Privacy Policy

Last updated: 19 August 2026

1. Purpose and Scope

This Privacy Policy explains how FERUTAX OÜ collects and uses personal data in connection with https://www.ferutoys.com, customer accounts, orders, delivery, returns, support, marketing, security and related business activities.

Because the Website sells intimate products, we recognise that order and support information is particularly private. We do not use purchase data to infer a person’s sex life, sexual orientation or health for advertising or unrelated profiling.

2. Controller

The controller is:

3. Data We Collect

Depending on how you interact with us, we may collect:

• identity data, such as name and confirmation that you meet the adults-only requirement;
• contact data, such as email, delivery address and billing address;
• order data, including products, quantities, price, currency, delivery status, returns and warranty history;
• payment-related data, such as payment method, transaction reference, status and fraud indicators, while full card details are generally handled by the payment provider;
• account data, such as credentials, preferences and account activity;
• support data, including messages, attachments and complaint information;
• technical data, such as IP address, device, browser, operating system, timestamps, security logs and Website interactions;
• marketing data, such as subscription and consent status, campaign engagement and preferences; and
• cookie and similar-technology data described in the Cookie Policy.

4. Sensitive and Unnecessary Information

We do not ask customers to provide medical diagnoses, intimate photographs or detailed information about sexual behaviour to complete an ordinary order. Please do not send such information unless it is strictly necessary for a safety or product complaint.

An order history may allow sensitive inferences because of the nature of the products. We treat it with heightened confidentiality and do not intentionally create special-category profiles from purchases. If you voluntarily provide health or other special-category data, we will process it only where necessary and where a valid condition under applicable data-protection law exists, such as explicit consent, establishment or defence of legal claims, or another legally available basis.

5. How We Obtain Data

We obtain personal data:

• directly from you when you browse, register, order, communicate, return a product or subscribe;
• automatically from your device and Website technologies;
• from payment providers, carriers such as DPD and FedEx, fraud-prevention providers and other service providers involved in a transaction; and
• from public authorities or other lawful sources where necessary for sanctions, safety, fraud or legal compliance.

6. Purposes and Legal Bases

We process personal data for the following purposes and legal bases:

• to operate checkout, accept payment, fulfil orders, provide accounts, deliver products, manage returns and provide support — performance of a Contract or steps requested before a Contract;
• to maintain accounting, tax, customs, consumer, product-safety and regulatory records — compliance with legal obligations;
• to secure the Website, prevent fraud, enforce Terms, manage business operations and establish or defend claims — our legitimate interests, balanced against your rights;
• to send requested newsletters and use non-essential cookies or advertising technologies — consent where required;
• to send service messages about an order, account, recall or safety issue — performance of a Contract, legal obligation or legitimate interests, as applicable; and
• to anonymise and aggregate information for business analysis — legitimate interests, provided the result no longer identifies you.

Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

7. Necessity of Data

Information marked as required at checkout is needed to form and perform the Contract, process payment, deliver the order or comply with law. If it is not provided, we may be unable to accept or fulfil the order.

Marketing information and non-essential cookie consent are optional. Refusal does not prevent ordinary shopping, although some preference or personalised features may be unavailable.

8. Payments

Payment-card information is submitted to an authorised payment service provider through a secure payment interface. We receive transaction status, references and limited card-related information necessary for reconciliation, support, fraud prevention and refunds.

The payment provider processes data under its own legal responsibilities and privacy information. Its identity will be shown at checkout or in the payment interface when a provider is implemented.

9. Delivery and Neutral Communications

We share the name, address, contact details, parcel information and necessary customs data with carriers, including DPD and FedEx where used. Carriers may send operational tracking messages.

We minimise explicit product information in ordinary delivery communications and outer packaging. Customs, safety or carrier rules may nevertheless require accurate descriptions or classifications.

