marketing where you have provided the necessary consent or where another permitted basis applies under relevant legislation.

Email and SMS Marketing

Where you subscribe to our newsletter, we may use your email address and relevant preferences to send marketing communications.

For existing customers, we may also send marketing about similar TORRO products where the conditions of the applicable soft opt-in exemption are met, including providing a clear opportunity to opt out when details are collected and in every subsequent marketing message.

We do not treat the purchase of a product as automatic consent to every form of marketing.

Personalised Marketing

Where permitted, we may use information such as:

• Products previously purchased.
• Products viewed or added to a shopping basket.
• Customer preferences and interests.
• Engagement with previous marketing communications.
• Relevant website activity collected through permitted tracking technologies.

This information may help us recommend products or provide marketing that is more relevant to your interests.

Where personalised marketing relies on non-essential cookies or similar tracking technologies, we obtain consent where required.

The lawful basis for subsequent processing of personal data is assessed separately and may include consent or legitimate interests, depending on the activity and applicable legal requirements.

Abandoned Basket and Browse Reminders

Where permitted, we may send reminders about products you have viewed or added to your shopping basket without completing a purchase.

These communications may be supported by our email marketing platform, Klaviyo.

We only send these reminders where an appropriate legal basis and applicable electronic marketing permissions exist.

Managing Marketing Preferences

You can opt out of direct marketing at any time by:

• Clicking the unsubscribe link included in our marketing emails.
• Using any available marketing preference controls.
• Contacting customercare@torro.co.uk.

We will respect your marketing preferences and maintain the information necessary to record and honour opt-out requests.

Unsubscribing from marketing will not prevent us from sending essential service communications relating to your orders, account security, recalls or other non-promotional matters.

We use Klaviyo to support email marketing, customer communications and relevant personalisation.

Klaviyo may process information such as:

• Contact details and marketing subscription status.
• Order and purchase history.
• Products viewed and shopping basket activity.
• Email engagement, including clicks and other interaction data.
• Customer preferences and relevant website interactions.

Where permitted, Klaviyo may use first-party cookies, persistent identifiers and similar technologies to recognise browsers across visits and associate website activity with a customer or subscriber profile.

For example, website interactions may help us provide relevant product recommendations or abandoned basket reminders.

The use of non-essential tracking technologies is subject to applicable cookie consent requirements.

Consent to receive marketing communications is separate from consent to optional website tracking.

Where required, visitors can manage or withdraw tracking consent through our cookie preferences.

Klaviyo and related information may be subject to retention periods determined by the service configuration and our retention requirements.

For more information about the technologies used on our website, please see our Cookie Policy.

We use cookies and similar technologies to operate our website, understand how visitors use it and measure marketing performance.

These technologies may include browser cookies, tracking pixels, local storage and other online identifiers.

Essential Technologies

Certain technologies are necessary for the operation and security of our website.

These may support:

• Shopping basket and checkout functionality.
• Customer authentication.
• Website security and fraud prevention.
• Session management.
• Remembering privacy preferences.

Essential technologies may operate without consent where an applicable legal exception permits their use.

Analytics Technologies

We use analytics services, including Google Analytics, to understand website traffic, customer interactions and purchasing activity.

Depending on the configuration, these services may process information such as device identifiers, browsing events, transaction information and approximate location.

Where required by applicable law, optional analytics technologies are activated only after the appropriate consent has been obtained.

Advertising Technologies

We use advertising and measurement services to understand campaign performance and, where permitted, deliver relevant advertisements.

These services may include Google advertising technologies and Meta advertising services associated with Facebook and Instagram.

Advertising technologies may process information about visits, product interactions, purchases and other conversion events.

Personalised advertising and related tracking are subject to applicable data protection and cookie consent requirements.

Some advertising providers may act as independent controllers or joint controllers for particular processing activities, rather than processing information solely on TORRO's instructions.

