Privacy Policy - Europe Toys Store

Last updated: 1 August 2026

This Privacy Policy explains how Toys Online Store, trading as "Europe Toys Store" (“we”, “us”, “our”), collects, uses, discloses and protects your personal data when you visit toysonlinestore.eu (the “Site”), make a purchase, or otherwise contact us. It is written to comply with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”) and applicable EU/EEA data protection law.

Please read this policy carefully. If you do not agree with it, please do not use the Site.

1. Who We Are (Data Controller)

Toys Online Store, operating the Site under the trading name "Europe Toys Store", is the data controller responsible for your personal data. We can be reached at:

Email (general/customer service): cs@toysonlinestore.eu
Email (orders): store@toysonlinestore.eu
Email (privacy / data protection inquiries): compliance@3-tech.eu
Operations: Italy – Milan; Netherlands – Amsterdam & Groningen; Switzerland – Basel

[Store owner note: please add your registered company name, official business address and, if applicable, company registration/VAT number here, so this section fully identifies the controller as required by Article 13(1)(a) GDPR.]

2. Changes To This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. We will post the revised version on this page and update the “Last updated” date above. We encourage you to review this page periodically.

3. What Personal Data We Collect

3.1 Information You Give Us Directly

Contact details: name, billing/shipping address, phone number, email address.
Order information: items purchased, payment confirmation (not full card numbers), order history.
Account information: username, password (stored encrypted), account preferences.
Shopping activity: items viewed, wishlist, cart contents, reviews, coupons used.
Customer support information: the content of messages you send us.

Providing this data is generally necessary to place an order or create an account; without it we may not be able to provide the requested service.

3.2 Information We Collect Automatically

When you use the Site, we and our service providers automatically collect certain technical data via cookies and similar technologies, including your IP address, browser and device type, pages viewed, referring URL, and approximate location derived from your IP address. See Section 5 (Cookies) below.

3.3 Information From Third Parties

We may receive information about you from payment processors (e.g. confirmation that a payment was successful), from social login providers if you choose to sign in that way, and from marketing/advertising partners. This information is combined with the data described above and handled in accordance with this Policy.

4. How We Use Your Data and Our Legal Basis

Under the GDPR we may only process your personal data where we have a valid legal basis. The table below sets out our main purposes and the corresponding legal basis (Article 6 GDPR):

Processing and fulfilling your orders (payment, shipping, customer service, returns) — necessary to perform our contract with you (Art. 6(1)(b)).
Creating and managing your account — performance of a contract (Art. 6(1)(b)).
Complying with legal obligations (e.g. tax and accounting records) — legal obligation (Art. 6(1)(c)).
Marketing communications (newsletters, promotions) — your consent (Art. 6(1)(a)), which you may withdraw at any time; or, for existing customers regarding similar products, our legitimate interest (Art. 6(1)(f)).
Advertising and audience measurement via Google, Meta, Pinterest and Reddit tools — your consent, collected via our cookie banner (Art. 6(1)(a)).
Site security, fraud prevention and spam protection — our legitimate interest in keeping the Site and our customers safe (Art. 6(1)(f)).
Improving the Site and understanding usage — our legitimate interest (Art. 6(1)(f)), or consent where required for non-essential analytics cookies.

5. Cookies

We use cookies and similar technologies to operate the Site, remember your preferences, and — with your consent — measure traffic and personalise advertising. Categories of cookies we use:

Strictly necessary — required for core functions such as the shopping cart, checkout and account login. These do not require consent.
Functional — remember settings such as language and currency.
Analytics — help us understand how visitors use the Site (e.g. Jetpack Stats).
Advertising / marketing — set by Google, Meta (Facebook/Instagram), Pinterest and Reddit tools to measure and personalise ads. These are only set with your consent.

You can accept or reject non-essential cookies through our cookie banner when you first visit the Site, and change your choice at any time via your browser settings or by clearing your cookies. Blocking cookies may affect how the Site functions.

