Privacy Policy
Last updated: 7 September 2026
This Privacy Policy explains how Individual Entrepreneur Denys Shpodaris, operating the TOYS AGENCY brand and the website toys-agency.com («TOYS», «we», «us») processes personal data.
1. Who is responsible for your personal data
Data Controller for website visitors, enquiries and our own business contacts:
Individual Entrepreneur Denys Shpodaris
Identification Number: 324078190
Email for privacy requests: info@toys-agency.com
If we are required to appoint an EU or UK representative under applicable data-protection law, its contact details will be published here.
2. When TOYS is a processor for a client
When a client gives us access to its leads, CRM, customer lists, advertising audiences, advertising accounts, call-tracking data or similar data, the client normally remains the controller and TOYS acts as its processor. We process such data only to deliver the agreed services and under the client’s documented instructions.
The client agreement and/or Data Processing Agreement governs this processing. We do not sell, reuse, combine or use client data for another client or for our own independent marketing.
At the end of the engagement, we return or delete client data without undue delay, unless applicable law requires its retention. Limited backup copies may remain only until they are overwritten through normal secure backup cycles.
3. Data we collect
Depending on how you interact with us, we may process:
- Enquiry and contact data: name, business email, phone number, company name, messenger profile, and information you send to us.
- Project-enquiry data: business niche, current marketing tools, business goals, estimated advertising budget, website/project link and other information entered in our forms.
- Contract and finance data: the data necessary to enter into and perform a contract, issue invoices, maintain accounting records and communicate with a client or its representatives.
- Website and device data: IP address, cookie identifiers, browser and device information, pages visited, referral source, approximate location, event data and interactions with the website.
- Client-provided data: only where necessary to provide services, including the categories described in Section 2.
Please do not send passport, identity-document, health, biometric, payment-card or other sensitive data through website forms, email or messengers unless we specifically request it through a secure channel and explain why it is needed.
4. Why we use data and the legal basis
Replying to enquiries and preparing proposals. We use your enquiry and project-enquiry data to reply to you, prepare a proposal and take steps you request before entering a contract. Where GDPR applies, the legal basis is Article 6(1)(b).
Delivering services and managing the client relationship. We use contact, contract and project data to provide the agreed services and communicate with the client. Where GDPR applies, the legal basis is Article 6(1)(b).
Processing client data on a client’s behalf. We process client-provided data only under the client’s instructions and the applicable Data Processing Agreement. TOYS acts as processor for this activity.
Accounting, tax and legal obligations. We retain necessary contract and finance data to comply with applicable legal obligations. Where GDPR applies, the legal basis is Article 6(1)(c).
Website and business security. We use technical and security data to protect our website, systems and communications from abuse and security incidents. Where GDPR applies, the legal basis is our legitimate interests in security and business continuity under Article 6(1)(f).
Analytics and advertising. We use cookie, device and event data through Google or Meta to measure website usage and advertising only with your consent where consent is required. Where GDPR applies, the legal basis is Article 6(1)(a).
Where we rely on legitimate interests, you may object by emailing us. We will stop the processing unless we have compelling legitimate grounds or need the data for legal claims.
5. Cookies, analytics and advertising
We use strictly necessary cookies to operate the website. We also use optional analytics and marketing technologies, including Google Tag / Google Analytics and Meta Pixel, to understand website performance, measure advertising and build or measure advertising audiences.
Optional analytics and marketing technologies are activated only after your consent where this is required by law. You can accept, reject or change your choices through the cookie settings available on the website.
The cookie banner and cookie settings must provide the current list of cookies, providers, purposes and storage periods. Rejecting optional cookies will not prevent you from using the website or submitting an enquiry.
6. Who receives data
We may disclose data only where necessary to the following categories of recipients:
- website hosting and WordPress infrastructure providers, including GoDaddy where applicable;
- Google and Meta, where you consent to optional analytics or advertising technologies;
- CRM and call-tracking providers used for a particular client project;
- business communications providers, including Telegram and WhatsApp when you choose to communicate with us through them;
- professional advisers, accountants, payment/invoicing providers and public authorities where required by law;
- contractors and service providers who need access to support our services and are subject to confidentiality and data-protection obligations.
We do not sell personal data.
7. International transfers
TOYS is established in Georgia. Personal data may therefore be processed in Georgia and in other countries where our service providers operate.
Where data is transferred from the EEA, the UK or Switzerland to a country without an applicable adequacy decision, we use an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses, and additional safeguards where necessary. You may request information about the relevant safeguards by emailing info@toys-agency.com.
For client data, the relevant transfer terms are set out in the client agreement and/or Data Processing Agreement.
8. How long we keep data
- Website enquiries and proposal data: until the matter is resolved or you ask us to delete it, and in any case no longer than 24 months after the last meaningful contact, unless a contract is concluded.
- Contract, invoice and accounting data: for the period required by applicable tax, accounting and limitation laws.
- Client-provided data: returned or deleted at the end of the engagement as described in Section 2, unless the client instructs otherwise or law requires retention.
- Cookies: for the period shown in the cookie settings, or until you withdraw consent or clear the relevant cookies.
9. Your rights
Subject to applicable law, you may ask us to access, correct, delete or restrict the use of your personal data; object to processing; receive data you provided in a portable format; and withdraw consent at any time. You can also object at any time to direct marketing.
To exercise these rights, email info@toys-agency.com with the subject line “Privacy request”. We may request reasonable information to confirm your identity. If GDPR applies, you may also complain to the data-protection authority in the EEA country where you live, work or believe a breach occurred. UK residents may complain to the Information Commissioner’s Office.
If your request concerns data that TOYS processes solely for a client, please contact that client first. We will assist the client as required by our agreement and applicable law.
10. Automated decisions and children
We do not make decisions about you solely by automated means that produce legal or similarly significant effects. Subject to your consent, advertising and analytics tools may use website activity to measure campaigns or show more relevant advertising.
Our services and website are not intended for children. Do not provide us with personal data of a child through the website.
11. Security
We use technical and organisational measures appropriate to the risk, including access controls, confidentiality obligations and measures designed to protect data against unauthorised access, loss, alteration and disclosure. No internet transmission or storage system can be guaranteed completely secure.
12. Changes to this policy
We may update this policy when our services, legal obligations or data practices change. We will publish the current version on this page and update the “Last updated” date.
