At HK, we are committed to protecting your personal data and your right to privacy. This policy explains what information we collect, how we use it, and your rights.

1. Data Controller
The data controller is HK Toys SL ("HK"), with registered office in Barcelona, Spain. For any privacy-related inquiries, please contact: privacy@hk-toys.com.

2. Information We Collect
We collect information you provide directly:

• Identifiers: Name, shipping/billing address, email address, phone number.

• Commercial Information: Order history, purchased products, preferences.

• Payment Information: Processed securely by our payment partners (e.g., Stripe, PayPal). We do not store full credit card numbers.

• Technical Data: Collected automatically via cookies: IP address, browser type, device information, and pages visited (see our Cookie Policy for details).

3. How We Use Your Information
We use your data for specific, legitimate purposes:

• To process and fulfill your orders, including shipping and customer service.

• To communicate with you about your order (confirmations, updates, recalls).

• To comply with legal obligations (e.g., invoicing).

• With your explicit consent, to send you our newsletter about new products and stories.

• To improve our Site and user experience (via anonymized, aggregated data).

4. Legal Basis for Processing (GDPR)
Our processing is based on:

• Contract: Processing your order.

• Legal Obligation: Complying with tax and commercial law.

• Legitimate Interest: Improving our website security and functionality.

• Consent: Sending marketing communications. You can withdraw consent at any time.

5. Data Sharing & Transfers
We do not sell your personal data.
We share it only with trusted third parties who provide essential services under strict contracts:

• Payment Processors (Stripe, PayPal)

• Shipping Carriers (DHL, Correos)

• Website Hosting & Analytics Providers (e.g., Google Analytics, with anonymized IP)
  All partners are either within the EU or adhere to EU-approved data protection frameworks.

6. Data Retention
We retain your personal data only as long as necessary:

• Order and invoice data: Retained for 6 years to comply with tax law.

• Customer service communications: Retained for 3 years.

• Marketing consent: Retained until you unsubscribe.
  After these periods, data is securely deleted or anonymized.

7. Your Rights
Under the GDPR, you have the right to:

• Access the personal data we hold about you.

• Rectify inaccurate data.

• Request deletion of your data ("right to be forgotten").

• Restrict or object to our processing.

• Data portability.

• Withdraw consent for marketing.
  To exercise these rights, contact us at privacy@hk-toys.com. We will respond within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Changes to This Policy
We may update this policy periodically. The "Last Updated" date at the top will indicate changes. Material changes will be communicated to you via email or a notice on our Site.