Privacy Notice

Last updated: 17 July 2026

1. Introduction

NewRides Crew Ltd, trading as My Toy Box (“My Toy Box”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, disclose and protect your personal information when you:

• visit or use our website, mytoybox.co.uk or newrides.co.uk;
• create or use a customer account;
• place an order with us;
• contact us by email, telephone or another method;
• subscribe to receive marketing communications from us; or
• otherwise interact with us.

It also explains your rights under applicable data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Please read this Privacy Notice carefully so that you understand how and why we use your personal information.

2. Who we are

For the purposes of UK data protection law, the data controller is:

NewRides Crew Ltd, trading as My Toy Box

Registered office:
Studio I1c Witan Studios
Witan Gate
Milton Keynes
Buckinghamshire
England
MK9 1EF

Email: sales@newrides.co.uk

As data controller, NewRides Crew Ltd is responsible for deciding how and why your personal information is used.

We do not currently have a dedicated internal Data Protection Officer. Privacy enquiries and requests should be sent to sales@newrides.co.uk.

3. The personal information we collect

The personal information we collect depends on how you interact with us.

Identity and contact information

This may include:

• your name;
• billing address;
• delivery address;
• email address;
• telephone number;
• customer account details; and
• any other contact information you provide to us.

Order and transaction information

This may include:

• the products you order;
• order numbers;
• purchase history;
• delivery information;
• returns, refunds or complaints;
• transaction dates and amounts;
• payment status; and
• limited payment-related information supplied by our payment providers.

Payments may be processed through Shopify Payments, PayPal or Google Pay, depending on the payment method you select at checkout.

We do not normally receive or store your complete payment-card details. Your payment information is processed securely by the relevant payment provider. Those providers may process your information under their own privacy notices.

Account information

If you create an account, we may process:

• your login details;
• account preferences;
• saved addresses;
• order history; and
• communications relating to your account.

Passwords are managed through our ecommerce platform and are not available to us in readable form.

Communications

We may collect information contained in correspondence when you contact us, including:

• emails;
• telephone enquiries;
• customer-service requests;
• complaints;
• returns enquiries; and
• other information you choose to provide.

Website and device information

When you use our website, Shopify and related service providers may automatically collect information such as:

• your IP address;
• browser type and version;
• device type;
• operating system;
• time zone and approximate location;
• pages viewed;
• products viewed;
• dates and times of visits;
• referring website or source;
• shopping-cart activity; and
• information collected through cookies or similar technologies.

Some of this information may identify you indirectly or become personal information when combined with other information.

Marketing preferences

Where applicable, we may record:

• whether you have asked to receive marketing;
• the method by which you agreed;
• the date of your consent;
• your communication preferences; and
• whether you have unsubscribed.

Fraud prevention and security information

We and our service providers may process information used to detect, prevent and investigate fraud, misuse, security incidents, unlawful activity or breaches of our terms.

4. Information we do not intend to collect

We do not normally need or intend to collect special category personal information through our website. This includes information about health, race or ethnicity, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric information, or a person’s sex life or sexual orientation.

Please do not provide this type of information unless it is genuinely necessary. Where we need to process special category information, we will identify an appropriate lawful basis and any additional legal condition required.

We also do not intentionally collect information about criminal convictions or offences unless permitted or required by law.

5. How we collect your information

We collect personal information:

Directly from you

For example, when you:

• place an order;
• create or update an account;
• contact us;
• request a refund or return;
• communicate with customer service;
• subscribe to marketing; or
• otherwise provide information to us.

Automatically through our website

Shopify and its service providers may collect device, usage and cookie information when you browse or interact with our website.

From service providers and other third parties

We may receive information from:

• Shopify;
• Shopify Payments, PayPal, Google Pay and other payment providers;
• delivery and fulfilment providers;
• fraud-prevention and security providers;
• technical and IT support providers;
• banks or payment-card networks;
• public authorities; and
• other parties involved in fulfilling an order or resolving a transaction.

