Data Controller

The controller is Theia Moira Ltd, trading as APPYTOYS, Triq Il-Kullegg L'Antik, Tas-Sliema SLM 1379, Malta. VAT: MT 2168-2832. Privacy enquiries: info@appytoys.com.mt.

Personal data we collect

Depending on how you use APPYTOYS, we may process identity and contact details; billing and delivery information; customer-account and preference information; order, delivery, return, refund and support records; transaction and payment-status information received from payment providers; communications; technical and usage information such as IP address, browser, device and cookie identifiers; marketing preferences; and information used for security, fraud prevention and troubleshooting.

How we obtain personal data

We obtain data directly from you when you browse, order, create or access an account, contact us, subscribe or otherwise interact with APPYTOYS. We may also receive limited information from Shopify, payment providers, carriers, fraud-prevention services, analytics or advertising providers and social-media or communication platforms according to the services used and your settings.

Purposes and legal bases

We process data where necessary to perform a contract or take requested pre-contract steps; comply with legal obligations; pursue legitimate interests such as security, fraud prevention, service improvement and business administration; or rely on consent where consent is required, including for certain marketing and non-essential cookies.

Consent can be withdrawn at any time without affecting processing that was lawful before withdrawal.

Orders, accounts and Customer Care

Order and account data is used to process purchases, manage availability, provide delivery updates, administer customer accounts, handle cancellations, returns, refunds, product issues, guarantees and complaints, and maintain records required for accounting, tax and dispute-resolution purposes.

Payments

Payments are processed through the payment methods displayed at checkout. Payment providers may send APPYTOYS transaction references, status information and limited payment-related data required for accounting, refunds, fraud prevention and disputes. APPYTOYS does not ask Customer Care users to provide complete payment-card details by email or chat.

Newsletter and direct marketing

If you subscribe or otherwise provide valid consent, APPYTOYS may use your email address and marketing preferences to send selected news, offers and product information. You can unsubscribe using the link in eligible marketing emails or otherwise withdraw consent.

Cookies, analytics and online advertising

The website uses cookies and similar technologies for essential functions such as security, cart, checkout, language, market preferences and account access. Optional analytics or advertising technologies are used according to the consent choices available on the website and applicable law. See the Cookie Policy.

Recipients and service providers

Personal data may be shared, where necessary, with service providers that support the ecommerce operation, including Shopify, payment providers, carriers and fulfilment partners, customer-communication and email-marketing providers, IT/security providers, accounting or professional advisers, and analytics or advertising providers where enabled and lawfully used.

Providers process data according to their role, applicable contracts and law.

International transfers

Some service providers may process data outside Malta or the European Economic Area. Where required, APPYTOYS relies on a lawful transfer mechanism such as an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules or another safeguard permitted by data-protection law.

Retention

We retain personal data only for as long as necessary for the purpose for which it is processed and to meet legal, accounting, tax, security, reporting and dispute-resolution requirements. Marketing records are retained as needed to manage subscription and opt-out preferences. Cookie and technical-data retention depends on the technology concerned.

Your data-protection rights

Subject to the conditions in applicable law, you may have rights to access, correct or erase personal data; restrict or object to processing; receive certain data in a portable format; withdraw consent; and lodge a complaint with a competent supervisory authority.

Requests can be sent to info@appytoys.com.mt. We may need to verify identity before acting on an account-specific request.

Automated processing and fraud indicators

Security, payment and ecommerce systems can use automated signals to detect fraud, abuse, unusual activity or technical risk. These signals may influence whether additional verification or manual review is required. Where applicable law grants specific rights in relation to solely automated decisions with legal or similarly significant effects, those rights remain available.

Children's privacy

APPYTOYS sells products for children, but the website, checkout and customer-account functions are intended to be used by persons who can lawfully enter into the relevant transaction or by an authorised adult. We do not intentionally ask children to provide personal data where an adult should provide it instead.

Security

APPYTOYS and its service providers use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. No online system can be guaranteed completely secure, so customers should also protect their email accounts and verification codes.

Complaints

You may contact APPYTOYS first so we can address a privacy concern. You also have the right, subject to applicable law, to lodge a complaint with the competent data-protection supervisory authority, including the Office of the Information and Data Protection Commissioner in Malta where appropriate.

Changes and contact

We may update this Privacy Policy when our services, providers or legal obligations change. The current version and update date are published on this page.

Privacy enquiries: Theia Moira Ltd — APPYTOYS, info@appytoys.com.mt.