Privacy Policy

First Class Journey LLC Effective Date: September 28, 2026

1. Who We Are

First Class Journey LLC is a limited liability company organized under the laws of the State of New Mexico, United States. Our registered and business address is 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. We operate the website at https://journeyfirstclass.com (the "Site"). We provide e-commerce training and business advisory services: training programmes on launching and running an online store, and consulting and advisory services for companies seeking to improve their operations, pricing, sales channels and growth planning. The Site is an informational page describing our services; nothing is sold through it.

For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK General Data Protection Regulation as retained in UK law ("UK GDPR"), First Class Journey LLC is the data controller of personal information collected through the Site.

2. Scope

This Privacy Policy applies to personal information collected through the Site when you visit it, read its content, or submit an enquiry through the contact form, and to personal and business information you share with us in the course of a training or advisory engagement that follows from such an enquiry. It does not apply to information you provide to third parties, even if you reach them through a link on our Site. Because nothing is sold through the Site itself, this policy covers no online payment data and no shopping account data collected through the Site; where fees are invoiced for an agreed engagement, section 3d below explains what we collect for that purpose.

3. Information We Collect

3a. Contact Form Data

When you submit the contact form on our Site, we collect the following:

• First and last name
• Email address
• Phone number (optional, if you choose to provide it)
• Reason for contacting us, selected from: e-commerce training, business advisory, or other consulting
• Your message
• A record of whether you checked the required privacy-policy acknowledgement checkbox
• A record of whether you checked the separate, optional checkbox to receive news and updates by email

The form also includes a hidden anti-spam honeypot field that is not visible to human visitors and is not used to collect any personal information. Its sole purpose is to detect and discard automated spam submissions. The form also applies a per-IP submission rate limit: to operate it, we store a one-way SHA-256 hash of the submitting IP address together with a timestamp, in a private folder on our server, for up to one hour, after which it is deleted. We cannot reconstruct your IP address from that hash.

Submitted form data is transmitted by email through the Site's own mail server (PHP mail() via local Exim) to support@journeyfirstclass.com and is stored in that mailbox. We do not use a third-party form service, a customer relationship management (CRM) system, or a newsletter platform at this time.

3b. Information Shared During an Engagement

If your enquiry leads to a training programme, advisory engagement, or other consulting service, we may collect further information necessary to scope and deliver that service, such as: the emails and messages we exchange with you; information about your business that you choose to share for the purposes of diagnosis, planning, pricing or process review (for example, general information about your store, sales channels, suppliers, or margins); scheduling details for live sessions; and, where an engagement is invoiced, billing contact details. We only collect what is reasonably necessary for the specific engagement, and we do not ask for information unrelated to the service being provided.

3c. Technical Server Logs

Our hosting server automatically records the following information each time a browser requests a resource from the Site:

• IP address of the requesting device
• User-agent string (browser type and version, operating system)
• Date and timestamp of the request
• URL of the requested resource

These logs are retained for security purposes for up to 30 days and are then deleted. They are not used to build visitor profiles or for marketing.

3d. Browser Storage

The Site does not set any cookies. It uses two localStorage entries in your browser:

• fcj-lang: stores your chosen display language (English or Spanish), only written if you have accepted the Preferences category. This is a preference entry.
• fcj-consent: stores your consent choices made in the consent banner. This is a strictly necessary entry required to honour your choices.

No analytics, advertising pixels, social media embeds, or third-party tracking scripts are loaded on the Site. Third-party fonts are not loaded at runtime; all fonts are self-hosted on our server. A more detailed description of browser storage appears in Section 7 below and in our Cookie Policy.