6. How we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for each way in which we use personal information.

Depending on the circumstances, we rely on one or more of the following lawful bases:

• Contract: processing is necessary to enter into or perform a contract with you.
• Legal obligation: processing is necessary for us to comply with a legal requirement.
• Legitimate interests: processing is necessary for our legitimate business interests, or those of another person, provided that your interests and fundamental rights do not override those interests.
• Consent: you have given us clear permission to use your information for a particular purpose.

The table below explains our principal processing activities.

Processing and fulfilling orders

We use your identity, contact, order, payment and delivery information to:

• accept and process orders;
• take or arrange payment;
• confirm your purchase;
• package and dispatch products;
• arrange delivery;
• provide order updates;
• manage cancellations, returns and refunds; and
• communicate with you about your order.

Lawful basis: Performance of our contract with you.

Managing payments

We use transaction and payment-related information to:

• process and authorise payments;
• confirm payment status;
• issue refunds;
• maintain transaction records;
• prevent and detect fraud; and
• deal with payment disputes or chargebacks.

Payments may be processed using:

• Shopify Payments;
• PayPal; or
• Google Pay.

The payment option available may depend on your device, browser, location and the payment methods enabled at checkout.

We do not normally receive or store your complete payment-card details. Payment information is submitted directly to and processed by the relevant payment provider.

Payment providers may process personal information as independent data controllers for purposes such as payment authorisation, fraud prevention, regulatory compliance and dispute management. Their processing is also governed by their own privacy notices.

Lawful basis: Performance of our contract with you, compliance with applicable legal obligations, and our legitimate interests in receiving payment, preventing fraud, reducing financial loss and managing disputes.

Providing customer service

We use your contact details, order information and communications to:

• answer questions;
• resolve problems;
• manage complaints;
• provide product or delivery information;
• assist with returns and refunds; and
• maintain records of our communications.

Lawful basis: Performance of our contract with you and our legitimate interests in supporting customers and improving our service.

Managing customer accounts

We use account, identity and contact information to:

• create and maintain accounts;
• authenticate account access;
• save preferences and addresses;
• display order history; and
• protect accounts against unauthorised access.

Lawful basis: Performance of our contract with you and our legitimate interests in providing convenient and secure account services.

Operating and improving our website

We use website, device and usage information to:

• operate the website;
• maintain website functionality;
• remember items in a shopping basket;
• understand technical performance;
• identify errors;
• improve usability;
• protect the website; and
• understand, in general terms, how visitors use our services.

Lawful basis: Our legitimate interests in operating, securing and improving our website. Where the law requires consent for a particular cookie or similar technology, we rely on consent.

Security, fraud prevention and misuse

We may use identity, transaction, device and technical information to:

• protect our website, systems, customers and business;
• authenticate users;
• prevent and investigate fraud;
• detect suspicious activity;
• enforce our terms;
• respond to cybersecurity incidents; and
• establish, exercise or defend legal claims.

Lawful basis: Our legitimate interests in protecting our customers, systems and business, and compliance with legal obligations where applicable.

Complying with legal and regulatory requirements

We may process information to:

• maintain accounting and tax records;
• respond to lawful requests from public authorities;
• comply with consumer-protection obligations;
• comply with court orders;
• meet fraud-prevention and anti-money-laundering requirements where applicable; and
• establish, exercise or defend legal rights.

Lawful basis: Compliance with a legal obligation and, where relevant, our legitimate interests in protecting our legal rights.

Direct marketing

We do not currently send routine direct-marketing communications.

We may offer customers or website users the opportunity to subscribe to marketing in the future. Where we do so, we will send electronic marketing only where we have an appropriate legal basis, such as:

• your consent; or
• the limited “soft opt-in” available under UK electronic marketing rules, where legally applicable.

You may unsubscribe at any time by using the unsubscribe link in a marketing message or by contacting sales@newrides.co.uk.

We will not send marketing merely because you have visited our website. We will also not require you to consent to marketing as a condition of placing an order.

Lawful basis: Consent or our legitimate interests where the soft opt-in lawfully applies.

