Privacy Policy

This privacy policy explains how Sofia Monaco Werk EOOD processes personal data when you visit toy.cars, contact us, register for an event or, once enabled, use the TOY online shop. Personal data means any information relating to an identified or identifiable person.

1. Controller and contact details

The controller is Sofia Monaco Werk EOOD, Str. 5010 No. 1, 1528 Sofia, Bulgaria, represented by its Managing Director Nikolay Dobrev. You can contact us at info@toy.cars or by phone at +49 151 14456600.

2. Website access and hosting

When you access this website, technical data is processed automatically. This may include your IP address, the date and time of the request, the requested page, referrer, browser and device information, and response or error data. We process this information to deliver the website, maintain its security and stability, and diagnose technical problems. The legal basis is our legitimate interest in operating a secure and reliable website under Article 6(1)(f) GDPR.

The website is operated on server infrastructure managed through Dokploy. Our server and infrastructure providers may process technical data on our behalf. Where data is processed outside the European Economic Area, we use an applicable adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses. Technical log data is retained only for as long as required for security, troubleshooting and legal obligations.

3. Local storage and cookie choices

We use strictly necessary cookies and browser storage for secure sign-in, preview access, shopping functions and remembering your privacy choices. This information is stored on your device where applicable. Optional analytics and external media are disabled until you choose to allow them. You can reject optional technologies or change your choice through the cookie controls. The legal basis for optional processing is your consent under Article 6(1)(a) GDPR. Withdrawing consent does not affect processing carried out before the withdrawal.

4. Privacy-friendly website analytics

We use a self-hosted instance of Umami to understand how the website is used and which content or actions are most relevant. Umami records aggregated information such as the visited page, referrer, approximate country, device, browser and selected interactions. To distinguish visits without cookies, the visitor's IP address is used transiently together with browser information to create a rotating pseudonymous identifier; the raw IP address is not stored by Umami. If you are signed in and have allowed analytics, a one-way pseudonymous identifier derived from your internal account ID links sessions across devices. We do not send your account ID, name or email address to Umami. The analytics service does not track visitors across websites and does not receive access codes or vehicle details. Analytics data is stored on infrastructure controlled by us and is processed with your consent under Article 6(1)(a) GDPR. The tracker respects your browser's Do Not Track setting.

5. Instagram content

The homepage can display embedded posts from Instagram, a service of Meta Platforms. These embeds are not loaded until you allow external media. Once loaded, your IP address, device and browser information and information about your interaction with the post may be transmitted to Meta. If you are logged into Instagram, Meta may associate the visit with your account. Meta may process data outside the European Economic Area. The legal basis is your consent under Article 6(1)(a) GDPR. For details about Meta's own processing, please refer to Instagram's privacy information.

6. Contact enquiries

If you contact us by email or telephone, we process the information you provide, such as your name, contact details and the content of your enquiry, in order to respond. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract or steps before entering into a contract, and otherwise our legitimate interest in answering enquiries under Article 6(1)(f) GDPR. We retain correspondence for as long as necessary to deal with the enquiry and any related legal obligations.

7. Event access and RSVP

For invitation-only TOY events, we may process an access code, your name, attendance status, email address and vehicle information. We use this data to verify access, administer the guest list, organize the event and send confirmations or relevant event information. The legal basis is Article 6(1)(b) GDPR and our legitimate interest in securely organizing the event under Article 6(1)(f) GDPR. RSVP data is stored only for as long as needed for event administration, follow-up and applicable record-keeping obligations. Email delivery and database providers may process this data on our behalf.

8. Online shop

The online shop is currently displayed as opening soon. If the shop is activated, it will use Shopify to provide product, cart and checkout functions. Data needed to process an order, such as contact, delivery, payment and order information, will be processed to perform the contract under Article 6(1)(b) GDPR and to comply with legal obligations under Article 6(1)(c) GDPR. Shopify and the payment or delivery providers selected at checkout may receive the data required to provide their services. Additional shop details will be shown before an order can be placed.

9. Recipients and international transfers

We disclose personal data only where necessary to operate the website and provide the requested service, where we are legally required to do so, or where you have consented. Recipients may include hosting and IT providers, database and email providers, Meta for embedded Instagram content, and Shopify and checkout providers once the shop is enabled. Where a recipient processes data outside the European Economic Area, we rely on an applicable adequacy decision or appropriate safeguards, unless another lawful transfer mechanism applies. You may contact us for more information about those safeguards.

10. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected. We may retain certain information for longer where required by tax, commercial or other law, or where needed to establish, exercise or defend legal claims. When data is no longer required, it is deleted or anonymized.

11. Your rights

Subject to the conditions of the GDPR, you have the right to request access to and a copy of your personal data, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority in Bulgaria is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, email kzld@cpdp.bg, website cpdp.bg. You may also contact the supervisory authority responsible for your place of residence or work.

12. Automated decision-making

We do not use personal data collected through this website for decisions based solely on automated processing that produce legal or similarly significant effects.

13. Changes to this policy

We may update this privacy policy when our website, services or legal requirements change. The current version is published on this page. Last updated: 3 September 2026.