Privacy Policy

Data Controller

The controller responsible for the processing described in this policy is:

Theia Moira Ltd, trading as APPYTOYS
Triq Il-Kullegg L'Antik, Tas-Sliema SLM 1379, Malta
VAT number: MT 2168-2832
Email: info@appytoys.com.mt

Personal Data We Collect

Depending on how you use the Website, we may process:

• identity and contact details, including your name, email address, telephone number, billing address and delivery address;
• account information, login details and saved preferences;
• order, delivery, return, refund and customer-service records;
• payment-related information and transaction confirmations received from payment providers, but not complete card details stored directly by APPYTOYS;
• communications sent through email, contact forms, chat, WhatsApp or social-media channels;
• technical and usage data, such as IP address, browser, device, pages viewed, referring source and cookie identifiers;
• marketing preferences and records of consent, subscription or objection;
• information used to protect transactions, identify technical problems and prevent fraud or misuse.

How We Obtain Personal Data

We receive data directly from you when you browse the Website, create an account, place an order, complete a form, contact us or subscribe to marketing. We may also receive limited information from Shopify, payment providers, delivery partners, fraud-prevention services, advertising or analytics providers and social-media platforms, according to the service used and your settings.

Purposes and Legal Bases

We process personal data only where an applicable legal basis exists:

• Contract and pre-contractual steps: to create and manage accounts, process purchases and payments, deliver products, provide order updates and manage cancellations, returns, refunds and guarantees.
• Legal obligations: to keep accounting and tax records, comply with consumer, payment and regulatory requirements, respond to lawful requests and establish required transaction records.
• Legitimate interests: to respond to enquiries, improve and secure the Website, prevent fraud and misuse, manage business operations and establish, exercise or defend legal claims. We consider the effect on your rights before relying on this basis.
• Consent: for optional newsletter or promotional communications and non-essential cookies where consent is required. Consent may be withdrawn at any time.

Data required to complete an order is necessary for the contract or applicable legal obligations. If it is not provided, we may be unable to accept or fulfil the order. Optional data and marketing consent are not required to make a purchase.

Orders, Accounts and Customer Assistance

We use the information supplied during registration and checkout to administer your account, confirm availability, process the order, arrange delivery, provide invoices and updates, and deal with returns, refunds, complaints and product guarantees.

When you contact us, we use the information you provide to understand and answer your request. Please avoid sending information that is unnecessary for the matter concerned.

Payments

Payments are processed through the payment methods displayed at checkout, which may include payment cards, PayPal, Apple Pay and Google Pay. Payment providers process the information needed to authorise and complete the transaction under their own privacy terms or as service providers, depending on the arrangement.

APPYTOYS does not directly receive or store complete payment-card numbers or card security codes. We may receive transaction references, status, limited payment details and information needed for accounting, fraud prevention, refunds and dispute management. Additional authentication may be required under payment-services rules, including Strong Customer Authentication.

Newsletter and Direct Marketing

If you subscribe or otherwise give valid consent, we may use your email address to send APPYTOYS news, offers and product information. Subscription is optional and does not affect your ability to purchase. You may withdraw consent at any time by using the unsubscribe link in an email or contacting us.

Where permitted by applicable electronic-marketing law, we may contact existing customers about our own products that are similar to those previously purchased. This is used only where the legal conditions are satisfied and a clear, free means of objecting was provided when the contact details were collected and in every subsequent message. You may object at any time.

We do not provide your contact details to unrelated third parties for their own independent marketing without an appropriate legal basis.

Cookies, Analytics and Online Advertising

The Website uses cookies and similar technologies that are necessary for functions such as checkout, security, language or market preferences and account access. Subject to your choices and applicable law, optional technologies may be used to understand Website performance, measure campaigns and personalise advertising.

Non-essential technologies are used according to the consent choices made through the Website. You can review or change those choices using the available privacy or cookie controls. Further details are provided in our Cookie Policy.

Recipients and Service Providers

Where necessary for the purposes described above, personal data may be disclosed to:

• Shopify and providers that host, maintain or support the Website and its applications;
• payment, fraud-prevention and transaction-security providers;
• warehouses, suppliers, fulfilment partners, couriers and parties involved in delivery, collection, returns or repairs;
• customer-support, communications, newsletter, analytics and advertising providers used by APPYTOYS;
• accountants, auditors, insurers, legal advisers and other professional consultants;
• public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required or necessary to protect legal rights.

These parties receive only the information reasonably necessary for their role and must process it under applicable data-protection requirements.

International Data Transfers

Some technology and service providers may process personal data outside Malta or the European Economic Area. Where required, such transfers are based on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or another lawful transfer mechanism. Information about relevant safeguards may be requested from us.

Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose and to satisfy legal, accounting, tax, reporting and dispute-resolution requirements. In particular:

• order, payment and accounting records may be retained for up to ten years from the relevant transaction, or longer where required by law or an ongoing claim;
• account information is normally retained while the account remains active and for a reasonable period afterwards;
• customer-service correspondence is retained for the time needed to resolve the request and manage related legal or operational matters;
• marketing information is retained until consent is withdrawn, an objection is made, or the data is no longer required, subject to limited suppression records used to respect opt-out requests;
• cookie and technical-data retention depends on the technology concerned and is described through the applicable cookie information.

Data may be deleted, anonymised or retained for a longer period where a legal obligation, dispute, investigation or defence of legal claims requires it.

Your Data-Protection Rights

Subject to the conditions and exceptions established by law, you may:

• request access to your personal data and obtain a copy;
• request correction of inaccurate or incomplete data;
• request erasure or restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format and request its transmission where applicable;
• withdraw consent at any time, without affecting processing carried out lawfully before withdrawal;
• lodge a complaint with a competent supervisory authority.

To exercise a right, email info@appytoys.com.mt. We may request information reasonably necessary to verify your identity and understand the request.

Automated Processing and Fraud Indicators

Our commerce, payment and security providers may use automated tools to identify suspicious transactions or provide risk indicators. APPYTOYS does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you, unless this is permitted by law and the required information and safeguards are provided.

Children's Privacy

APPYTOYS sells products for children, but the Website and its purchasing, account and newsletter services are intended for adults. We do not knowingly seek to collect personal data directly from children. A parent or guardian who believes that a child has provided personal data without appropriate authorisation may contact us so that we can review the matter and take appropriate action.

Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, misuse or disclosure. No online transmission or storage method can be guaranteed to be completely secure, so we review safeguards in light of the nature of the data and available technology.

Complaints

You may contact us first so that we can try to resolve your concern. You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta, using the current contact details and complaint procedure published at idpc.org.mt.

Changes to This Policy

We may update this Privacy Policy to reflect changes to the Website, our services, providers or applicable law. The revised version will be published on this page with an updated date. Where required, we will provide additional notice or request renewed consent.