Business administration and restructuring

We may process relevant information in connection with:

• audits;
• professional advice;
• insurance;
• financing;
• a business sale;
• merger;
• restructuring; or
• transfer of assets.

Lawful basis: Our legitimate interests in administering, developing or restructuring our business and, where applicable, compliance with legal obligations.

7. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and developing our business;
• fulfilling and managing customer orders;
• providing effective customer service;
• securing our website, systems and premises;
• preventing fraud and misuse;
• maintaining accurate business records;
• improving our products and services;
• managing disputes and complaints;
• obtaining professional advice; and
• protecting our legal rights.

Before relying on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override our interests.

You may object to processing based on legitimate interests in certain circumstances. See the section titled “Your data protection rights”.

8. When you must provide information

Where we need personal information to enter into or perform a contract with you, or to comply with a legal obligation, failure to provide that information may mean that we cannot:

• process your order;
• take payment;
• arrange delivery;
• provide a refund;
• respond fully to your request; or
• provide another requested service.

We will try to make clear when information is required and when it is optional.

9. Who we share personal information with

We do not sell your personal information.

We share information only where reasonably necessary for the purposes described in this Privacy Notice.

Shopify

Our online shop is hosted and operated using Shopify. Shopify processes information needed to provide ecommerce hosting, checkout, account, security and related services.

For customers in the United Kingdom, European Economic Area and Switzerland, personal information may initially be processed by Shopify International Limited in Ireland and may also be processed by other Shopify group companies and subprocessors.

Payment service providers

Depending on the payment method selected at checkout, payments may be processed by Shopify Payments, PayPal or Google Pay, together with relevant banks, payment-card networks and financial institutions.

These organisations may process information needed to:

• verify your identity or payment method;
• authorise and complete payments;
• prevent and investigate fraud;
• comply with financial and regulatory obligations;
• process refunds; and
• manage payment disputes or chargebacks.

We do not normally receive or store your complete payment-card details.

Shopify Payments, PayPal, Google Pay and other organisations involved in processing your payment may act as independent data controllers for some uses of your information. Their handling of personal information is also governed by their respective privacy notices.

Delivery providers

We may share your name, delivery address, contact details and relevant order information with delivery companies so that they can deliver and track your order.

Our delivery providers include:

• Royal Mail;
• Evri; and
• Parcelforce.

The courier used may depend on the size, value, location or delivery method for an order.

Delivery companies may process information as independent controllers for certain purposes, such as their own delivery records, legal compliance and fraud prevention.

IT and technical-support providers

We may share or permit access to information where necessary for providers who support our:

• website;
• local servers;
• business systems;
• email;
• cybersecurity;
• backups; and
• technical support.

Our external IT provider is Webbytech.

Such providers are permitted to use information only as necessary to provide their services, subject to appropriate contractual and confidentiality requirements.

Professional advisers

We may share information where necessary with:

• accountants;
• auditors;
• insurers;
• banks;
• solicitors;
• tax advisers; and
• other professional advisers.

Public authorities and legal recipients

We may disclose information to:

• HM Revenue & Customs;
• courts;
• regulators;
• law-enforcement bodies;
• government departments; and
• other authorities,

where required by law or where disclosure is necessary to protect our legal rights, customers, staff, systems or business.

Business purchasers and restructuring parties

If we sell, merge or reorganise all or part of our business or assets, relevant personal information may be disclosed to prospective purchasers, advisers and new owners, subject to appropriate protections.

10. International transfers

Some providers involved in operating our website, processing payments or providing technical services are based outside the United Kingdom or may access information from other countries.

In particular, Shopify is an international organisation and uses group companies and subprocessors in several countries. This may involve transferring personal information outside the United Kingdom.

Where personal information is transferred to a country that has not been formally recognised as providing an adequate level of data protection, we expect the relevant provider to use an approved legal safeguard. Depending on the circumstances, this may include:

• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses;
• an adequacy regulation;
• binding corporate rules; or
• another legally permitted safeguard.

Where required, additional technical and organisational protections may also be used.

