Privacy Policy

We’re Toys Ahoy Limited, an independent toy shop at 2 Admirals Way, Hythe, Southampton, Hampshire, SO45 6RU (company number 07994329). We’re the “data controller” for the personal information described here, which means we decide how it’s used and we’re responsible for looking after it.

You can reach us on 023 8084 9388, by email at hello@toysahoyshop.co.uk, or through our contact form.

When you place an order: your name, billing and delivery address, email address, phone number, what you bought, and anything you add to the order notes or gift message.

When you contact us: your name, email address, phone number if you give it, your order number if relevant, and your message.

When you choose to hear from us: a record that you ticked the box at checkout, when you did it, and the wording you agreed to.

When you use the website: basic technical information such as your IP address and browser type, which our hosting provider logs to keep the site secure.

We never see or store your full card details. Those go straight to our payment provider.

We only use your information when the law allows us to:

• To fulfil your order: taking payment, packing and posting it or getting it ready to collect, and emailing you about it. We need this to carry out our contract with you.
• To answer your questions and sort out any problems, because it’s in our legitimate interests to look after our customers.
• To keep proper business records, because the law (including HMRC rules) requires it.
• To send you news, events and offers by email, but only if you’ve opted in. You can unsubscribe at any time using the link in any email or by telling us.

We will never sell your information, and we don’t use it for automated decision-making or profiling.

Online payments are processed by WooPayments, which is provided by Automattic and powered by Stripe. They handle card, Apple Pay and Google Pay payments securely, and may use your information to prevent fraud. We receive confirmation that you’ve paid, along with limited details such as the card type and last four digits, but never your full card number.

You can read how they handle your data in Automattic’s privacy policy and Stripe’s privacy policy.

Cookies are small files stored on your device. We only use the ones the shop needs to work:

• Basket and checkout cookies, so the website remembers what’s in your basket.
• Account and security cookies, so you stay logged in and the site is protected.
• Payment provider cookies, which help our payment provider spot fraud.

We don’t use advertising or tracking cookies. To see how many people visit the site and which pages are useful, we use Plausible Analytics, a privacy-friendly service that doesn’t use cookies, doesn’t collect personal information and doesn’t follow you around the web.

You can clear or block cookies in your browser settings, but the basket and checkout won’t work without them.

We only share your information with companies that help us run the shop, and only what they need:

• WooPayments (Automattic) and Stripe, to take payment.
• Royal Mail or another courier, who get your name and delivery address so they can deliver your parcel.
• Hostinger, who host our website.
• Google, who provide our email.
• Plausible Analytics, who provide anonymous visitor statistics. No personal information is shared.
• Our email newsletter provider, who will get your name and email address, but only if you’ve opted in to hear from us.

Some of these companies store data outside the UK. Where they do, they use legal safeguards approved under UK data protection law. We may also share information if the law requires it, for example with HMRC.

We keep personal information only for as long as we need it, in line with UK law:

• Orders and payment records: six years from the end of the financial year they relate to, as UK company and tax law requires.
• Messages and enquiries: only for as long as we need them to help you, unless they relate to an order, in which case we keep them with that order.
• Email marketing: until you unsubscribe.
• Customer accounts: until you ask us to close your account. Order records linked to it are still kept for six years as above.

After that, we delete it securely.

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct anything that’s wrong
• ask us to delete it, where we don’t need to keep it by law
• object to or ask us to limit how we use it
• ask for it in a format you can take elsewhere
• withdraw your consent to marketing at any time

Just get in touch by phone, email or our contact form. We’ll reply within one month, and there’s no charge.

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the UK’s data protection regulator.