Privacy & cookie policy

Last updated: August 2026

1. Who is responsible for your data

The data controller is FTV London Ltd, registered in England and Wales under company number 07685945, trading as Xtoys.UK. For anything in this policy, email privacy@xtoys.uk.

2. What we collect, why, and our lawful basis

Under UK GDPR we must have a lawful basis for everything we do with your data. Ours are set out below.

3. What we deliberately do not do

• We do not sell, rent or trade your personal data. Ever, to anyone.
• We do not build advertising profiles from what you buy or browse.
• We do not load analytics on pages whose address is itself personal — your account, basket, checkout, order tracking, wishlist or search results are all excluded, so a page containing your order number or search term is never reported to a third party.
• We do not make any decision about you by automated means alone, and we do not profile you.

4. A note on sensitive data

What someone buys from a shop like this could suggest something about their sex life, which UK GDPR treats as a special category of data. We take that seriously. We use your order data only to fulfil and support that order and to meet our legal obligations — never for profiling, advertising, targeting or resale — and we keep the number of people and systems that can see it to the minimum needed to get your parcel to you.

5. Who else sees your data

We share the minimum necessary with the following kinds of recipient, each acting under contract and only on our instructions:

• Payment provider — to take payment and process refunds. They receive your payment details directly; we receive only a confirmation.
• Fulfilment and delivery partners — the warehouse that packs your parcel and the carrier that delivers it receive your name, delivery address and contact details, and nothing about the wider contents of your order beyond what is needed to ship it.
• Email provider — to send order confirmations, dispatch notices and password resets.
• Hosting provider — the servers this site runs on.
• Analytics provider — only if you accept optional cookies.
• Professional advisers and authorities — our accountants, and any body we are legally required to disclose to.

Where a provider is outside the UK, we only use them where the transfer is covered by UK adequacy regulations or by an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Order and transaction records: six years after the end of the financial year they fall in, because HMRC requires it.
• Account details: until you ask us to close the account, after which we delete or anonymise what we are not legally required to keep.
• Marketing consent: until you unsubscribe, and then a suppression record so we do not email you again by mistake.
• Search terms: kept as aggregate reporting data, with no identifier attached at any point.
• Support emails: up to two years after the matter is closed.

7. Your rights

Under UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have data deleted, where we have no overriding legal reason to keep it.
• Restriction — have us pause processing while a dispute is resolved.
• Portability — receive your data in a machine-readable form.
• Object — to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — at any time, without affecting anything done before you withdrew it.

Email privacy@xtoys.uk and we will respond within one month. There is no charge. If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office — ico.org.uk, helpline 0303 123 1113 — though we would rather you gave us the chance to put it right first.

8. Cookies

A cookie is a small file stored by your browser. We split ours into two groups, and we ask before setting anything in the second.

Essential cookies — always on

These make the site function and cannot be switched off. They do not track you across other websites. Without them the basket, sign-in and checkout simply do not work, so no consent is required for them under the Privacy and Electronic Communications Regulations.

Optional analytics cookies — only with your consent

If you accept, we use StatCounter to count page views and understand which parts of the shop people use. It is not loaded at all until you agree, and it is never loaded on your account pages, basket, checkout, order tracking, wishlist or search results.

You can change your mind at any time using the Cookie preferences link at the bottom of every page, or by clearing cookies in your browser. Declining is as easy as accepting, and nothing about the shop stops working if you decline.

9. Security

The site runs over HTTPS, passwords are stored hashed and never in readable form, card details never reach our servers, and access to order data is limited to the staff who need it. No system is perfect, but if a breach ever affected your rights we would tell the ICO within 72 hours and tell you without undue delay where the risk to you was high.

10. Discretion by design

Beyond the law: parcels go out in plain, unbranded packaging with nothing on the outside indicating the contents, and your card statement shows “XTU Retail” rather than the shop name.

11. Children

This shop is for adults. It is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

12. Changes to this policy

We may update this policy. Any change takes effect when published here, and the date at the top will tell you when that was.