Affiliate Marketing

We may use affiliate marketing services to identify visits and purchases resulting from links placed by our promotional partners.

These technologies can help attribute sales to the appropriate publisher and calculate commissions.

Where affiliate attribution involves cookies or similar technologies, we apply the relevant consent requirements and legal exceptions.

Your Cookie Choices

You can manage optional cookies and tracking technologies through the cookie consent controls available on our website.

You may also use your browser settings to block or delete cookies.

Please note that blocking essential cookies may affect the functionality of our website.

For further details, please read our Cookie Policy.

We share personal information with selected service providers and other organisations where necessary to provide our services, operate our business or comply with legal obligations.

The information shared depends on the service involved.

Ecommerce and Website Services

Shopify

Our website operates using Shopify's ecommerce platform.

Shopify processes information necessary for ecommerce functionality, including customer accounts, shopping baskets, orders, checkout, website operations and relevant analytics or marketing services.

Depending on the specific service and processing purpose, Shopify may act as a processor or an independent controller.

Payment Service Providers

We share relevant transaction information with payment service providers to process payments, refunds and related security checks.

The providers involved depend on the payment method selected at checkout.

Payment service providers may process relevant personal information in accordance with their own privacy policies and legal obligations.

Delivery and Fulfilment Partners

We share the information necessary to deliver orders with relevant delivery couriers, fulfilment providers and shipping services.

This may include your name, address, contact details, order reference and delivery instructions.

Where necessary for international delivery, information may also be provided to customs authorities and other relevant organisations.

Marketing and Customer Engagement

Klaviyo

We use Klaviyo to support email marketing, customer engagement and relevant personalisation.

Google

We use Google services for website analytics, advertising and campaign performance measurement.

Meta

Where enabled, we use Meta services associated with Facebook and Instagram for advertising, measurement and related marketing activities.

Additional advertising providers may be used where relevant to our marketing activities and website configuration.

Customer Reviews and Feedback

Trustpilot

We may share relevant information with Trustpilot to facilitate customer review invitations and support feedback about our products and services.

Trustpilot may process information as an independent controller for certain activities.

Marketplaces and Sales Channels

Amazon

Where relevant to an order, marketplace activity or related customer service, information may be exchanged with Amazon or other sales-channel providers.

Such sharing is limited to information necessary for the relevant transaction or service.

Customer Support and Operational Services

We may share relevant information with providers supporting:

• Customer service and communications.
• Order management and fulfilment.
• Website hosting, maintenance and technical support.
• Payment security and fraud prevention.
• Business analytics and reporting.
• Professional accounting, legal and compliance services.

We seek to ensure that organisations processing personal information on our behalf are subject to appropriate contractual and security obligations.

Where a recipient acts as an independent data controller, it is responsible for complying with applicable data protection requirements in relation to its own processing activities.

We do not sell customer contact lists to third parties for their independent direct marketing.

We may disclose personal information where necessary to comply with legal obligations, respond to lawful requests or protect legitimate interests.

This may include disclosures to:

• Law enforcement authorities.
• Courts and regulatory bodies.
• Tax and customs authorities.
• Fraud prevention and security organisations.
• Legal advisers and professional consultants.

We assess requests for personal information and disclose information only where we have an appropriate legal basis.

If TORRO undergoes a merger, acquisition, restructuring or sale of some or all of its business, relevant personal information may be transferred to a prospective or new owner where lawful and necessary.

Any such transfer will be handled in accordance with applicable data protection requirements.

TORRO is based in the United Kingdom, but some of our service providers, customers and business partners operate internationally.

As a result, personal information may be processed or accessed outside the United Kingdom.

International transfers may occur when:

• We use international ecommerce, hosting or cloud services.
• Payments are processed through international payment networks.
• Orders are delivered internationally.
• Customer service or technical support is provided from another country.
• Analytics, marketing or other service providers process information internationally.

Where personal information is transferred outside the United Kingdom and the transfer is subject to UK GDPR restrictions, we ensure that an appropriate transfer mechanism applies.

