Privacy governance, advertising tracking, & data protection standards

Advertising Platforms & Click Identifiers

This website receives active promotional traffic through commercial campaigns operated on major digital networks. Specifically, google ads, microsoft advertising, and Meta Ads send traffic here. When a user clicks a paid placement to reach bajashq.com, platform-specific click identifiers are appended to the landing URL:

• gclid — Google Click Identifier, utilized by Google Ads for conversion measurement and campaign attribution.
• msclkid — Microsoft Click Identifier, utilized by Microsoft Advertising to measure search and retail ad engagement.
• fbclid — Meta Click Identifier, utilized by Meta Ads for campaign routing and engagement verification.

These identifiers allow our marketing systems to verify campaign return on investment without building comprehensive personal behavioral profiles.

Consent Mode v2 Integration Mechanics

In full compliance with international standards, this site implements Google consent mode v2. Prior to an explicit interaction with our cookie banner, the four foundational advertising signals are maintained in a strictly denied status:

• ad_storage: Denied by default; prevents platforms from writing or reading advertising cookies.
• ad_user_data: Denied by default; prevents sending user-centric identifiers to advertising platforms.
• ad_personalization: Denied by default; prevents utilizing visit data for retargeting or interest profiles.
• analytics_storage: Denied by default; prevents long-term analytics session cookies until permission is granted.

When a visitor chooses to decline or withdraw consent, all four parameters are immediately returned to denied status. No measurement tags execute or read cookies without active affirmative permission.

Global Privacy Control Signal Recognition

Baja’s HQ automatically recognizes and honors the global privacy control (GPC) signal transmitted via the Sec-GPC browser header. When your browser broadcasts this signal, our systems interpret it as an immediate, binding request to opt out of non-essential tracking, sale, and cross-context behavioral advertising without requiring manual interaction with our consent banner.

Third-Party Data Processors

Operational data is shared only with vetted third-party service providers acting on our strict instructions under written data processing agreements:

• Google LLC / Google Ireland Ltd: Advertising campaign delivery, conversion verification, and Consent Mode signal reception.
• Microsoft Ireland Operations Ltd: Microsoft Advertising delivery and Merchant Center verification. For details on Microsoft data handling, review the Microsoft privacy statement at privacy.microsoft.com.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Social advertising delivery and attribution tracking where active campaigns run.
• Hosting Infrastructure & Network Provider: United States datacenter infrastructure maintaining application server containers, MySQL storage, and daily encrypted backups.
• Email Transmission Gateway: Encrypted SMTP mail relay routing incoming technical fitment notifications to our parts desk inbox.

International Data Transfers

Data collected through bajashq.com is stored primarily on servers within the United States. For visitors accessing our services from outside the United States, personal data is transferred across international borders pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, UK International Data Transfer Agreements, or equivalent cross-border data protection transfer mechanisms ensuring adequacy.

Fixed Data Retention Schedules

We do not retain customer data indefinitely. Baja’s HQ applies explicit, defined retention limits across all informational categories:

• Technical Inquiries & Email Records: Retained for exactly 24 months from submission to support recurring vehicle fitment lookups and parts warranty verification.
• Support Chat Transcripts: Retained for 18 months to facilitate customer service continuity.
• Server & Access Log Files: Retained for 60 days for network security auditing and automated denial-of-service monitoring, after which logs are purged automatically.
• Cookie Consent Choices: Stored locally in the user’s browser for 12 months, after which the preference prompts renewal.
• Data Subject Access Requests: Formal requests and our correspondence are archived for 24 months to satisfy legal audit obligations.

Technical & Organizational Security Measures

We maintain comprehensive administrative and technical safeguards designed to protect personal and vehicle fitment data against unauthorized access, loss, or alteration:

• Full Transport Layer Security (TLS 1.3) encryption enforced across all web pages and API submission endpoints.
• Rigorous input sanitization, automated anti-spam token verification, and honeypot field trapping on all web forms.
• Restricted internal access controls limiting customer inquiry databases strictly to our authorized parts management personnel.
• Automated periodic vulnerability patching across our hosting environment and server runtime packages.

Children’s Online Privacy Protection

Baja’s HQ operates an off-road automotive equipment and tuning catalogue intended solely for licensed drivers and adult vehicle owners. Our website does not target, solicit, or knowingly collect personal information from individuals under the age of 16. In the event that we identify personal data inadvertently gathered from a minor, we will delete that information immediately upon discovery.

Policy Updates & Amendments

We reserve the right to amend this privacy policy to reflect alterations in our technical operations, emerging legal requirements, or adjustments to advertising platform standards. Substantive updates will be published directly to this page with a revised effective date. Continued use of our site following published revisions constitutes acknowledgement of the updated terms.

California & US State Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (ccpa / CPRA), as well as comprehensive privacy statutes in other applicable states, California residents and eligible US consumers possess enforceable privacy rights:

• Right to Know & Access: You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, and our business purpose for processing.
• Right to Deletion: You have the right to request that we delete personal data collected from you, subject to statutory exceptions for warranty and commercial record-keeping.
• Right to Correction: You may demand correction of inaccurate personal data maintained in our records.
• Right to Opt-Out of Sale or Sharing: Baja’s HQ does not sell personal information for monetary consideration. To opt out of cross-context behavioral advertising (sharing), use our cookie preference tool or transmit a Global Privacy Control signal.
• Right to Non-Discrimination: We will never deny services, charge differentiated prices, or degrade component quote turnaround because you exercised your statutory privacy rights.

European Economic Area & UK Rights (GDPR)

For visitors accessing bajashq.com from the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (gdpr) guarantees specific individual protections:

• Right of Access: Request confirmation of whether your data is being processed and obtain a portable copy.
• Right to Rectification: Rectify inaccurate or incomplete contact records.
• Right to Erasure ('Right to be Forgotten'): Request erasure of personal data where processing is no longer required for its original purpose.
• Right to Restriction: Restrict processing during active disputes concerning data accuracy or lawfulness.
• Right to Data Portability: Receive your inquiry records in a structured, commonly used, machine-readable format.
• Right to Object: Object to processing founded upon legitimate business interests or direct promotional attribution.
• Right to Withdraw Consent: Revoke consent at any moment without affecting the lawfulness of prior processing.

Regulatory Complaints & Supervisory Authorities

If you believe that our data handling practices violate applicable privacy statutes, you hold the legal right to submit a formal complaint to competent supervisory bodies:

• In California, complaints may be lodged with the California Privacy Protection Agency (CPPA) or the Office of the California Attorney General.
• In other US jurisdictions, contact your relevant state Attorney General’s consumer protection bureau.
• In the European Union or United Kingdom, contact your national Data Protection Authority (such as the UK Information Commissioner’s Office or the Irish Data Protection Commission).

Human Privacy Contact Information

For questions concerning our privacy practices, platform tracking disclosures, or to reach our data privacy officer directly: