Arctosoft AB (Org. nr. 559217-9724, "toybite", "we", "us") is the data controller responsible for the processing of personal data as described in this privacy policy. In this privacy policy, we explain what type of personal data we store and how we process it. This privacy policy comes into effect on 2026-10-11 and supersedes any previously published privacy policies. The terms set out in this document apply to Toybite.com and all related (sub)domains and APIs, hereinafter also referred to as “the service”.

We process the following categories of personal information:

• Account information: When you create an account on the service, you will need to provide an email address and a password. You can also provide additional information such as your name, address, telephone number, personal identification number, date of birth, profile pictures, settings and preferences.
• Shop information: As a seller, you need to provide your name, address and email address. If you are a private individual, you also need to provide your personal identity number and date of birth, as well as your VAT number and telephone number, if applicable. As a business you need to provide the company name, company registration number and, where applicable, VAT number and telephone number. Seller information can be publicly visible, including name, address, company name, company registration number, support email address, support telephone number, VAT number (if applicable), shop image(s), shop descriptions and similar shop information such as any discount codes, stock levels, variations, shop announcements or similar, if you have provided them. When linking a PayPal account, we also process your PayPal email, business details and related information.
• Orders and payments: When placing an order, you will need to provide your name, address, email address and any telephone number and message for the seller. This information is used so that the seller can know who is making the purchase and where the product is to be sent, so that the payment provider can process payments, and so that the seller can receive payment and pay their fees to us at Toybite. We also store information about what each user has bought or sold, which is used, amongst other things, to inform sellers about which orders they have. When paying using a PayPal account, we also process your selected delivery address and PayPal email and account ID.
• Technical information: When you use the service, we process and store device information such as IP addresses, technical information about your browser, which pages you visit and how the service is used.
• Reviews: When you submit a review, we save and publish your product rating, your review, your username and the product you have reviewed.
• Customer support: When you contact us regarding a support issue, we process the contact information you provide, your message, and any files, media, or other materials you send to us.
• Cookies: We use cookies to improve your user experience, to remember your user session and to remember your preferences. For example, we use cookies to remember that you are logged in. We only use strictly necessary cookies that are required for the service to function. In some cases, we may use third-party providers, for example for payments. These third-party cookies are also strictly necessary in order to use the service.
  
  Cookies are small text files stored in your browser by the websites you visit. They usually contain a website and an identifier. Cookies help to improve your experience when you browse our website, for example by remembering which items you add to your shopping basket.
  
  You can prevent cookies from being stored or used by changing your browser settings; however, this may affect the functionality of the websites you visit. Cookies on our website are strictly necessary, and deleting or blocking them may result in the service not working.

• Provision of the service: We use your personal data to fulfil our contracts with you, that is, when you use the service, when you create an account, or when you make a purchase. The legal basis for processing personal data for this purpose is that the processing is necessary for the performance of a contract with you.
• Customer relationship management: We use your personal data to manage our customer relationship with you. This may include, for example, customer service, handling complaints and troubleshooting issues relating to your account. The legal basis for processing personal data for this purpose is that the processing is necessary to fulfil a contract with you.
• Analysis, business development and service improvement: We are constantly working to develop and improve our services and products. A large part of this work involves analysing various types of personal data, such as customer history, and account and profile information. The legal basis for processing personal data for this purpose is our legitimate interest.
• Personalised user experience: We tailor the user experience and communication to your customer relationship, and we use personal data for this purpose. The legal basis for processing personal data for this purpose is our legitimate interest.
• Sales and marketing: We use personal data in connection with the sale and marketing of our own and our sellers' products and services, for example by sending you emails. The legal basis for processing personal data for this purpose is our legitimate interest. You have the option to opt out of parts of this processing by, for example, opting out of receiving emails from us.
• System monitoring, troubleshooting, etc. : We monitor our systems for faults and problems. Some of these processes involve the storage and processing of personal data. The legal basis for processing personal data for this purpose is our legitimate interest.
• Security, detection of fraud and criminal activity: We process personal data as part of our efforts to protect our users and ourselves against fraud, misuse and criminal activity. The legal basis for processing personal data for this purpose is our legitimate interest.
• Complying with legal obligations: In certain cases, we are obliged to process personal data in order to comply with legal obligations. An example of this is information relating to sales, which we are obliged to record and retain in accordance with the Swedish Accounting Act. The legal basis for processing personal data for this purpose is that the processing is necessary to comply with a legal obligation to which we are subject.

We retain personal data only for as long as is necessary to operate and provide the service. Personal data that is no longer required and that is not required to be retained by law is deleted.

Personal data that we are required to retain under the Swedish Accounting Act is stored for at least 7 years.

Technical information such as visitor logs, browser information and similar data is stored for a maximum of one year.

We do not share or sell your personal data to external parties. This does not include subcontractors or third-party suppliers that we use to operate and provide the service. We may share personal data with external parties in connection with, for example, email campaigns, payments, regulatory requirements or similar matters. We restrict access to your personal data to only those who need it in order for us to provide the service. Your data may also be shared with:

• Payment providers: We use PayPal and Mollie to process payments between buyers, sellers and Toybite. It is possible to pay with one of the following payment providers (depending on where you live):
  PayPal: Card, PayPal account.
  Mollie: Card, Swish and Klarna.
  When you pay for an order, your details are shared either solely with PayPal or Mollie, or with the respective payment provider listed earlier if you choose to pay through their payment service. Their privacy policies can be found in the following links;
  
  PayPal: https://www.paypal.com/us/legalhub/paypal/privacy-full
  Klarna: https://cdn.klarna.com/1.0/shared/content/legal/terms/sv-se/privacy
  Mollie: https://www.mollie.com/se/legal/privacy

We process and store all personal data within Sweden. In specific cases, such as for payments and email communications, we may use third-party service providers operating within or outside the EU, which may involve the transfer of some data to third party countries. In such cases, we ensure that appropriate security measures are put in place before any transfer to a third party country is initiated, to ensure that the recipient provides an adequate level of protection. This means that we only transfer personal data to countries which, according to the European Commission, are deemed to meet such a level of security, or which are covered by Standard Contractual Clauses (SCCs) with the recipient where no decision has been made by the European Commission.

If you wish to exercise any of your rights, you can contact us

Right of access to one's own data

You can request a copy of all the data we process about you.

Right to rectification of personal data

You have the right to request that we correct or supplement any information that is incorrect or misleading.

Right to erasure of personal data

You have the right to have your personal data erased without delay. You may request that we erase data relating to you at any time. Please note, however, that information which we are obliged to retain in order to comply with other legal obligations (such as the Swedish Accounting Act) will not be erased.

Restriction on the processing of personal data

In certain situations, you may also request that we restrict the processing of your personal data. You can do this by contacting us.

Object to the processing of personal data

If you believe that we are processing your personal data incorrectly, you can object to this by contacting us.

Data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format. Please contact us to receive your personal data.

We set high standards for how we protect your personal data and work actively to ensure that it is processed with the utmost care. We take the necessary measures to ensure that your personal data is processed securely and in accordance with this policy and the General Data Protection Regulation. For example, all traffic between your browser and Toybite's servers is protected using TLS, and passwords are hashed using a strong one-way algorithm.

Arctosoft AB, org.nr. 559217-9724, are the data controllers responsible for the processing of your personal data. If you have any questions regarding the processing of your personal data, please feel free to contact us.