1. Who we are
Toys Heaven is operated by Bumerang Ltd. ("we", "us", "our"), a company registered in England and Wales, with its registered office at Unit 5, North Weald Airfield, Merlin Way, North Weald Bassett, Epping, Essex, CM16 6HR. We are registered with the Information Commissioner's Office (ICO), registration reference ZC139702. You can contact us by phone at 01279 964430 or via our Contact page or by email at privacy@toysheaven.co.uk.
2. What information we collect
We collect information you provide directly, including: your name, email address, phone number, company name and company registration number, billing and delivery addresses, and order history. If you sign in using Google, we receive your name and email address from Google. If you sign in using Facebook, we receive your name and email address from Meta. In both cases, we use this information solely to create and manage your account. We also automatically collect limited technical information through analytics cookies (see our Cookie Policy), such as pages visited and general usage patterns, where you have given consent.
3. How we use your information
We use your information to: create and manage your wholesale account, verify your business through Companies House where applicable, process and fulfil orders, communicate with you about your account and orders, and improve our website through anonymised analytics (Google Analytics) and advertising measurement (Meta Pixel), where you have consented to these cookies.
3a. Lawful bases for processing
Under UK GDPR, we rely on the following lawful bases for processing your personal data:
| Processing activity | Lawful basis | Retention |
|---|---|---|
| Account registration and management | Contract (steps necessary to enter into and perform a contract) | While your account is active, plus 12 months |
| Company verification via Companies House | Legitimate interests (verifying B2B eligibility) | Duration of account plus 12 months |
| Order processing, invoicing, and fulfilment | Contract; Legal obligation (UK tax record-keeping) | 6 years from the end of the tax year in which the transaction occurred |
| Transactional emails (order confirmations, dispatch notices) | Contract | Duration of account |
| Marketing emails and newsletters | Consent | Until you withdraw consent or unsubscribe |
| Google Analytics (website usage patterns) | Consent (cookie consent) | Based on cookie duration; data anonymised |
| Meta Pixel (advertising measurement) | Consent (cookie consent) | Based on cookie duration |
| Fraud prevention and platform security | Legitimate interests (protecting our business and users) | As long as necessary for the specific risk assessment |
Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights. You may contact us to request further details.
4. Who we share your information with
We do not sell your personal information. We share information with trusted service providers who help us run our business, strictly for the purposes described above:
- Supabase (database hosting, located in the EU)
- Evrien Creative (evrien.com), our appointed technology partner, who has database-level access to the platform for the purposes of development, maintenance, security monitoring, and ensuring service continuity. Evrien Creative processes data strictly on our behalf and under our instructions, in compliance with UK GDPR requirements for data processors.
- Cloudinary (image hosting)
- Google Analytics and Meta Pixel (website analytics and advertising measurement, only with your consent)
- Companies House (UK government service, to verify business details you provide)
- Our email service provider, for transactional emails related to your orders
Some of these providers process data outside the United Kingdom:
| Provider | Processing location | Transfer safeguard |
|---|---|---|
| Supabase | EU (Frankfurt) | UK adequacy decision for EEA |
| Cloudinary | USA / EU | UK International Data Transfer Agreement (IDTA) |
| Google (Analytics, OAuth) | USA / EU | UK IDTA / Standard Contractual Clauses |
| Meta (Pixel, OAuth) | USA / EU | UK IDTA / Standard Contractual Clauses |
| Evrien Creative | United Kingdom | No international transfer (UK-based) |
You may contact us to request further information about the safeguards we have in place for international data transfers.
4a. Technology Partner
Our website and platform infrastructure is developed and maintained by Evrien Creative (evrien.com), operating as a data processor under a data processing agreement with Bumerang Ltd. In this capacity, Evrien Creative has access to the platform's database systems to perform essential functions including software development, bug resolution, performance optimisation, security patching, and service continuity management.
Evrien Creative does not independently determine the purposes or means of processing your personal data, does not use your data for its own purposes, and does not share your data with any third parties. All data access is subject to appropriate technical and organisational security measures. For more information about Evrien Creative's own privacy practices, please visit evrien.com/privacy-policy.
5. How long we keep your information
We retain your account and order information for as long as your account remains active, or as needed to operate our business. If you ask us to delete your account, we will delete your profile information (such as your name, login details, and saved addresses). However, UK tax law requires businesses to retain financial records, including order and invoice records, for a minimum of 6 years — so we will retain that specific transaction data for that period even after an account deletion request, as permitted under data protection law for compliance with a legal obligation.
6. Your rights
Under UK GDPR, you have the right to access, correct, delete, or restrict the use of your personal information, and to object to certain processing (such as analytics or marketing). To exercise any of these rights, contact us via our Contact page. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have not handled your data properly.
7. Cookies
Our website uses cookies, including analytics and advertising cookies that require your consent. See our Cookie Policy for full details.
8. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will reflect the most recent changes.
9. Contact us
If you have any questions about this policy or how we handle your data, please email us at privacy@toysheaven.co.uk, contact us via our Contact page, or call us on 01279 964430.