4. How We Use Your Information and Legal Bases Under GDPR / UK GDPR

4a. Responding to Enquiries and Scoping Engagements

We use the name, email address, optional phone number, reason for contact, and message that you submit to read, assess, and respond to your enquiry, and to prepare a proposal or engagement letter if you request one. The legal basis is Article 6(1)(b) GDPR / UK GDPR: processing is necessary to take steps at your request prior to entering into a contract. Where you submit a general question not tied to a prospective engagement, we rely on Article 6(1)(f): our legitimate interest in communicating with prospective clients and operating our business responsibly, balanced against your interest in receiving a response you have actively requested.

4b. Delivering a Training or Advisory Engagement

Once you engage us for training or advisory services, we use the information described in section 3b to plan sessions, prepare deliverables, communicate with you, issue invoices, and otherwise perform the engagement. The legal basis is Article 6(1)(b): processing is necessary for the performance of a contract with you, or, where the engagement is with a company you represent, our legitimate interest under Article 6(1)(f) in performing that business relationship.

4c. News and Updates Emails

If you check the separate, optional opt-in checkbox on the contact form, we will use your email address to send you occasional updates about our training programmes and advisory services. The legal basis is Article 6(1)(a) GDPR / UK GDPR: your freely given, specific, informed, and unambiguous consent. You may withdraw this consent at any time by emailing support@journeyfirstclass.com; withdrawal does not affect the lawfulness of processing before withdrawal. We do not send marketing emails on the basis of legitimate interests; we only send them where you have given separate, specific opt-in consent.

4d. Security and Anti-Spam

We use server logs (IP address, user agent, timestamps, URLs), the hashed-IP rate limit, and the honeypot mechanism to detect and mitigate security threats, abuse, and spam. The legal basis is Article 6(1)(f): our legitimate interest in protecting the integrity and security of the Site and our communications infrastructure.

4e. Legal and Tax Compliance

We may process and retain personal information, including invoicing and engagement records, where we are required to do so under applicable tax, commercial, or other law, or to respond to a lawful request from a competent authority. The legal basis is Article 6(1)(c): processing is necessary for compliance with a legal obligation.

4f. No Automated Decision-Making

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

5. Marketing Emails - Opt-In Requirement

We only send news and update emails to individuals who have affirmatively checked the separate, clearly labelled optional checkbox on the contact form before submitting it. That checkbox is unchecked by default. Checking the required privacy-policy acknowledgement checkbox does not constitute consent to receive marketing emails; the two checkboxes are separate.

If you did not check the opt-in checkbox when you submitted the form, you will not receive marketing emails from us on the basis of that submission. If you change your mind and wish to receive such emails, you may contact us at support@journeyfirstclass.com to provide your consent.

To stop receiving marketing emails, email support@journeyfirstclass.com at any time. We will process your withdrawal promptly.

6. Service Providers and Disclosures

6a. Hosting and Email Provider

Our web agency operates a dedicated server on our behalf. That server is located in Germany, European Union, and hosts both the Site and the support@journeyfirstclass.com mailbox. Our web agency processes personal information stored on that server only on our instructions and does not use it for its own purposes.

6b. No Other Third-Party Data Processors at This Time

At this time, we do not use any third-party analytics service, advertising network, social media platform, CRM, newsletter platform, or payment processor in connection with the Site. If we engage such a provider in the future, we will update this policy.

6c. Other Disclosures

We may disclose personal information in the following circumstances:

• To comply with a court order, subpoena, or other lawful legal process
• To respond to a verified request from a law enforcement or regulatory authority
• To protect the rights, property, or safety of First Class Journey LLC, our clients, or the public where required or permitted by law
• To our accountant or legal counsel where necessary to comply with tax, commercial, or other legal obligations, under confidentiality obligations
• In connection with a merger, acquisition, reorganization, or sale of assets, where the receiving party is bound to treat the information in accordance with this policy or to notify you of any material change before the information is used differently

We do not sell, rent, trade, or otherwise disclose personal information for monetary or other valuable consideration to any third party, and we do not share personal information for cross-context behavioral advertising.

