Last Updated: September 22, 2026
This Data Safety & Retention Policy describes the technical and organizational measures ToysForYou (“we”, “us”, “our”) uses to protect personal data collected through toysforyou.in (“Website”), and how long different categories of data are retained.
1. Scope & Purpose
This Policy applies to personal data collected through toysforyou.in, operated by Sporteology Global Private Limited (CIN U62012WB2025PTC279345), registered office at 11 Olabibitala Lane, Shibpur, Howrah, West Bengal, India – 711102.
It sets out, in more technical detail than our Privacy Policy, the specific retention periods for each category of data we hold, and the security measures we and our service providers apply to protect it.
2. Data Retention Schedule
| Data Type | Retention Period / Policy |
|---|---|
| Name, email, phone number | Up to 1 year from your last interaction with the Website, then deleted or anonymized |
| Shipping/billing address | Up to 1 year from your last interaction, except where retained as part of order/invoice records below |
| Order, invoice & transaction records | 8 years, as required under Section 128 of the Companies Act, 2013 and applicable GST law |
| Account password (hashed) | Retained while your account remains active; deleted on account deletion |
| Website analytics data (Google Analytics) | Governed by Google’s own data retention policy — not set or controlled by us |
| Advertising/tracking data (Meta Pixel) | Governed by Meta’s own data retention policy — not set or controlled by us |
| Payment data | Not stored by us; processed and retained by Razorpay under its own PCI-DSS-compliant policy |
| Shipping data shared with courier partners | Retained by Shiprocket and Delhivery under their own respective privacy/data policies, for as long as needed to complete delivery and their own record-keeping |
Where you request erasure of your data under our Privacy Policy, we delete or anonymize all categories we directly control; data held by third parties above is deleted or retained according to their own policies.
3. Data Storage & Backups
Our Website and database are hosted on Hostinger, with servers located in India. Hostinger performs automatic daily backups of our website and database. Our database is encrypted at rest.
4. Access Control
Access to customer and order data is restricted to authorized personnel at Sporteology Global Private Limited. Each administrator has a separate, individual login — we do not use shared admin credentials. Two-factor authentication (2FA) is enabled on all administrative and hosting accounts with access to personal data.
5. Third-Party & Vendor Security
We work with the following service providers, each of which processes data under its own security practices:
- Razorpay (payment processing) is a PCI-DSS-compliant payment processor; we do not store your full card or banking details.
- Shiprocket and Delhivery (delivery) process your name, address, and phone number to the extent necessary to fulfil delivery, under their own respective privacy and security policies.
- Google Analytics and Meta Pixel (analytics/advertising, where you have accepted the relevant cookies) process data under Google’s and Meta’s respective privacy and security policies.
- Our third-party email/SMS marketing platform processes your name, email, and phone number to send promotional communications, under its own privacy and security policy.
We select service providers based on their suitability for our operations. Beyond Razorpay’s publicly documented PCI-DSS compliance, we do not independently audit or certify our service providers’ security practices; their handling of your data is governed by their own respective policies, which we encourage you to review. For how Shiprocket and Delhivery handle your order itself — timelines, serviceability, and tracking — see our Shipping Policy.
6. Data Breach Response
In the event of a suspected personal data breach affecting your personal data, we will assess the incident within 72 hours of detection. Where the breach is likely to affect you, we will notify you — and, where required under applicable law, the Data Protection Board of India — without undue delay following our assessment.
We recommend you also take standard precautions on your end, such as using a strong, unique password for your account.
7. Contact & Changes to This Policy
For any questions about this Policy or our data security practices, contact us at support@toysforyou.in or +91-8013136258.
We may update this Policy from time to time; changes will be posted on the Website with a revised “Last Updated” date.