Depending on the circumstances, this may include:

• UK adequacy regulations recognising an appropriate level of data protection.
• The UK International Data Transfer Agreement (IDTA).
• The UK Addendum to the European Commission's Standard Contractual Clauses.
• Other lawful transfer mechanisms or exceptions permitted under applicable data protection legislation.

Where required, we also assess whether supplementary safeguards are necessary to protect transferred information.

You may contact us for further information about the safeguards applicable to relevant international transfers and how to obtain a copy of them, subject to appropriate confidentiality protections.

Where the EU GDPR also applies, relevant international transfers are assessed under the corresponding EU requirements.

We take the security of personal information seriously.

We use appropriate technical and organisational measures designed to protect information against unauthorised access, accidental loss, destruction, alteration or disclosure.

These measures may include:

• Encrypted connections when transmitting information.
• Access controls and account security measures.
• Restrictions on access to personal information according to business responsibilities.
• Appropriate authentication and password protection.
• Security monitoring and incident investigation.
• Contractual protections for relevant service providers.
• Reviews of information security risks and system vulnerabilities.

Payments are processed through authorised payment providers using appropriate security controls.

No internet-based service or method of electronic storage can be guaranteed to be completely secure. However, we take reasonable and proportionate steps to protect information in accordance with applicable legal requirements.

Where a personal data breach occurs, we assess the incident and make notifications to the Information Commissioner's Office or affected individuals where required by law.

We retain personal information only for as long as necessary for the purposes for which it was collected, including fulfilling contractual commitments, meeting legal obligations, resolving disputes and establishing or defending legal claims.

Different categories of information may be retained for different periods.

Orders, Payments and Financial Records

We retain transaction and accounting records for the periods required by applicable tax, accounting and other legal obligations.

Where applicable, records may be retained for at least six years or another legally required period.

Customer Accounts

Account information is retained while an account remains active and thereafter for the period necessary to meet legitimate operational, contractual or legal requirements.

Customers may request account deletion, subject to information we are legally entitled or required to retain.

Customer Service, Returns and Warranty Information

We retain relevant correspondence and records relating to customer enquiries, orders, returns, complaints and warranties for periods necessary to provide support, manage continuing obligations and resolve disputes or legal claims.

Marketing Records

Marketing contact information is retained while there is a valid basis to send communications and for any further period necessary to maintain appropriate compliance records.

Where you unsubscribe, we may retain limited information on a suppression list to ensure that your preferences continue to be respected.

Website Analytics and Tracking

Information collected through analytics and tracking technologies is retained according to the purpose, relevant service settings, applicable consent choices and our data-retention requirements.

Cookie and device-level retention periods may differ from retention periods for information held within analytics or marketing platforms.

Security and Fraud Prevention

Relevant records may be retained for periods reasonably necessary to investigate suspected fraud, protect our systems, comply with legal obligations and establish or defend legal claims.

When personal information is no longer required, we will delete it, anonymise it or otherwise dispose of it securely, unless continued retention is legally justified.

The specific periods applied to each category are determined by our documented retention requirements, relevant legal obligations and the circumstances of the processing.

Depending on the circumstances and applicable law, you have a number of rights concerning your personal information.

Right of Access

You can request confirmation of whether we process your personal information and obtain access to the information we hold about you.

Right to Rectification

You can request that inaccurate or incomplete personal information be corrected or completed.

Right to Erasure

You can request deletion of your personal information where the relevant legal conditions are met.

This right is not absolute. We may need to retain certain records to comply with legal obligations or for other lawful purposes.

Right to Restrict Processing

You can request that we restrict the use of your personal information in certain circumstances.

Right to Data Portability

Where applicable, you can request certain personal information in a structured, commonly used and machine-readable format, or ask for it to be transmitted to another organisation where technically feasible.

Right to Object

You may object to processing based on legitimate interests in circumstances provided by law.

