Privacy Policy

Effective date: 3 September 2026

1. Who we are

Leo’s Trading Ltd, trading as Lennie’s Toys (“Lennie’s Toys”, “we”, “us” or “our”), is the controller responsible for the personal information described in this policy.

Company number: SC674363
Registered office: 432B Lanark Road, Edinburgh, EH13 0NJ, United Kingdom
Email: callum@lenniestoys.com
Website: https://lennies.com

2. Scope of this policy

This policy explains how we collect, use, store, share and delete personal information when you:

• shop through our website;

• purchase from us through Amazon, eBay, Temu or another marketplace;

• contact our customer-service team;

• subscribe to marketing;

• use an account or other Lennie’s Toys service; or

• otherwise interact with us.

We may receive personal information directly from you or from a marketplace, payment provider, delivery company or other service involved in your order.

3. Information we collect

Depending on your interaction with us, we may process:

• your name;

• delivery and billing addresses;

• telephone number and email address;

• order references, products, quantities, prices and payment status;

• delivery, fulfilment, returns and tracking information;

• customer-service correspondence;

• marketing preferences;

• fraud-prevention and security information;

• website usage, device and cookie information; and

• other information you choose to provide.

For marketplace orders, we collect only the customer and order information made available by the marketplace and reasonably required to fulfil, deliver, support or legally record the transaction.

We do not normally receive or store complete payment-card details. Payments are processed by Shopify, marketplace platforms or their authorised payment providers under their own privacy policies.

We do not intentionally collect special-category personal information unless it is strictly necessary and legally permitted.

4. Why we process information

We use personal information to:

• process, fulfil and deliver orders;

• create delivery labels and provide tracking;

• manage returns, refunds and customer enquiries;

• maintain transaction, tax and accounting records;

• prevent fraud and protect our customers and systems;

• manage customer accounts;

• operate and improve our website and services;

• measure website and advertising performance;

• send marketing where permitted; and

• comply with legal and regulatory requirements.

Our legal bases normally include:

• Contract: processing needed to accept, fulfil, deliver or support an order.

• Legal obligation: processing and retention required for taxation, accounting, consumer protection or other legal duties.

• Legitimate interests: operating and securing our business, preventing fraud, analysing performance and improving our services, where those interests are not overridden by your rights.

• Consent: optional marketing, cookies or other processing where consent is required.

You may withdraw consent at any time where processing depends upon consent.

5. Lennie OS, automation and artificial intelligence

Lennie OS is our internal commerce, catalogue, inventory, pricing, order and fulfilment system. It may connect to Shopify, Amazon, eBay, Temu, Google services, Sendcloud and approved delivery providers.

Lennie OS may use product, inventory, pricing, sales and performance information to assist with catalogue improvements, stock management and commercial decisions.

Marketplace customer personally identifiable information is not supplied to artificial-intelligence services, used for AI model training or used to make decisions that have legal or similarly significant effects on customers.

AI-assisted product work is limited to appropriate non-customer information such as product titles, descriptions, images, catalogue details and aggregated commercial performance.

6. Who we share information with

We share only the information reasonably necessary for the relevant service. Recipients may include:

• Shopify and associated payment providers;

• Amazon, eBay, Temu and other marketplaces through which an order is placed;

• Google Cloud, which hosts Lennie OS and associated databases;

• Sendcloud for shipment and label management;

• Royal Mail, DPD, InPost and other selected delivery carriers;

• payment, fraud-prevention and security providers;

• Google Analytics, Google Ads and similar services where permitted;

• accountants, professional advisers, insurers and regulators; and

• law-enforcement bodies where disclosure is legally required.

Service providers must process information only for the agreed purpose and subject to appropriate contractual and security requirements.

We do not sell customer personal information. We do not share it for another organisation’s unrelated advertising purposes.

7. International transfers

Our Lennie OS production application and database are hosted in the United Kingdom.

Some service providers or marketplace platforms may process information outside the United Kingdom. Where UK personal information is transferred internationally, we use an appropriate lawful transfer mechanism, such as:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses; or

• another safeguard permitted by UK data-protection law.

Further information about relevant safeguards is available by contacting us.

8. Retention and deletion

We retain information only for as long as it is needed for its stated purpose or required by law.

Customer contact and delivery fields stored operationally in Lennie OS for marketplace fulfilment are deleted or anonymised when no longer needed and normally no later than 30 days after confirmed delivery.

Information may be retained longer where necessary for an active return, dispute, fraud investigation, legal claim or legal obligation. Where extended retention is legally required, we retain only the minimum information necessary and restrict its operational use.

Transaction, tax, VAT and accounting records may be retained for up to six years from the end of the relevant financial year, or longer where legally required. Relevant requirements include the Finance Act 1998, Schedule 18, paragraph 21; Companies Act 2006, section 388; and VAT Regulations 1995, regulation 31.

Security records that do not contain unnecessary customer information may be retained for a limited period to protect our services and investigate incidents.

Marketing information is retained until you unsubscribe, withdraw consent or it is no longer reasonably required. We may keep a minimal suppression record to ensure that an opt-out continues to be honoured.

9. Security

We use appropriate technical and organisational measures designed to protect personal information. These include encrypted communications, managed cloud storage, restricted access, protected credentials, security logging, backups and deletion controls.

No internet service can guarantee absolute security. If we discover a personal-data breach, we will investigate it and notify affected individuals, regulators or marketplace partners where legally or contractually required.

10. Your rights

Depending on the circumstances, UK data-protection law may give you the right to:

• request access to your personal information;

• request correction of inaccurate information;

• request deletion;

• restrict processing;

• object to processing, including direct marketing;

• request data portability;

• withdraw consent; and

• complain to the Information Commissioner’s Office.

To exercise a right, contact callum@lenniestoys.com. We may need to verify your identity before responding.

You may contact the Information Commissioner’s Office through https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

11. Marketing and cookies

We send electronic marketing only where permitted. You can unsubscribe using the link in a marketing message or by contacting us.

Our website may use essential, analytics and advertising cookies. Where required, non-essential cookies are used only after consent. You can update your cookie preferences through the controls provided on our website or browser.

12. Children

We sell toys and family products, but our purchasing and account services are intended for adults. We do not knowingly ask children to provide personal information or create orders without appropriate adult involvement.

13. Changes to this policy

We review this policy regularly and when our services, marketplace integrations or legal obligations materially change.

When we make significant changes, we will update the effective date and provide further notice where appropriate.

14. Contact us

Questions, complaints or privacy requests should be sent to:

Leo’s Trading Ltd trading as Lennie’s Toys
432B Lanark Road
Edinburgh
EH13 0NJ
United Kingdom

Email: callum@lenniestoys.com