Privacy Policy

Last updated: 6 October 2026

CataTrain is an online store operated by [Catatrainn]. We provide physical surgical training simulators, accessories and related educational products through our online store.

Our online store is hosted by Shopify, which provides the e-commerce platform that allows us to offer and sell our products.

This Privacy Policy explains how we collect, use, disclose and protect your personal information when you visit our website, purchase our products, contact us or otherwise interact with our Services.

For the purposes of applicable data protection law, including the General Data Protection Regulation (“GDPR”), [Catatrain] is the data controller unless otherwise stated.

1. Personal information we collect

We collect only the personal information reasonably necessary to operate our store, process purchases and provide customer support.

When you place an order or contact us, we may collect your name, billing address, shipping address, email address, telephone number and any information you voluntarily provide to us.

We collect information relating to your purchases, including products ordered, order value, delivery information, returns, refunds and previous transactions.

Payment information is processed through Shopify and/or our selected payment providers. We generally do not directly store complete credit or debit card numbers. We may receive limited payment-related information such as payment status, payment method, transaction identifiers and billing details.

When you browse our website, certain technical information may be collected automatically, including your IP address, browser type, device information, operating system, pages viewed, approximate location derived from your IP address and information about how you interact with the website.

If you create a customer account, we may also process information necessary to create and manage that account.

2. Surgical training and health information

CataTrain provides training products and educational materials. Our Services are not intended to provide medical care or to collect patient information.

Please do not submit patient-identifiable information, medical records, clinical photographs, health information or other special-category personal data through our website, contact forms or customer-support channels.

If such information is submitted to us inadvertently, we will take reasonable steps to delete it when it is not necessary for a legitimate and lawful purpose.

3. How we use your personal information and our legal bases

We use your personal information only where we have a lawful basis for doing so.

We process information necessary to receive, confirm and fulfil orders; process payments; arrange delivery; manage returns, replacements and refunds; maintain customer accounts; provide order-related customer support; and communicate with you regarding your purchase. The legal basis for these activities is generally the performance of a contract or taking steps at your request before entering into a contract.

We may process information relating to purchases, invoices and transactions where necessary to comply with accounting, tax, consumer-protection and other applicable legal requirements. The legal basis for this processing is compliance with a legal obligation.

We may process limited personal and technical information to operate and secure our website, detect fraudulent transactions, prevent misuse, troubleshoot technical problems and protect our business and customers. Where applicable, this processing is based on our legitimate interests in operating a secure and reliable online business, provided that those interests are not overridden by your rights and freedoms.

Where required by applicable law, we rely on your consent to send electronic marketing communications, use non-essential cookies or similar tracking technologies, or provide personalised advertising. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We may also analyse aggregated or appropriately anonymised information to understand how our store is used and improve our products and Services. Information that can no longer identify or reasonably be linked to an individual is not treated as personal data under this Policy.

4. Marketing communications

We may send you information about CataTrain products, new training materials, promotions or other commercial communications where you have consented to receive them or where another lawful basis permitted by applicable law applies.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in the message or by contacting us at hello@catatrain.com.

Unsubscribing from marketing communications will not prevent us from sending you necessary transactional messages relating to an order, payment, shipment, return or customer-support request.

5. Cookies and similar technologies

Our website may use cookies and similar technologies that are necessary for the website to operate, including technologies required for shopping-cart functionality, checkout, fraud prevention, security and customer preferences.

We may also use analytics, advertising or personalisation technologies where permitted by law and, where required, only after obtaining your consent.

You can manage your preferences through the cookie banner or privacy controls available on our website.

Further information about the cookies and similar technologies used by CataTrain is available in our Cookie Policy.

6. How we obtain personal information

We may obtain information directly from you when you purchase a product, create an account, contact us, subscribe to marketing communications or otherwise provide information to us.

We may also collect certain information automatically when you use our website through cookies and similar technologies.

We may receive information from service providers involved in operating our business, such as Shopify, payment providers, delivery companies and technical service providers, where necessary to provide our Services.

7. How we disclose personal information

We do not sell your personal information in the ordinary meaning of the word.