7. Browser Storage and Cookies

The Site does not place any cookies on your device. The only client-side storage the Site uses is two localStorage entries: fcj-lang (preference, stores your language choice) and fcj-consent (strictly necessary, stores your consent selections). Neither entry is used for advertising, analytics, or cross-site tracking.

When you first visit the Site, a consent banner invites you to Accept all, Reject non-essential storage, or Manage preferences. The preference categories in the banner are Necessary, Preferences, Analytics, and Marketing. The Analytics and Marketing categories are currently inactive; no scripts or tools in those categories are loaded. If we introduce analytics or marketing tools in the future, we will update this policy before doing so, and those tools will only be activated after you have given opt-in consent.

A "Cookie preferences" link in the Site footer allows you to reopen the consent banner and change your choices at any time.

For a complete technical description of browser storage, please see our Cookie Policy.

8. International Transfers

First Class Journey LLC is based in the United States. Our server is located in Germany, which is within the European Economic Area (EEA); personal information you submit through the Site is stored on that server and therefore remains within the EEA at rest.

However, because we are a US-based company, our access to and use of that data constitutes a transfer of personal information from the EEA and the United Kingdom to the United States. To ensure adequate safeguards for such transfers, we rely on the following mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our agreement with our web agency and, where applicable, into arrangements governing our own access to EEA-hosted data as a US-based controller
• For transfers from the United Kingdom, the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office, or the UK Addendum to the EU SCCs, as appropriate

You may request a copy of the relevant transfer safeguards by contacting us at support@journeyfirstclass.com.

9. Retention

We retain personal information only for as long as necessary for the purposes described in this policy:

• Enquiries that do not lead to an engagement: retained for up to 24 months after the date of last contact, then deleted from the mailbox.
• Client engagement records (proposals, engagement letters, correspondence, invoices, and related business records for a training or advisory engagement): retained for the duration of the engagement plus the period required by applicable US tax and commercial recordkeeping law, generally up to 7 years, then deleted or anonymized.
• News and updates opt-ins: retained until you withdraw your consent (unsubscribe), then deleted.
• Rate-limit hash (hashed IP address): retained for up to 1 hour, then deleted automatically.
• Server logs: retained for up to 30 days for security purposes, then deleted automatically.
• Browser localStorage entries: stored in your browser until you clear your browser storage or change your consent settings; they are not stored on our server.

When we delete personal information, we do so by removing it from the relevant mailbox, files, and any accessible backups within the applicable retention period.

10. Security

We take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration, disclosure, or destruction. Specific measures include:

• Hosting on a dedicated server (not shared hosting) operated in a European data centre
• Access controls limiting mailbox and file access to authorised personnel
• Encrypted transmission of form submissions over HTTPS
• Server log retention limited to 30 days
• IP addresses used for rate limiting stored only as a one-way hash, in a private folder, for up to one hour
• Honeypot anti-spam controls on the contact form
• No collection of payment card data through the Site

No method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to notifying affected individuals and relevant supervisory authorities in the event of a personal data breach as required by applicable law.

11. Your Rights Under GDPR / UK GDPR

If you are located in the European Economic Area or the United Kingdom, you have the following rights with respect to your personal information:

• Right of access: you may request confirmation of whether we process your personal information and a copy of it.
• Right to rectification: you may ask us to correct inaccurate or complete incomplete personal information.
• Right to erasure: you may ask us to delete your personal information where it is no longer necessary, where you withdraw consent, or where processing is unlawful.
• Right to restriction: you may ask us to restrict processing in certain circumstances, for example while you contest accuracy.
• Right to data portability: where processing is based on consent or contract and carried out by automated means, you may ask us to provide your data in a structured, commonly used, machine-readable format.
• Right to object: you may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decisions: we do not carry out such processing, but you have the right to request human review if we ever do.

To exercise any of these rights, contact us at support@journeyfirstclass.com. We will respond within one month of receiving a valid request, or notify you if we need an extension. We may need to verify your identity before processing a request.

