Last updated: 16 August 2026
Who controls your data
The controller is Hanbo Lei, sole trader operating ToyNero, NIF 302048766, Rua de Campolide Número 26 B, 1070-036 Lisboa, Portugal. Privacy enquiries: toynerocom@gmail.com.
Data we collect
We may collect account and contact details, delivery and billing information, order history, customer-service messages, device and security logs, cookie choices, and limited analytics or advertising data where consent is required and obtained. Payment providers process payment credentials under their own privacy notices; ToyNero normally receives only transaction status and limited identifiers.
Why we use it
- To take payment, fulfil and deliver orders, manage returns and provide customer support – performance of a contract.
- To issue invoices, keep tax and accounting records, prevent fraud and comply with legal duties – legal obligation or legitimate interests.
- To secure, maintain and improve the website – legitimate interests, balanced against your rights.
- To send optional marketing or use non-essential analytics and advertising cookies – consent, which may be withdrawn at any time.
Who receives data
Data may be shared only as needed with hosting and IT providers, payment processors, email and customer-service providers, analytics providers used with the required consent, professional advisers, authorities where legally required, and fulfilment, customs and delivery partners. Because orders dispatch from China, the recipient name, address, contact details and necessary order information may be sent to fulfilment and logistics partners in China.
International transfers
Where personal data is transferred outside the European Economic Area, ToyNero will use an available lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or approved contractual clauses, where required. Contact us for information about safeguards relevant to a particular transfer.
Retention
We keep data only for as long as required for the purpose collected, including contractual, tax, accounting, fraud-prevention and legal-claims periods. Marketing data is retained until consent is withdrawn or it is no longer needed. Exact periods can differ according to legal obligations and the status of an order or dispute.
Your rights
Subject to the GDPR and applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to Portugal’s data-protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at cnpd.pt.
Cookies
Essential cookies support the shop, cart, checkout, account security and privacy choices. Non-essential analytics, personalisation or advertising cookies should be used only after the required consent. You can change your choice through the cookie controls when available and through your browser settings.
Security and children
We use reasonable technical and organisational safeguards. No online system can be guaranteed completely secure. ToyNero is intended only for adults and is not directed to children.
Contact
Email privacy requests to toynerocom@gmail.com. We may need to verify identity before completing a request.