Privacy Policy

  1. Introduction

Welcome to the website

This section is dedicated to our privacy policy.

The purpose of this section is to familiarize the Users with the sources and the use given to the information collected and processed during the consultation and eventual reservations made in our website, as well as their rights.

This policy is important to the Users, as they desire a positive and trustworthy experience in our services, and therefore it is important to us since we seek to match their expectations.

  1. Data Protection
  • Data Controller


headquartered: Av. João Crisóstomo, n. º 30, 6º Dt., 1050-127 Lisboa

Company registered by the number: 513018360

For any subject related to data protection please contact: [… e-mail address]

According to General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), hereinafter GPDR, personal data is any data that allows to identify directly or indirectly a natural person (not applied to legal persons).

X-TOYSTORE, Lda., as Data Controller may request to the User the availability of his/her personal data in order to identify him/her and/or contact him/her and/or execute the purchase agreement request.

  • Purposes and legal basis of data processing

The personal data processed by X-TOYSTORE, Lda., through this website will be used for the following purposes:


– Processing orders, sales validation and issuing invoices;

– Communication with customers / users;

– Sending relevant information of an institutional or promotional nature;

– Compliance with legal obligations, whenever applicable.

The data processed may consist in identification data, contact and other data that is collected in the context of the relationship with the User.

Our Newsletters always allows the User to access the Opt-out option if it is not intended to remain as part of our mailing list.

If the User does not wish to continue to receive our Newsletter we may transmit such information through the email address […]

Personal data are processed in the context of contractual execution, compliance with legal obligations and the legitimate interest of the X-TOYSTORE, Lda.

  • Communication of data to third parties

The User’s data are destined to us and are only communicated to third parties when strictly necessary to the execution of the contract or to comply with legal obligations, namely merchandise transport companies and the Tax and Customs Authority.

  • Transfer of data to third countries

We do not transfer internationally, personal data outside the European Union.

  • Data conservation period

We only maintain User’s data for as long as it is necessary to meet the purposes for which they were collected.

  • Withdrawal of consent

In cases where the processing of data is based on the consent of the User, at any time, without compromising the lawfulness of the processing made based on the consent previously given, it may be withdrawn.

  • What are the User rights?

Right of Access

The User, as Data Subject, has the right to obtain from the Data Controller (X-TOYSTORE, Lda.) the confirmation of which data are processed, as well as the right to access them and the following information:

  • The purpose of processing.
  • The categories of personal data in question.
  • The recipients to whom the data have been or will be disclosed.
  • If possible, the deadlines for the retention of data, or the criteria for fixing these deadlines.
  • The right to request rectification, erasure, limitation or opposition to processing.
  • The right to complain to the supervisory authority.
  • The existence of autonomous decisions, including the definition of profiles.
  • If the data were not collected from the subject, available information as to their origin.
  • Guarantees concerning the transfer of data to third countries or international organizations.

Right of Rectification

The Data Subject has the right to obtain, without undue delay, rectification of inaccurate personal data concerning him, as well as having the right to request that his incomplete personal data be completed.

Right to erase data

The Data Subject has the right to request the erase of his personal data, without undue delay, when:

  • The data are no longer required for the purpose for which they were collected or processed.
  • Withdraw the consent on which the processing is based, not existing any other legal ground for the processing.
  • Opposes to processing as provided for in the Regulation.


Right to limit Processing

The Data Subject has the right to obtain from the Data Controller the limitation of the processing, applying among other things one of the following situations:

  • Having disputed the accuracy of the data in the necessary the period for the verification for its accuracy.
  • If the Data Controller no longer needs the data for processing purposes, yet the data is required by the data subject for the purposes of declaration, exercise or defense of a right in a legal process.
  • When there is opposition to processing, until it is verified that the legitimate reasons of the Data Controller prevail over those of the Data subject.

Right to data portability

If the processing is based on consent, the Data Subject has the right to receive the data that was communicated in a digital format of current use and automatic reading or to request the direct transmission of the same to another entity that becomes the new Data Controller.

Said right, applies without prejudice the GRDP provisions in what concerns the right to erasure.

Right of opposition and automated decisions

The Data Subject may oppose to the processing of the Data, in the specific cases provided for in the Regulation, when he demonstrates that his particular situation should come under the exercise of functions of public interest, public authority or legitimate interests, including the definition of profiles based in provisions relating thereto, namely, The Data Subject also has the right to oppose to the processing of his data that includes the definition of profiles for the purposes of direct marketing, and the personal data should no longer be processed for this purpose.

The Data Subject has the right not to be bound to any decision taken solely on the basis of automated processing, including the definition of profiles that have an effect on its legal status, or that significantly affect it, except when it is necessary for the performance of an agreement, is based on the User explicit consent or is authorized by Community or national law.

Right to complain

The Data Subject have the right to complain to the supervisory authority in the Member State of his habitual residence, business address or the place where the infringement was allegedly committed, considering that the processing of its personal data is in breach of the General Regulation of Data Protection.

The Data Subject has the right to a lawsuit against the legally binding decisions of the control authorities that concern him.

It is also entitled to a lawsuit if considered that there has been an infringement of the rights under the General Regulation of Data Protection.

Right to Withdraw Consent

Being the processing of the data accomplished based on the User consent, the User may withdraw it at any time, although this right does not compromise the lawfulness of the previous processing based on the same consent.

If you wish to exercise any of your rights, you must contact us in writing to the email address [•], or by letter to the address [•].

  1. Security and confidentiality

We are committed to ensure the confidentiality of Users data by using the appropriate security measures to ensure that they are not accessed by unauthorized persons. We submit our systems to the analyses of periodic security to ensure that Users Data is protected and secure. However, the transmission of information over the Internet is not completely safe, as so, we cannot guarantee absolutely the security of the information transmitted through our website.