You also have the right to lodge a complaint with a supervisory authority. In the EU, this is the data protection authority of your EU member state of habitual residence. In the United Kingdom, this is the Information Commissioner's Office (ICO), which can be reached at https://ico.org.uk.

12. Your Rights Under US State Privacy Laws

12a. Applicability

This section applies to residents of US states that have enacted comprehensive consumer privacy laws, including California (CCPA as amended by CPRA), and other states with similar enacted privacy frameworks. We provide the rights described below to all US residents who submit requests to us, regardless of state, to the extent required by applicable law.

12b. Categories of Personal Information We Collect

We collect identifiers (name, email address, IP address), optional contact information (phone number), commercial information relating to an engagement (proposals, invoices), and the content of messages you send us. We do not collect sensitive personal information as defined under CCPA/CPRA. We do not knowingly collect data from children under 16.

12c. Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which we collected it
• The business or commercial purposes for collecting it
• The categories of third parties with whom we share it
• The specific pieces of personal information we have collected about you

12d. Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law (for example, completing a service you requested, security purposes, or complying with a legal obligation such as tax recordkeeping).

12e. Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

12f. Right to Opt Out of Sale or Sharing

We do not sell personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information in those ways, there is nothing to opt out of, but we honor this right and will confirm our practices upon request.

12g. Non-Discrimination

We will not discriminate against you for exercising any privacy rights. We will not deny you services, charge you different prices, provide you a different level of service, or suggest you will receive different treatment because you exercised a privacy right.

12h. Authorized Agents

You may designate an authorized agent to submit a rights request on your behalf. We will require the authorized agent to provide written proof of authorization and may require you to verify your own identity directly with us before we fulfill the request.

12i. Appeals

If we deny your rights request, in whole or in part, you may appeal by sending us a written explanation of the basis for your appeal to support@journeyfirstclass.com. We will respond to appeals within the timeframe required by applicable state law. If your appeal is denied, you may contact the relevant state attorney general or data protection authority.

12j. Submitting a Request

To submit any US state privacy rights request, email support@journeyfirstclass.com with the subject line "Privacy Rights Request" and include sufficient information for us to identify your records (such as the name and email address you used when contacting us). We will respond within 45 days; we may extend this period by an additional 45 days where reasonably necessary and will notify you within the first 45-day period if an extension is needed.

13. Do Not Track / Global Privacy Control

Some browsers transmit a "Do Not Track" (DNT) signal to websites. Because the Site does not use cookies or tracking technologies, there is currently no tracking to disable. We treat DNT signals consistently with that approach.

The Site is designed to respect the Global Privacy Control (GPC) signal. Where we detect a GPC signal from your browser, we treat it as a request to opt out of any sale or sharing of your personal information. Because we do not sell or share personal information, this has no additional operational effect, but we record and honor the signal in accordance with applicable law.

14. Children

The Site and our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor without appropriate consent, we will delete it promptly. If you believe we may have received information from a minor, please contact us at support@journeyfirstclass.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Site, or applicable law. When we make material changes, we will update the effective date at the top of this policy and post the revised version at https://journeyfirstclass.com. If we intend to process personal information in a materially different way from the manner described at the time it was collected, we will provide notice and, where required by law, obtain fresh consent before doing so.

We will not add analytics or marketing tools to the Site without first updating this policy and obtaining your opt-in consent for those tools.

We encourage you to review this policy periodically. Continued use of the Site after any update constitutes acknowledgement of the revised policy.

16. Contact

For questions about this Privacy Policy, to exercise any of the rights described above, or to raise an accessibility concern regarding our legal pages, please contact us:

First Class Journey LLC 1209 Mountain Road Pl NE, Ste R Albuquerque, NM 87110 United States

Email: support@journeyfirstclass.com

We aim to respond to all privacy and accessibility inquiries within 10 business days.

First Class Journey LLC - Privacy Policy - Effective September 28, 2026