You may contact us at sales@newrides.co.uk for further information about the safeguards relevant to a particular transfer. Some details may be subject to confidentiality or security restrictions.

11. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, reporting and dispute-resolution requirements.

Our retention periods depend on the type of information and why we hold it.

As a general guide:

• Order, invoice, payment and accounting records: normally retained for up to six years after the end of the relevant financial year, or longer if required by law or an active dispute.
• Customer-service communications: normally retained for up to six years after the matter or transaction is completed, where needed to maintain a record or manage possible claims.
• Customer account information: retained while the account remains active and for a reasonable period afterwards, unless earlier deletion is appropriate or continued retention is required.
• Marketing consent and suppression records: retained for as long as we send marketing and afterwards for as long as reasonably necessary to demonstrate consent or ensure that an unsubscribe request continues to be respected.
• Website and security records: retained for a period appropriate to the security, troubleshooting, fraud-prevention or operational purpose for which they were created.
• Unsuccessful or abandoned transaction information: retained only for as long as needed for operational, security, fraud-prevention or legal purposes.

We may retain information for longer where:

• a complaint, dispute, investigation or legal claim is ongoing or reasonably anticipated;
• the law requires a longer period;
• a regulator or authority requires it; or
• retention is necessary to protect someone’s rights.

When information is no longer required, we will delete, anonymise or securely dispose of it, subject to the operation of backup systems.

12. How we protect your information

We use reasonable technical and organisational measures designed to protect personal information from:

• unauthorised access;
• accidental loss;
• unlawful use;
• alteration;
• disclosure; and
• destruction.

These measures include, where appropriate:

• anti-virus and anti-malware protection;
• regular security scans;
• system and software patching;
• access controls;
• passwords and authentication controls;
• secure internet connections;
• server and network security;
• backups;
• staff and supplier confidentiality requirements; and
• support from our external IT provider.

We work with Webbytech to support the security, maintenance and updating of our IT systems and servers.

Information sent through our website is protected in transit using HTTPS/TLS where supported by the service. Shopify and payment providers apply their own security controls to information processed through their platforms.

No system or method of transmission can be guaranteed to be completely secure. However, we take proportionate steps designed to reduce the risk of unauthorised access, loss or misuse.

If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable law, including notifying the Information Commissioner’s Office and affected individuals where legally required.

13. Cookies and similar technologies

Cookies are small text files placed on a device when someone visits a website. They help websites operate, remember information and understand how services are used.

Our website uses cookies and similar technologies provided through Shopify.

These may include:

Strictly necessary cookies

These are needed for functions such as:

• website security;
• checkout;
• shopping-basket operation;
• account access;
• payment processing;
• fraud prevention; and
• remembering privacy choices.

These cookies do not normally require consent because the website or a service requested by the user cannot operate properly without them.

Functional cookies

These may remember choices or provide enhanced website features.

Analytics or performance cookies

Depending on our Shopify configuration, these may help us understand website traffic, technical performance and how visitors use the site.

Advertising or targeting cookies

We do not currently use Google Analytics, Meta Pixel or a separate advertising platform. However, certain Shopify features, sales channels or integrations may use technologies that fall within this category if enabled.

Where UK law requires consent, non-essential cookies will not be used until consent has been obtained through the available privacy or cookie controls.

You can also manage cookies through your browser settings. Blocking all cookies may affect checkout, account access or other website functions.

Because our cookie use may change when Shopify updates its services or when our store configuration changes, information shown through the website’s cookie banner or privacy controls should be read alongside this notice.

14. Marketing communications

We do not currently send regular marketing communications.

If we introduce email marketing, we may use Shopify’s customer and subscriber tools to manage the recipient list.

We will explain what someone is signing up to and will record the applicable consent or other lawful basis.

You may stop receiving marketing at any time by:

• clicking the unsubscribe link in the message; or
• emailing sales@newrides.co.uk.

Opting out of marketing will not prevent us from sending necessary service communications about an order, delivery, account, return, refund or legal matter.