6. Who We Share Your Data With

We do not sell your personal data. We share it only with the following categories of recipients, each acting either as our processor (under a data processing agreement) or as an independent controller for their own purposes:

Payment processors — Stripe and PayPal, to securely process your payment.
Hosting and IT infrastructure providers — including our hosting/technology partner (3-Tech) and website security, backup and performance services (e.g. Jetpack, Backuply).
Order fulfilment and logistics — shipping carriers and, for certain items fulfilled via our supplier network, drop-shipping suppliers sourced through AliExpress, who receive the shipping details necessary to deliver your order directly to you.
Email and marketing service providers — for transactional order emails (e.g. GoSMTP) and, where you have subscribed, newsletters (e.g. MailPoet).
Advertising and analytics partners — Google (Ads/Merchant Center), Meta/Facebook, Pinterest and Reddit, when you have consented to marketing cookies.
Spam and fraud prevention services — e.g. Akismet, to filter spam submissions.
Professional advisers and authorities — where necessary to comply with the law or protect our legal rights.

7. International Data Transfers

Some of the recipients listed above are located, or process data, outside the European Economic Area (EEA) — for example in the United States (several of our hosting, analytics and advertising providers) or, for certain drop-shipped products, in China (our AliExpress-sourced suppliers, who receive only the shipping information needed to deliver your order). Where we transfer personal data outside the EEA, we rely on recognised safeguards such as the European Commission’s Standard Contractual Clauses, the EU-US Data Privacy Framework (where the recipient is certified), or a European Commission adequacy decision, as applicable. You can request more information about these safeguards by contacting us using the details in Section 12.

8. How Long We Keep Your Data

Account data — for as long as your account remains active, plus a reasonable period afterwards in case you wish to reactivate it.
Order and invoice data — for the period required by applicable tax and commercial accounting law (in most EU countries, up to 7–10 years).
Marketing consent and preferences — until you withdraw consent or unsubscribe, after which we retain a minimal record of your opt-out to honour it.
Customer support correspondence — for a reasonable period to handle follow-up queries, typically up to 3 years.
Technical and log data — typically retained for a short period (around 30–90 days) unless needed for a security investigation.

Where we no longer need personal data for these purposes, we delete it or anonymise it.

9. Data Security

We use appropriate technical and organisational measures to protect your personal data, including encrypted (HTTPS/TLS) connections and encrypted storage of passwords. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please avoid sending sensitive information to us through insecure or public channels.

10. Children’s Privacy

Although we sell toys, our Services are directed at adults who purchase products for children, not at children themselves. We do not knowingly collect personal data directly from children. If you believe a child has provided us with personal data, please contact us using the details in Section 12 and we will delete it.

11. Your Rights Under the GDPR

If you are located in the EEA (or another jurisdiction with similar protections), you have the following rights regarding your personal data:

Right of access — obtain confirmation of, and a copy of, the personal data we hold about you.
Right to rectification — ask us to correct inaccurate or incomplete data.
Right to erasure (“right to be forgotten”) — ask us to delete your data in certain circumstances.
Right to restrict processing — ask us to limit how we use your data in certain circumstances.
Right to data portability — receive your data in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller.
Right to object — object to processing based on legitimate interest, including profiling, and to object to direct marketing at any time (which we will always honour).
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
Right to lodge a complaint — with a supervisory authority (see Section 13).

To exercise any of these rights, contact us using the details in Section 12. We may need to verify your identity before responding, and we will respond within the timeframes required by the GDPR (generally within one month).

12. Data Protection Officer and Contact

Given the size and nature of our processing activities, we are not currently required under Article 37 GDPR to appoint a statutory Data Protection Officer. All data protection questions, requests and complaints should be directed to:

Email: compliance@3-tech.eu
Customer service: cs@toysonlinestore.eu / store@toysonlinestore.eu

13. Complaints to a Supervisory Authority

If you are not satisfied with how we have handled your personal data or a request you have made, you have the right to lodge a complaint with your local data protection supervisory authority in the EU/EEA country where you live, work, or where the alleged infringement occurred. A full list of EU supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu. We would, however, appreciate the chance to address your concerns directly first — please contact us using the details above.