Privacy & Data Protection Policy

Tooaleta.co.uk respects your privacy and is committed to protecting your personal data. This Privacy & Data Protection Policy explains, in clear terms, what information we collect, why we use it, how long we keep it, who we may share it with, how cookies and similar technologies are controlled, and the rights available to you.

We process personal data in accordance with applicable UK privacy and data protection legislation, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"), as amended from time to time.

1. Who We Are & Who Controls Your Data

Tooaleta.co.uk is operated by Maro GmbH. Maro GmbH determines how and why personal data collected through Tooaleta.co.uk is processed and is therefore the data controller for the purposes described in this policy.

This policy applies to personal data processed when you browse Tooaleta.co.uk, create or use an account, place an order, contact us, request technical or warranty support, communicate with our customer service team, subscribe to marketing where available, or otherwise interact with our services.

2. The Personal Data We Collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

• Identity Data: first name, last name, account username and similar identifiers.
• Contact Data: billing address, delivery address, email address and telephone number.
• Order & Transaction Data: products ordered, order value, payment status, refunds, delivery information, invoices and transaction references.
• Payment-Related Data: payment method, payment status and payment-provider transaction identifiers. Full card details are normally handled directly by the relevant secure payment provider rather than stored by Tooaleta.co.uk.
• Account & Profile Data: account details, purchase history, saved preferences, wishlist information and communications with us.
• Customer Service & Warranty Data: correspondence, service requests, technical descriptions, photographs or videos you choose to provide, product serial numbers and warranty information.
• Technical Data: IP address, browser type and version, device type, operating system, time zone, referring pages, requested pages, timestamps, security information and similar technical information.
• Usage & Analytics Data: information about how you use the website, but only where the applicable technology is permitted by law and, where required, you have given consent.
• Marketing Preference Data: your preferences regarding marketing communications and your cookie/privacy choices.

Where We Obtain Your Data

Most personal data is provided directly by you, for example when you place an order or contact us. We may also receive limited information from payment providers, delivery companies, fraud-prevention or security providers, manufacturers assisting with warranty claims, and business partners where necessary to provide a service you have requested.

We do not intentionally request special-category personal data such as medical information, biometric information, religious beliefs or information about your sexual life. Please avoid providing such information unless it is genuinely necessary for a specific request.

3. How and Why We Use Your Data

We only process personal data where we have an appropriate lawful basis. Depending on the purpose, this may include performance of a contract, compliance with a legal obligation, our legitimate interests or your consent.

Our Legitimate Interests

Where we rely on legitimate interests, those interests may include operating and securing our business, preventing fraud, maintaining accurate records, providing effective customer support, defending legal claims, improving our services and protecting our customers. We consider whether our interests are necessary and proportionate and whether your rights and freedoms override those interests.

4. Payments, Fraud Prevention & Security

Payment information is transmitted using encrypted connections to the relevant payment provider. Where Stripe or another external payment service is selected, that provider may process payment information, device information and fraud-prevention signals in accordance with its own privacy obligations.

We may use payment and security providers to detect suspicious transactions, protect payment credentials, prevent account abuse and reduce fraud. Such services may use automated risk signals. Tooaleta.co.uk does not intentionally make decisions based solely on automated processing that produce legal or similarly significant effects on you unless such processing is permitted by law and appropriate safeguards are in place.

Our security measures include, as appropriate:

• TLS/SSL encryption for website communications.
• Access controls designed to limit access to personal data.
• Network and application security measures.
• Fraud and abuse-prevention controls.
• Monitoring and maintenance of website infrastructure.
• Confidentiality obligations for staff and service providers who require access to personal data.

No internet-based service can guarantee absolute security. If we become aware of a personal-data breach, we will assess it and make any notifications required by applicable law.

5. Sharing Your Personal Data

We do not sell your personal data. We disclose personal data only where necessary for the purposes described in this policy, where required by law, or where you have otherwise authorised us to do so.

Recipients may include:

• Payment Providers: for payment processing, refunds, fraud prevention and payment security.
• Delivery & Logistics Providers: such as FedEx, DHL, DPD, Kuehne+Nagel and other carriers or freight partners used for a particular delivery.
• Manufacturers & Service Partners: where necessary to handle technical enquiries, warranty claims, replacement parts or repairs.
• Hosting, Infrastructure & Security Providers: organisations supporting website hosting, content delivery, security and fraud prevention.
• Customer Service Providers: including systems used to provide email, support or live-chat functionality.
• Analytics Providers: including Google Analytics 4, but only where the relevant consent has been given.
• External Media Providers: including YouTube where you choose to enable external media.
• Professional Advisers: lawyers, accountants, auditors, insurers, banks and other advisers where necessary.
• Public Authorities: courts, regulators, tax authorities, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

Where another organisation processes personal data on our behalf, we require appropriate contractual and security protections where required by law.

6. International Data Transfers

Maro GmbH is established in Austria and operates Tooaleta.co.uk for the UK market. Consequently, information relating to UK customers may be processed within the European Economic Area as part of order administration, customer service and business operations.

Some technology, payment, analytics, security or support providers may also process information in countries outside the UK. Where a transfer is subject to UK data-protection restrictions, we seek to use an appropriate lawful transfer mechanism, such as an applicable UK adequacy regulation or recognised contractual safeguards, where required.

You may contact us at [email protected] if you would like further information about the safeguards relevant to a particular transfer.

7. How Long We Keep Your Data

We do not keep personal data indefinitely. Retention depends on why the information was collected, applicable legal obligations, warranty and contractual requirements, the possibility of legal claims and our legitimate business needs.

