Privacy policy
Last updated
We're a small family toy shop and we collect very little about you: enough to take your order, get it to you and answer your questions. This policy describes what this website actually does with personal information. We don't sell your details and we don't track you around the internet.
Who is responsible for your information
Toybox Ross is a trading name of TOY BOX (ROSS) LIMITED, a company registered in England and Wales with company number 10894743. Registered office: The Threshing Barn, Fownhope, Hereford, HR1 4PU, United Kingdom. We are the “controller” of the personal information described here, which means we decide how it is used and are responsible for looking after it under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For anything about your personal information, contact us at toyboxross@gmail.com, on 01989 565322, or by post at Toybox Ross, 15 Broad Street, Ross-on-Wye, HR9 7EA.
What we collect and why
You can browse the whole website without giving us any personal details. There are no customer accounts and no passwords: your basket and wishlist live in your own browser.
| When | What | Why we use it | Our legal basis |
|---|---|---|---|
| You place an order | Your name, email address, phone number and, for delivery, your delivery address. These are entered on Stripe's payment page and passed to us with your order. We also record what you bought, what you paid, whether you chose delivery or collection, and the payment reference. | To take payment, prepare and deliver your order or have it ready to collect, send your order confirmation, contact you about your order, and deal with returns and refunds. | Performing our contract with you |
| After an order | The order record above. | To keep the accounting and tax records the law requires of a company, and to handle any later query, complaint or legal claim. | Legal obligation; our legitimate interest in dealing with queries and claims |
| You ask for a back-in-stock email | Your email address and the product you asked about. | To send you one email when that product is back in stock. It is never used for marketing and you are not added to any mailing list. Every alert email has a link to stop it. | Your consent, which you can withdraw at any time |
| You contact us | Whatever you tell us by email, phone or in the shop, and your contact details. The contact form on this website opens your own email app; it doesn't send anything to our website. | To answer you and keep a record of what was agreed. | Our legitimate interest in responding to customers (or steps you ask us to take before ordering) |
| You visit the website | Technical information your browser sends automatically: IP address, browser type, the page requested and the time. Your IP address is also used briefly to limit repeated checkout or sign-up attempts. | To deliver the pages you ask for, keep the website secure, and prevent abuse and fraud. | Our legitimate interest in running a secure website |
| Cookies and browser storage | Your basket, wishlist and delivery choice, a checkout cookie and, only if you agree, your recently viewed products and a Google map. | To make the shop work and, with your agreement, to add those extras. Full details are in our Cookie policy. | Strictly necessary for the service you ask for; otherwise your consent |
We don't send marketing emails or texts from this website, we don't build profiles of our customers, and we don't make automated decisions about you. If you don't give us the details needed for an order, we won't be able to supply it.
Card payments
Payments are handled by Stripe. When you press “Secure checkout” you are taken to a payment page run by Stripe, and you type your card details there, not on our website. We never receive or store your full card number, expiry date or security code. We receive confirmation that the payment succeeded and a payment reference.
Stripe also uses the information it collects to detect and prevent fraud and to meet its own legal duties, for which it is responsible in its own right. See Stripe's privacy policy.
Who we share it with
We only share personal information with the businesses that help us run the shop, and only what each needs:
- Stripe — takes card payments and collects your contact and delivery details at checkout.
- IONOS — hosts this website and its order database on servers in the United Kingdom.
- Our email providers — order confirmations and back-in-stock emails are sent from our own email address through our mail hosting provider, and messages you send to toyboxross@gmail.com are received in a Google (Gmail) mailbox.
- Smart Designs Online Ltd — the web agency that builds and maintains this website for us, which may see order information while supporting it.
- Delivery services — your name and address go on the parcel and to whoever carries it.
- Google — only if you choose to load the Google map on our Visit Us page (see the Cookie policy).
We may also need to share information with our accountants and professional advisers, with HMRC, or with the police, a court or a regulator where the law requires it. We never sell personal information.
Transfers outside the UK
Our website and order records are held in the UK. Stripe and Google operate internationally, so information they handle may be processed outside the UK, including in the United States. Where that happens it is protected by safeguards recognised under UK law, such as UK adequacy regulations (including the UK-US data bridge) or approved standard contractual clauses.
How long we keep it
- Orders: six years after the end of the financial year in which you ordered, because company and tax law require us to keep records of sales for that long.
- Back-in-stock requests: until we've sent your email or you stop the alert. A record that the alert was sent stays in our system until you ask us to remove it or we clear out old alerts.
- Emails and enquiries: for as long as needed to deal with your enquiry and any follow-up.
- Website access logs: up to 14 days, after which they are deleted automatically.
- Your basket, wishlist and cookie choices: these are on your device, not ours. See the Cookie policy.
Keeping it safe
The website is served only over an encrypted (HTTPS) connection. Order information can only be seen by shop staff who sign in to a protected area of the site, and card payments are handled entirely by Stripe. No system is perfectly secure, but if something ever went wrong that was likely to put you at risk, we would tell you and the regulator as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we no longer need to keep it;
- ask us to restrict how we use it, or object to our using it, in certain circumstances;
- ask for information you gave us in a portable format, where that applies;
- withdraw your consent at any time where we rely on it, for example by using the stop link in a back-in-stock email or changing your cookie settings.
To use any of these rights, contact us using the details at the top of this page. It's free. We may need to check who you are, and we'll reply within one month.
Children
We sell toys, but our website is for grown-ups to shop on. You must be 18 or over to place an order, and we don't knowingly collect personal information from children.
Questions and complaints
If you have a concern about how we've used your information, please tell us first at toyboxross@gmail.com so we can put it right. We'll acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this policy
We'll update this page if what we do changes, for example if we add a new service to the website, and change the date at the top. This policy was written for TOY BOX (ROSS) LIMITED (trading as Toybox Ross).