We may retain minimal information on a suppression list so that we can continue to respect an unsubscribe request.

15. Children’s information

Our website sells products that may be intended for children, but the website and purchasing service are intended for use by adults.

We do not knowingly invite children to create accounts, make purchases or provide personal information without appropriate adult involvement.

Orders for children’s products should be placed by a parent, guardian or other adult.

If you believe that a child has provided personal information to us inappropriately, please contact sales@newrides.co.uk so that we can investigate and take appropriate action.

16. Automated decision-making

We do not currently make decisions that produce legal or similarly significant effects on individuals solely through automated processing.

Shopify, payment providers or fraud-prevention providers may use automated systems to assess transactions for fraud, security or payment risk. Depending on the circumstances, those providers may make their own decisions or provide us with a risk assessment.

You may contact us if you have questions about a declined or restricted order. Payment providers may also have their own review and appeal procedures.

17. Your data protection rights

Depending on the circumstances, you may have the following rights.

Right to be informed

You have the right to receive clear information about how your personal information is collected and used. This Privacy Notice is intended to provide that information.

Right of access

You may ask us for confirmation of whether we process your personal information and request a copy of the information we hold about you.

Right to rectification

You may ask us to correct personal information that is inaccurate or complete information that is incomplete.

Right to erasure

You may ask us to delete your personal information in certain circumstances.

This right is not absolute. For example, we may need to retain information to comply with tax or accounting law, complete a transaction, manage a dispute or establish, exercise or defend a legal claim.

Right to restrict processing

You may ask us to restrict how we use your information in certain circumstances, including while we investigate a dispute about accuracy or lawful use.

Right to object

You may object to processing based on our legitimate interests in certain circumstances.

You have an absolute right to object to the use of your personal information for direct marketing.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may have the right to receive certain information in a structured, commonly used and machine-readable format, or ask us to send it to another organisation where technically feasible.

Rights relating to automated decision-making

You may have rights relating to decisions based solely on automated processing where those decisions produce legal or similarly significant effects.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Right to complain

You have the right to complain to the Information Commissioner’s Office if you are concerned about our use of your information.

18. How to exercise your rights

To exercise a data protection right, contact us at:

Email: sales@newrides.co.uk

Post:
NewRides Crew Ltd
Studio I1c Witan Studios
Witan Gate
Milton Keynes
Buckinghamshire
England
MK9 1EF

Please describe the information or processing your request relates to.

We may need to ask for information to verify your identity and ensure that personal information is not disclosed to an unauthorised person. We will request only information reasonably necessary for that purpose.

You will not normally have to pay a fee. However, the law may permit us to charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, particularly where it is repetitive.

We will normally respond within one month. Where a request is complex or several requests are made, the law may permit us to extend this period. If that happens, we will explain why and tell you when to expect a response.

Some rights are subject to exemptions or limitations. If we cannot fully comply with a request, we will explain the reason unless the law prevents us from doing so.

19. Complaints to the Information Commissioner’s Office

We encourage you to contact us first so that we have an opportunity to resolve your concern.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office

Website: ico.org.uk
Telephone: 0303 123 1113

Further contact details and complaint options are available on the ICO’s website.

20. Third-party websites and services

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of independent third parties. Their use of personal information is governed by their own privacy notices.

This may include, for example:

• payment providers;
• delivery tracking websites;
• social-media services; and
• other linked websites.

We recommend reviewing the relevant privacy notice before providing information to a third party.

21. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our business;
• changes to our website or service providers;
• changes to the way we use personal information;
• changes in law or regulatory guidance; or
• improvements to the clarity of the notice.

The latest version will be published on this page. The “Last updated” date at the beginning of the notice will show when it was most recently revised.

Where a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected individuals where required.

22. Contact us

For questions about this Privacy Notice or our use of personal information, contact:

NewRides Crew Ltd, trading as My Toy Box

Email: sales@newrides.co.uk

Registered office:
Studio I1c Witan Studios
Witan Gate
Milton Keynes
Buckinghamshire
England
MK9 1EF