Privacy Policy

1. Data controller

Controller: 3Toysm sp. z o.o., Wolności 97, 42-244 Mstów, Poland. Privacy contact: [email protected]. No Data Protection Officer is listed because no verified DPO information has been supplied.

2. Personal data collected

• Account data: none, because customer accounts are not offered.
• Order data: product IDs, names, quantities, prices, currency, delivery and payment method, order number and status.
• Contact and shipping data: name, email, phone number, country, city, postal code, address and optional apartment details.
• Payment-related data: selected payment method and transaction or settlement information supplied by an enabled payment provider; full card details are not collected by this store while card payment is unavailable.
• Customer-support data: messages, order references, complaint details and supporting photographs or documents provided by the customer.
• Technical data: IP address, device/browser information, request logs and security events processed by hosting infrastructure.
• Browser storage: cart product IDs and quantities, currency preference and cookie-notice choice.

3. Purposes and legal bases

• Contract performance and pre-contract steps: checkout, order handling, delivery, returns and customer support (Art. 6(1)(b) GDPR).
• Legal obligations: accounting, tax, product safety, consumer-law and authority requests (Art. 6(1)(c) GDPR).
• Legitimate interests where applicable: service security, fraud prevention, troubleshooting and legal claims (Art. 6(1)(f) GDPR), balanced against individual rights.
• Consent where applicable: optional cookies or other processing that legally requires consent (Art. 6(1)(a) GDPR). No optional analytics or marketing tools are currently implemented.

4. Recipients and processors

Data may be shared only as necessary with hosting/database providers, delivery providers, enabled payment providers, professional advisers, authorities, and customer-support or technology providers. Specific provider names must be added once the seller's final providers are confirmed. Providers must process data under an appropriate legal arrangement.

5. International transfers

If a recipient processes data outside the EEA, the controller will use a lawful transfer mechanism where required, such as an adequacy decision or appropriate safeguards, and provide more information on request. Final transfer details depend on the seller's confirmed providers.

6. Retention

Order and transaction records are kept for the period required by applicable accounting, tax and consumer law. Support and complaint records are retained while needed to resolve the matter and establish or defend legal claims. Technical logs are retained for an appropriate security period. Browser storage remains until it expires or the user deletes it. Seller-specific retention periods must be documented once the seller's country and obligations are confirmed.

7. Data subject rights

• Access, correction and, where applicable, deletion.
• Restriction of or objection to processing where applicable.
• Data portability for eligible data.
• Withdrawal of consent at any time, without affecting earlier lawful processing.
• A complaint to the competent data-protection supervisory authority, particularly in the country of residence, work or alleged infringement.

8. Security

Reasonable technical and organisational measures are used to protect personal data, including encrypted website connections and restricted access to order records. No security measure can guarantee absolute protection.

9. Cookies and similar storage

The current store uses browser storage needed for the cart, currency preference and cookie-notice choice. It does not currently use analytics or marketing cookies. See the Cookie Policy and Cookie Settings for current details.

10. Contact

Questions or rights requests may be sent to [email protected] or Wolności 97, 42-244 Mstów, Poland. Identity may need to be verified before a request is fulfilled.