Privacy Policy
How we handle your data — and why discretion is the default here.
1. Controller
Toys4Fans GmbH, Theaterstraße 3, 30159 Hannover, Germany (see Imprint) is the controller for all personal data processed through this store. You can reach us at info@toys4fans.com.
2. What we process, and on what legal basis
We process the order data you provide (name, shipping address, e-mail and payment confirmation) to perform our contract with you and to take pre-contractual steps at your request (Art. 6(1)(b) GDPR). We process the same data to meet our commercial and tax record-keeping duties (Art. 6(1)(c) GDPR). For fraud prevention, IT security and improving our service we rely on our legitimate interests (Art. 6(1)(f) GDPR). Analytics and marketing e-mails are processed only on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Providing the data marked as required is necessary to conclude and perform the contract; without it we cannot process your order. We do not use automated decision-making or profiling that produces legal effects for you.
3. Who receives your data
Order and account data are hosted on the infrastructure of Shopify (Shopify International Ltd. / Shopify Inc.), which acts as our processor. Payments are handled by our payment service providers Shopify Payments and, where you choose it, Klarna; we never see your full card details. Our e-mail and marketing provider Klaviyo (Klaviyo Inc.) processes your contact data only where you have consented to marketing e-mails. Our fulfilment and carrier partners receive the shipping data strictly needed to deliver your order, in neutral packaging with a neutral sender. These providers act as our processors under data-processing agreements, except where the law makes them separate controllers for their own service (e.g. Klarna for payment).
4. International transfers
Some of our providers are based in the USA — in particular Shopify (Shopify Inc.) and our e-mail/marketing provider Klaviyo (Klaviyo Inc.). Where data is transferred outside the EU/EEA, we rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses as appropriate safeguards under Art. 46 GDPR. You may request a copy of these safeguards at info@toys4fans.com. Klarna processes payment data within the EU.
5. Discretion by default
Purchases appear on your statement under a neutral billing descriptor. We do not sell or share your data for advertising purposes. Marketing e-mails are sent only after a confirmed double opt-in and can be unsubscribed with one click at any time.
6. Cookies and analytics
We use technically necessary cookies to run the store (cart, age confirmation, checkout); these do not require consent. Any non-essential cookies and analytics — including our shop platform's own usage statistics — are set only once you agree through our cookie banner, and you can withdraw that consent at any time. We currently use no advertising or cross-site tracking cookies.
7. Creator applications
If you apply to become a creator, we process the data you submit in the application form — your name and creator name, contact details, date of birth (to confirm you are 18 or older), reach/audience figures, links, and non-explicit face and body photos — solely to assess your suitability and the authenticity and technical feasibility of your application. Because of the context, these photos may reveal information concerning your sex life; we therefore process them only on your explicit consent (Art. 9(2)(a) together with Art. 6(1)(a) GDPR), which is voluntary and which you can withdraw at any time. The form does not accept explicit or sexual images, and you must not upload any; any explicit material received is deleted without further processing. If your application proceeds, we will invite you to share any further material only through a separate, secured channel and on the basis of separate consent. If we reject your application, or you withdraw it or your consent, we delete the submitted photos without undue delay and at the latest within 30 days of our decision. Detailed terms are set out in our Creator Application Image Upload Terms.
8. Your rights
Under the GDPR you have the right to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw any consent with effect for the future. You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Hannover. Requests: info@toys4fans.com.
9. Retention
We keep order and invoice data for the statutory periods under § 147 AO and § 257 HGB (currently 8–10 years depending on the document type) and delete or anonymise other data once its purpose ends.