10. Recipients

Personal data may be shared, only as necessary, with:

• payment and fraud-prevention providers;
• delivery, fulfilment, returns and customs providers;
• Website hosting, infrastructure, security and technical-support providers;
• email, customer-support and communication providers;
• analytics, consent-management and advertising providers, subject to consent where required;
• manufacturers or suppliers assisting with a warranty or safety issue, using the minimum necessary information;
• accountants, auditors, insurers, banks, legal advisers and other professional advisers;
• competent authorities, courts, regulators or law-enforcement bodies where disclosure is required or lawfully justified; and
• a purchaser or successor in a merger, restructuring or sale, subject to confidentiality and applicable law.

Service providers acting on our behalf are required to process data under appropriate contractual and security obligations.

11. International Transfers

Some providers may process data outside Estonia or the European Economic Area. Where personal data is transferred to a country without an applicable adequacy decision, we use an approved safeguard, such as European Commission Standard Contractual Clauses, together with supplementary measures where required.

You may contact info@ferutoys.com for information about the applicable transfer safeguard.

12. Retention

We keep personal data only for as long as necessary for the stated purpose, including:

• order, payment, accounting and tax records for the period required by applicable accounting and tax law;
• Contract, return, warranty and complaint records for the applicable guarantee and limitation periods and any additional period needed for a pending dispute;
• account data until the account is closed, followed by deletion or restriction except where records must be retained;
• support communications for the period needed to resolve the matter and manage legal claims;
• marketing data until consent is withdrawn or you object, with a limited suppression record retained to honour the choice;
• security logs for a limited period proportionate to investigation and security needs; and
• cookie data for the periods shown in Cookie Settings.

When retention is no longer necessary, data is deleted, anonymised or securely restricted.

13. Security and Confidentiality

We use technical and organisational measures appropriate to the risk, including access controls, role-based confidentiality, secure transmission, logging, provider due diligence, backups and incident procedures.

No system can guarantee absolute security. You should use a unique password, protect account access and avoid sending payment-card details or unnecessary intimate information by email.

14. Marketing

We send promotional email only where a lawful basis exists. Where consent is required, subscription is voluntary and must be given through a clear affirmative action.

You may unsubscribe through the link in a marketing message or by emailing info@ferutoys.com. Service, recall, security and transaction messages are not marketing and may continue where necessary.

15. Cookies and Similar Technologies

Strictly necessary technologies support security, checkout, preferences and core operation. Analytics, advertising and comparable non-essential technologies are used only in accordance with applicable consent requirements.

See the Cookie Policy and Cookie Settings for categories, purposes, providers and controls.

16. Automated Checks

Payment, security and fraud providers may use automated signals to assess transactions. Where a decision based solely on automated processing would produce legal or similarly significant effects and data-protection law grants relevant rights, you may request human review, express your view and contest the decision.

We do not use order history to make automated decisions about your health, sex life or sexual orientation.

17. Your Rights

Subject to applicable conditions, you may have the right to:

• access your personal data and receive information about processing;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive data in a portable format where the right applies;
• withdraw consent at any time;
• contest certain solely automated decisions; and
• lodge a complaint with a supervisory authority.

To exercise a right, email info@ferutoys.com. We may request proportionate information to verify identity. We normally respond within one month, subject to legally permitted extensions.

18. Supervisory Authority

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or, where applicable, the data-protection authority in the country of your habitual residence or work. Information about the Estonian authority is available at https://www.aki.ee.

19. Adults Only

The Website is not intended for persons under 18. We do not knowingly accept orders from minors. If we learn that a minor has provided personal data, we will take appropriate steps to delete or restrict it, subject to legal obligations.

Age-confirmation mechanisms should not be used to collect more identifying information than necessary. If a third-party age-verification service is introduced, this Policy will be updated before implementation.

20. Third-Party Sites

The Website may link to third-party sites. Their processing is governed by their own privacy information. Review it before submitting personal data.

21. Changes to This Policy

We may update this Policy to reflect legal, technical or operational changes. The latest version will be posted on the Website with its revision date. Where required, we will provide additional notice or obtain renewed consent.

22. Contact

Privacy questions and requests should be sent to info@ferutoys.com.