You have an absolute right to object to the processing of your personal information for direct marketing, including profiling related to direct marketing.

If you exercise this right, we will stop processing your personal information for the relevant direct marketing purposes.

Right to Withdraw Consent

Where we rely on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights Relating to Automated Decision-Making

You may have rights and protections concerning certain decisions made solely through automated processing that produce legal or similarly significant effects.

Where such decisions are made, we will provide the information and safeguards required by applicable law.

We do not describe ordinary product recommendations or routine marketing personalisation as decisions that automatically produce legal or similarly significant effects.

How to Exercise Your Rights

To exercise your data protection rights, please contact:

Email: customercare@torro.co.uk

Postal address: B.A.M Worldwide Ltd (trading as TORRO), Unit 4B, New York Way, New York Industrial Park, Newcastle Upon Tyne, NE27 0QF, United Kingdom.

We may request additional information where reasonably necessary to verify your identity.

We will respond within the time limits required by applicable law and explain any lawful reason why a request cannot be fulfilled in full.

We do not normally charge a fee for exercising data protection rights. A reasonable fee may apply where permitted by law, including for requests that are manifestly unfounded or excessive.

You can ask us to stop processing your personal information for direct marketing at any time.

The easiest way to stop receiving marketing emails is to use the unsubscribe link included in our communications.

You can also contact customercare@torro.co.uk to request changes to your marketing preferences.

If you object to direct marketing, we will stop processing your personal information for the relevant marketing purposes.

We may retain limited information necessary to maintain a suppression record and prevent further unwanted marketing.

Please note that essential non-promotional communications relating to orders, account security, product safety or legal requirements may continue where appropriate.

You can also manage optional website tracking through our cookie preference controls.

Our website and products are primarily intended for general consumers and are not specifically directed at children.

We do not knowingly seek to collect personal information directly from children for independent marketing purposes without an appropriate lawful basis and any consent required by law.

If you believe that a child has provided personal information to us in circumstances requiring further protection, please contact our Customer Care team.

We will review the circumstances and take appropriate action.

Our website may contain links to third-party websites, social media platforms or external services.

These organisations may collect and process information according to their own privacy policies and applicable legal obligations.

TORRO does not control the independent privacy practices of external websites.

We encourage you to review the privacy notices of third-party services before providing personal information.

If you have concerns about how TORRO collects, uses or protects your personal information, please contact us.

Email: customercare@torro.co.uk

Please include details of your concern and any information that may help us investigate.

We will acknowledge data protection complaints within 30 days of receipt, take appropriate steps to investigate without undue delay, keep you informed where appropriate and communicate the outcome of our review.

If you remain dissatisfied, or wish to raise a concern directly with the regulator, you have the right to complain to the Information Commissioner's Office (ICO).

Information Commissioner's Office
Website: https://ico.org.uk
Make a complaint: https://ico.org.uk/make-a-complaint/

You may also have the right to bring proceedings before a court or complain to another competent supervisory authority where applicable law provides for this.

We may update this Privacy Policy periodically to reflect changes in our services, business operations, technology or applicable legislation.

When changes are made, we will update the revision date at the top of this page.

Where required by law, we will provide additional notice or obtain appropriate consent before introducing new processing activities.

We encourage customers to review this page periodically to remain informed about how TORRO processes personal information.

If you have any questions about this Privacy Policy, our use of personal information or your data protection rights, please contact:

TORRO Customer Care
Email: customercare@torro.co.uk

B.A.M Worldwide Ltd (trading as TORRO)
Unit 4B, New York Way
New York Industrial Park
Newcastle Upon Tyne
NE27 0QF
United Kingdom

Website: https://torro.co.uk

Customer Care Hours: Monday – Friday, 9:00am – 3:00pm (UK), excluding UK bank holidays.

We are committed to handling personal information responsibly and responding to privacy enquiries in accordance with applicable data protection legislation.

LAST UPDATED: 21/10/26