Privacy policy

Privacy policy

Last updated: 12 October 2026

1. WHO WE ARE
This Privacy policy explains how personal data is processed on neitatoys.com (the “Site”). The data controller is Corentin S., sole trader (entreprise individuelle) trading as NeitaToys, rue du Ballon, 59110 La Madeleine, France, SIRET 919 801 829 00012 (“we”). You can contact us at ReplaceHelloNeitatoys. We have not appointed a data protection officer.

2. OUR APPROACH
Purchases on the Site can reveal information about your private life. We therefore collect only what is needed, use it only to handle your order and your requests, and never sell it. We do not use advertising trackers, social media pixels, audience-measurement tools or profiling on the Site, and our parcels are packaged discreetly.

3. DATA WE COLLECT, WHY, AND ON WHAT LEGAL BASIS

  • Order and delivery data (name, delivery address or relay point, email address, telephone number, items ordered, amounts, delivery method). Purpose: process and deliver your order, issue invoices, handle warranties, withdrawals and returns. Legal basis: performance of the contract.
  • Customer account data (email address, password stored in hashed form, order history, saved addresses). Purpose: let you manage your account and orders. Legal basis: performance of the contract.
  • Payment data (transaction identifier, payment status, payment method type). Your card number is entered with Stripe or PayPal and is never stored by us. Purpose: take payment and prevent fraud. Legal basis: performance of the contract and our legitimate interest in preventing fraud.
  • Your messages (emails and their content). Purpose: answer your questions and handle your claims. Legal basis: performance of the contract or our legitimate interest in providing customer service.
  • Accounting and tax records. Purpose: comply with our accounting and tax obligations. Legal basis: legal obligation.
  • Technical data (IP address, browser type, date and time of connection, pages requested, security events). Purpose: operate, secure and protect the Site against attacks and abuse. Legal basis: our legitimate interest in the security of the Site.

Providing the data needed for an order is necessary to place it. Without it, we cannot process your order.

4. WHO RECEIVES YOUR DATA
We share data only with the providers that are necessary to run the Site and deliver your order:

  • OVH SAS (France): hosting of the Site and of its data, and email services.
  • Cloudflare, Inc. (United States): content delivery and security network. Your connection to the Site transits through its servers, so it processes your IP address and technical data.
  • Stripe Payments Europe, Ltd. (Ireland) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payment processing. They act under their own privacy policies for payment, fraud prevention and legal compliance.
  • La Poste (Colissimo) and Mondial Relay: delivery of your parcel. They receive your name, delivery address or relay point and, where needed, your email address or telephone number for delivery notifications.
  • Authorities and advisers (tax authorities, accountant, courts), when the law requires it.

We do not sell your data and do not share it for advertising.

5. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Some of these providers (notably Cloudflare, Stripe and PayPal) may process data in the United States. These transfers rely on the European Commission’s adequacy decision for companies certified under the EU–U.S. Data Privacy Framework or, failing that, on standard contractual clauses.

6. HOW LONG WE KEEP YOUR DATA

  • Order, invoice and payment records: 10 years, as required by accounting and tax law.
  • Customer account: until you delete it, or after 3 years without activity.
  • Messages and customer service exchanges: 3 years after the last exchange.
  • Technical and security logs: up to 12 months.
    After these periods, data is deleted or anonymised.

7. YOUR RIGHTS
You have the right to access your data, have it corrected or erased, restrict or object to its processing, and receive a copy of it in a portable format. You may also give instructions on what happens to your data after your death. Where processing is based on your consent, you may withdraw it at any time. To exercise these rights, write to ReplaceHelloNeitatoys; we may ask for proof of identity and will reply within one month. You can also lodge a complaint with the French data protection authority, the CNIL (3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr), or with the authority of your country of residence.

8. COOKIES
The Site uses only cookies that are strictly necessary for its operation: shopping cart and session cookies, login cookies, security cookies (including technical cookies that Cloudflare may set to detect malicious traffic) and cookies used by Stripe and PayPal to secure payments. They do not require consent. We do not use cookies for audience measurement or advertising. You can block cookies in your browser settings, but the cart and checkout may then stop working.

9. SECURITY
The Site uses an encrypted connection (HTTPS), access to personal data is restricted to what is necessary, and the Site is protected by security tools and kept up to date. No system is perfectly secure, but we take reasonable measures to protect your data against loss, unauthorised access and misuse.

10. MINORS
The Site is intended for adults aged 18 or over. We do not knowingly collect data from minors.

11. CHANGES
We may update this policy. The current version is always available on this page, with its date of last update.