We may disclose personal information to service providers where this is necessary to operate our store or fulfil your order.

These providers may include Shopify; payment processors; shipping, courier and fulfilment companies; website and cloud-service providers; email and customer-support providers; accounting or professional advisers; and analytics or advertising providers where those services have been enabled and their use is permitted by applicable law.

We may also disclose personal information where required by law, court order, regulatory authority or other legally valid request, or where reasonably necessary to establish, exercise or defend legal claims.

If the ownership or operation of CataTrain changes as part of a merger, acquisition, restructuring or transfer of business, relevant personal information may be transferred as part of that transaction in accordance with applicable law.

8. Shopify

Our online store is hosted on Shopify.

Shopify processes certain personal information in order to provide the e-commerce infrastructure necessary to operate our store, including checkout, transaction processing, security and other platform services.

Depending on the particular Shopify service involved, Shopify may process information on our behalf or act as an independent controller for certain purposes.

You can find further information about Shopify's privacy practices in Shopify's Consumer Privacy Policy and privacy portal.

Using Shopify does not itself determine all of CataTrain's privacy obligations; we remain responsible for ensuring that our own use of personal information complies with applicable data-protection law.

Shopify confirms that merchants are generally controllers of their customers' personal data, while Shopify acts as processor for many core merchant services, with different roles potentially applying to certain enhanced services. Shopify Help Center

9. International data transfers

Some of our service providers may process or store personal information outside Spain or the European Economic Area (“EEA”).

Where personal information is transferred to a country outside the EEA that has not been recognised as providing an adequate level of data protection, we will rely on an appropriate legal transfer mechanism where required, such as the European Commission's Standard Contractual Clauses or another mechanism recognised under applicable law.

For European merchants, Shopify's principal contracting entity is Shopify International Limited in Ireland, although Shopify and its authorised subprocessors may process information in other jurisdictions. Shopify Help Center

10. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal requirements.

Order, payment and invoice information may be retained for the periods required under applicable Spanish accounting, commercial and tax legislation.

Customer-support communications may be retained for the period reasonably necessary to resolve the enquiry and manage any resulting legal obligations or claims.

Customer-account information may be retained while the account remains active and thereafter where necessary to comply with applicable legal obligations.

Marketing information will generally be retained until you withdraw your consent, unsubscribe or object to the relevant processing, unless we have another lawful basis for retaining limited information, such as maintaining a record that you have opted out.

When personal information is no longer required, we will delete, anonymise or otherwise securely dispose of it, subject to applicable legal requirements.

11. Data security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

You should not send sensitive, confidential, patient-identifiable or medical information through ordinary email or other unsecured communication channels.

12. Your rights

If you are located in the EEA, you may have the right under applicable data-protection law to request access to your personal information; request correction of inaccurate or incomplete information; request deletion of your information; request restriction of processing; receive certain information in a portable format; object to processing based on legitimate interests; and withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

You may exercise your rights by contacting us at hello@catatrain.com. We may need to request information reasonably necessary to verify your identity before processing certain requests.

You also have the right to lodge a complaint with the competent data-protection authority. In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).

13. Third-party websites and services

Our website may contain links to websites, social networks or services operated by third parties.

CataTrain is not responsible for the privacy practices, security or content of third-party websites that we do not control. We recommend reviewing the relevant privacy policies before providing personal information to those services.

14. Children

Our products and Services are intended primarily for adults, healthcare professionals, students and individuals involved in surgical education and training.

Our Services are not directed to children under the age of 18, and we do not knowingly collect personal information from children.

If you believe that a child has provided personal information to us, please contact us so that we can review the circumstances and, where appropriate, delete the information.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, Services, technology, legal obligations or privacy practices.

When we update this Policy, we will publish the revised version on our website and update the “Last updated” date above.

16. Contact

If you have questions about this Privacy Policy, wish to exercise your data-protection rights or have a privacy-related complaint, you may contact us at:

CataTrain
Operated by: Catatrain
Email: hello@catatrain.com
Address: Calle del Marqués de Viana 101, 28039 Madrid, Spain

For the purposes of applicable data-protection legislation, Catatrain is the controller of the personal information described in this Privacy Policy.