Privacy Policy

1. Introduction

Welcome to Kalotoys. We respect your privacy and are committed to protecting your Personal Identifiable Information (PII). This Privacy Policy applies to our website (kalotoys.com), our direct retail operations, and our data integrations with third-party e-commerce platforms and marketplaces (e.g., TikTok Shop, Amazon, Etsy, Shopify). It explains how we collect, use, and safeguard your data.

2. Information We Collect

Depending on how you interact with Kalotoys, we may collect the following information:

• Direct Purchases: When you buy directly from our website, we collect your name, email, shipping/billing address, phone number, and secure payment details.
• Third-Party Marketplace Integrations: If you purchase our products through a partner marketplace or platform (such as TikTok Shop, Amazon, Etsy, or Shopify), we retrieve necessary order details (Name, Address, Phone Number, Order ID) via secure API integrations solely to fulfill your order.
• Automated Data: As you browse our website, we automatically collect basic technical data, such as your IP address, browser type, and interaction metrics using cookies, to improve user experience.

3. How We Use Your Information

We use your information for the following purposes:

• To process transactions, fulfill orders, and coordinate shipping with carriers.
• To provide customer support and handle returns or inquiries.
• To synchronize order data internally using our secure Data Orchestration systems.
• To send order updates and, only with your explicit consent, promotional materials.

Specific to API Integrations: Data retrieved from third-party platforms (including TikTok Shop, Amazon, Etsy, and Shopify) is used strictly for fulfillment, shipping, and internal inventory management. We absolutely do not use API-sourced PII for external marketing, nor do we sell or rent it to data brokers.

4. Data Storage and Security

Kalotoys implements enterprise-grade security to protect your data:

• Encryption: Data is encrypted in-transit (TLS 1.2+) and at-rest (AES-256).
• Network Security: Our backend processing systems operate within isolated Virtual Private Networks (VPNs) with restricted access.
• Access Control: We use Role-Based Access Control (RBAC) to ensure only authorized personnel can handle sensitive data.
• Localization: Customer data is processed and stored securely within the United States.

5. Sharing Your Information

We do not sell your personal data. We only share necessary information with trusted service providers, such as payment processors (e.g., Stripe, PayPal) and shipping carriers (e.g., USPS, UPS, FedEx) to complete your order. We may also disclose information if required by law.

6. Data Retention and User Rights

We retain your data only for as long as necessary to provide our services and comply with tax and legal obligations. Depending on your location (e.g., under the CCPA in California), you have the right to:

• Know what personal data we collect about you.
• Request the deletion of your personal data.
• Opt-out of marketing communications at any time.