1. Scope of This Policy

This policy applies to personal data collected through our website, checkout pages, customer support channels, marketing communications, and related services for our toy, gift, baby, and accessories catalog.

2. Information We Collect

3. Data We Do Not Intentionally Collect

We do not intentionally collect sensitive personal data such as government-issued identity numbers, health records, or biometric data. We also do not knowingly collect personal data from children under the applicable age threshold without required consent from a parent or legal guardian.

4. Legal Bases for Processing

Depending on your location, we process data under one or more lawful bases:

• Contract necessity: to process your order and provide requested services.
• Legitimate interests: to improve operations, prevent fraud, and secure our services.
• Consent: for optional marketing and non-essential cookies where required.
• Legal obligation: tax, accounting, and regulatory compliance.

5. How We Use Your Information

• Create and manage customer accounts.
• Process, ship, and track orders.
• Handle returns, refunds, exchanges, and support requests.
• Send service communications (order confirmations, delivery notices).
• Provide optional marketing communications with clear opt-out options.
• Monitor for fraud, unauthorized transactions, and abusive behavior.
• Maintain website functionality, speed, and security.

6. Payment Processing

Card and wallet payments are processed by trusted third-party payment providers. We do not store full card numbers or security codes on our servers. Payment processors may collect and process transaction data according to their own privacy notices and compliance requirements.

7. Sharing and Disclosure

We only share personal data when necessary to operate our business, including with:

• Shipping carriers and logistics providers for order delivery.
• Payment gateways and fraud screening providers.
• IT hosting, analytics, and customer communication providers.
• Professional advisers, auditors, or authorities where required by law.

We do not sell personal information as a standalone data product.

8. International Data Transfers

If data is transferred outside your region, we apply suitable safeguards such as contractual protections and security controls to protect your information.

9. Retention Periods

We retain personal data only as long as needed for order fulfillment, legal compliance, accounting obligations, dispute resolution, and fraud prevention. Typical retention periods depend on data category and legal requirements.

10. Security Measures

• Transport layer encryption (HTTPS) for data in transit.
• Restricted internal access controls based on role and necessity.
• Monitoring and logging of security-relevant events.
• Periodic review of service-provider security posture.

No internet transmission is fully risk-free, but we use commercially reasonable safeguards to reduce risk.

11. Your Rights

Depending on your location, you may have rights regarding the personal data we process. Common rights include: (1) access to your data, (2) correction of inaccurate data, (3) deletion, (4) portability where applicable, and (5) objecting to certain processing and withdrawing consent where the law requires consent.

Note: This Privacy Policy is a template-style document and may be updated to reflect changing legal obligations. If you do not find a specific right described here, local law may still provide protections.

11.1 How to Exercise Your Rights

• Send your request to privacy@gooberrailroad.com.
• We may ask for information to verify your identity before fulfilling requests.
• We respond within the timeframe required by applicable law.

11.2 Advertising-Related Choices

Where required, we use consent-based mechanisms for non-essential cookies and may use conversion measurement technologies to understand whether ads lead to purchases. You can manage cookie preferences through your browser settings and/or our cookie banner.

11.3 California Residents (CPRA/CCPA Overview)

If you are a California resident, you may have additional rights such as the right to request information about categories of personal data processed, request deletion (subject to exceptions), and opt out of the sale or sharing of personal information where applicable.

11.4 GDPR/UK Privacy Rights (Overview)

If you are covered by GDPR or UK data protection laws, you may have rights including access, rectification, erasure, restriction, portability, and the right to object. Where processing is based on legitimate interests or consent, you can contact us for details.

12. Cookies and Tracking

We use essential cookies for checkout and account function, plus optional analytics and advertising cookies where legally allowed. See our Cookie Policy for details.

13. Third-Party Links

Our website may link to third-party websites. We are not responsible for the privacy practices of external services and recommend reviewing their policies separately.

14. Policy Updates

We may update this policy as our operations, technology, or legal requirements change. Material updates will be posted with a revised effective date.

15. Contact Us

For privacy requests or questions, contact:

• Email: privacy@gooberrailroad.com
• Support: support@gooberrailroad.com
• Address: Goober Railroad, 405 Market St, Suite 1200, San Francisco, CA 94105, United States