Skip to content

Inc. VAT

Ex. VAT

Privacy Policy

Privacy Policy

Last updated: 17 August 2026

1. Data Controller

The data controller for this website is Input IT Ltd (Company No. 04812979), trading as Cool Bear UK and XYZ Racing UK.

Contact: [email protected]

Address: Input IT Ltd, Unit 10/6 Pickup Storage, Grangefield Road, Pudsey, LS28 6JR, United Kingdom

2. What Data We Collect

We collect and process the following personal data:

  • Account information: name, email address, billing and shipping addresses, telephone number (if provided)
  • Order information: products ordered, order history, payment references, delivery addresses, vehicle details (make, model, year) related to your order
  • Payment information: payment is processed securely by Stripe. We do not store your full card details on our servers. Stripe may store tokenised payment data in accordance with their own privacy policy.
  • Communications: any emails, messages, or support correspondence you send to us
  • Website usage data: IP address, browser type, pages visited, referring URLs, and session duration (collected via cookies and analytics tools, subject to your consent)

3. Lawful Bases for Processing

Under UK GDPR, we process your personal data on the following lawful basis for each activity:

  • Contract: processing your orders, managing your account, arranging delivery, and providing after-sales support (including warranty claims and returns). This processing is necessary for the performance of our contract with you.
  • Legitimate interests: fraud prevention, website security, internal analytics to improve our service, and communication about order-related matters. We have assessed that these interests do not override your rights and freedoms.
  • Consent: marketing communications (email newsletters, promotional offers) and non-essential cookies (analytics, advertising). You may withdraw consent at any time.
  • Legal obligation: retention of order and financial records for HMRC VAT and tax compliance purposes.

4. How Long We Keep Your Data

  • Order and financial records: 7 years from the date of the transaction, as required by HMRC for VAT and accounting purposes.
  • Account information: retained for as long as your account is active. You may request deletion at any time (see section 7 below).
  • Marketing preferences: retained until you withdraw consent.
  • Website analytics data: aggregated and anonymised within 26 months.

5. Who We Share Your Data With

We share your personal data only where necessary:

  • Stripe: payment processing. Stripe acts as an independent data controller for payment data.
  • Cool Bear Co. Ltd (Taiwan): your name, shipping address, and order specification are shared with the manufacturer to fulfil your order.
  • Shipping carriers: your name and delivery address are shared with our courier partners to deliver your order.
  • Email service provider: if you opt in to marketing, your email address is shared with our ESP for newsletter delivery.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

6. International Transfers

Your order data is transferred to Cool Bear Co. Ltd in Taiwan for manufacturing and fulfilment purposes. Taiwan is not currently subject to a UK adequacy decision. We rely on Standard Contractual Clauses (SCCs) and a transfer risk assessment to ensure your data is protected to UK GDPR standards during this transfer.

7. Your Rights

Under UK GDPR, you have the following rights:

  • Right of access: request a copy of the personal data we hold about you
  • Right to rectification: request correction of inaccurate or incomplete data
  • Right to erasure: request deletion of your data (subject to legal retention obligations)
  • Right to restriction: request that we restrict the processing of your data in certain circumstances
  • Right to data portability: request a machine-readable copy of data you have provided to us
  • Right to object: object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
  • Right to complain: you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

8. How to Exercise Your Rights

To exercise any of the above rights, please email us at [email protected]. We will respond to your request within 30 days.

We may ask you to verify your identity before processing your request.

9. Cookies

We use cookies on this website. For full details of the cookies we use, their purposes, and how to manage your cookie preferences, please see our Cookie Policy.

10. Updates to This Policy

We may update this privacy policy from time to time. Material changes will be posted on this page with an updated “Last updated” date. Where appropriate, we will notify registered users by email of significant changes to how we handle personal data.