• Orders, invoices and accounting records: generally retained for the legally required accounting and taxation period, commonly up to seven years or longer where applicable law requires it.
• Customer account information: retained while the account remains active and reviewed when no longer required. Transaction records may need to be retained independently of the account.
• Warranty, return and support records: retained for as long as reasonably necessary to administer the request, product warranty, service obligations and potential legal claims.
• Payment records: retained to the extent necessary for transaction administration, fraud prevention, chargebacks, accounting and legal obligations. Full payment-card credentials are handled by the relevant payment provider.
• Marketing information: retained until you unsubscribe, withdraw consent where applicable, or the information is no longer reasonably required.
• Analytics information: collected only after Analytics consent and retained in accordance with the retention settings applied to our analytics service and our ongoing data-minimisation requirements.
• Security logs: generally retained only for a period reasonably necessary for security, fraud prevention, diagnostics and investigation.
• Cookie preference: our current consent preference cookie is normally stored for approximately 180 days unless you delete it earlier.

When personal data is no longer required, we may securely delete or anonymise it so that it can no longer identify you.

8. Marketing Communications

Where we send electronic marketing, we do so only where permitted by applicable law. Depending on the circumstances, this may be because you have consented or because another permitted electronic-marketing rule applies.

You can ask us to stop sending marketing communications at any time by using the unsubscribe mechanism contained in the relevant message or by contacting us at [email protected].

Withdrawing from marketing does not prevent us from sending non-marketing communications that are necessary to administer your order, account, warranty claim or other existing relationship with us.

9. Your Legal Rights

Depending on the circumstances and the lawful basis involved, UK data-protection law may give you the right to:

• Request access to personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of personal data where the legal conditions for erasure are met.
• Request restriction of processing in certain circumstances.
• Object to processing where we rely on legitimate interests, including an absolute right to object to certain direct-marketing processing.
• Request data portability for certain information processed by automated means on the basis of consent or contract.
• Withdraw consent at any time where processing is based on consent. Withdrawal does not make processing carried out before withdrawal unlawful.
• Request information about safeguards used for certain international data transfers.
• Raise concerns regarding automated decision-making where applicable.
• Make a complaint to a data-protection supervisory authority.

Your Right to Complain to the ICO

If you are in the UK and have concerns about how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

Information Commissioner's Office – Make a Complaint
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

We would appreciate the opportunity to address your concern first, but contacting us is not a prerequisite to exercising your right to complain to the ICO.

10. Cookies & Similar Technologies

Tooaleta.co.uk uses cookies and similar storage/access technologies for website operation, security, shopping-cart functionality, analytics and optional external services.

Some technologies are necessary for the website to function and may operate without consent where an applicable PECR exception permits this. Non-essential technologies are not enabled until the required consent has been given.

Our Cookie Consent Controls

When you first visit Tooaleta.co.uk without a stored privacy preference, our privacy-choice banner allows you to:

• Accept all optional categories.
• Reject non-essential technologies.
• Open Cookie settings and choose categories individually.

Our current consent categories are:

You can change or withdraw your choices at any time using the permanent Cookie settings control available in the website footer. Refusing optional technologies does not prevent you from shopping, using your cart or completing checkout.

Where technically possible, when Analytics or other optional consent is withdrawn, we stop loading the relevant technology and remove known first-party analytics/marketing cookies associated with the withdrawn category. Third-party providers may have their own retention obligations for information already lawfully transmitted before consent was withdrawn.

Cookies Commonly Used on Tooaleta.co.uk

Cookie names, providers and lifetimes may change when suppliers update their services. We periodically review the technologies used on the website and update this policy where material changes occur.

Google Analytics 4

Tooaleta.co.uk uses Google Analytics 4 with measurement ID G-V6ELTMSBDN. Google Analytics is not loaded before Analytics consent. If you reject Analytics, Google Analytics 4 is not activated by our consent system.

If you later withdraw Analytics consent, we stop initiating Analytics through our consent system and attempt to remove known Google Analytics cookies accessible from the Tooaleta.co.uk domain.

YouTube & External Media

Certain pages contain video content provided through YouTube. These video connections are blocked until you enable External Media. When External Media is disabled, clicking a protected video will direct you to your Cookie settings rather than contacting YouTube.

If you enable External Media and play a video, YouTube/Google may receive technical information such as your IP address, device/browser information and the page containing the video, and may use storage/access technologies in accordance with its own policies.

11. Third-Party Services

The website uses or may interact with external service providers. Depending on the service and your privacy choices, these providers may receive technical information such as your IP address and browser information.

• Google Analytics: website analytics, only after Analytics consent.
• YouTube / Google: embedded video content, only after External Media is enabled.
• Stripe: payment processing and fraud prevention where Stripe is used.
• Cloudflare: website security, availability and protection from malicious traffic.
• Zendesk / Zopim: customer-support and live-chat functionality.
• Google Fonts: font resources may be requested from Google infrastructure when pages are displayed.
• Website trust/security providers: certain pages may request trust-seal or verification resources from external providers.

Links to third-party websites are provided for convenience. Once you leave Tooaleta.co.uk, the third party's own privacy policy and terms apply.

12. Children, Changes to This Policy & Contact

Children

Tooaleta.co.uk is a retail website for bathroom products and is not directed at children. We do not knowingly seek to collect personal data from children for marketing or profiling purposes.

Changes to This Policy

We keep this policy under review and may update it when our services, technology providers, data-processing activities or legal obligations change. Where a material new use requires a new consent, we will request that consent rather than relying on a previous choice that did not cover the new purpose.

Contact Us Regarding Your Data

If you have a question about this policy, how we use your personal data, your cookie choices or a data-protection request, please contact:

Maro GmbH / Tooaleta.co.uk
Klagenfurter Str. 34
9170 Ferlach
Austria

Email: [email protected]

We keep our privacy information under regular review. This version was last updated in August 2026.