- We collect only what we need to make, send and support your order.
- Card details go straight to Stripe. We never see or store your card number.
- We don't sell your personal data, and we don't use the names you personalise for marketing.
- Analytics and advertising cookies are only used if you say yes, and you can change your mind at any time.
- You can ask to see, correct, download or delete your data by emailing togblocks@outlook.com.
Contents
- Who we are
- What we collect and why
- Children's names
- Cookies and similar technologies
- Who we share data with
- International transfers
- How long we keep data
- Security
- Your rights (EU, EEA and UK)
- California and other US states
- Canada, Australia and elsewhere
- Changes and contact
1. Who we are
The data controller for this website and your orders is TógBlocks, Co. Kildare, Ireland ("TógBlocks", "we", "us"). We design and 3D print personalised brick letters and door signs.
For anything about your personal data, email togblocks@outlook.com. We're a small business and haven't appointed a Data Protection Officer, as the law doesn't require one for us; your email reaches the people who handle your data.
2. What we collect and why
| What | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Order details: your name, delivery address, email, and what you ordered | To make your order, deliver it, and email you confirmations and dispatch updates | Contract (Art. 6(1)(b)) |
| Personalisation: the name or text you build, your colours, size, add-ons, and a picture of your design captured from the 3D preview | To print exactly what you designed and to show it in your order confirmation, order page and gift card | Contract |
| Payment: processed by Stripe; we receive the payment status and a payment reference | To take payment and handle refunds. We never receive your full card number | Contract; legal obligation (accounting records) |
| Account (optional): email, name and a securely hashed password, or, if you sign in with Google, your name, email and profile picture | To let you sign in, see your orders and keep your basket between devices | Contract |
| Messages: emails you send us and our replies | To answer questions and support your order | Contract; legitimate interests (customer service) |
| Review request: one email after delivery asking how we did | To hear from customers and improve. Reply "no reviews" and we won't ask again | Legitimate interests (Art. 6(1)(f)) |
| Reviews (optional): your rating, text, display name, town and an optional photo | To publish your review on our website after we check it | Consent (Art. 6(1)(a)); you can ask us to remove it at any time |
| Technical data: your IP address, held in memory for up to 10 minutes | To stop abuse of the image upload used by the 3D preview. We don't keep web server access logs | Legitimate interests (security) |
| Analytics and advertising (optional): pages viewed, basket and purchase events, device and browser details | To see which pages and ads bring people to the shop | Consent only; see Cookies |
We don't make decisions about you based solely on automated processing, and we don't build profiles of you.
3. Children's names
Our products are often gifts for children, so the names you personalise may belong to a child. We use them only to make, ship and support that order. They never go into marketing, and order pictures are stored under random, unguessable links that search engines are told not to index.
The website is for adults placing orders. We don't knowingly collect personal data directly from anyone under 16. If you believe a child has given us their data, email us and we'll delete it.
4. Cookies and similar technologies
We use a few strictly necessary cookies and browser storage items so the shop works. These don't need your consent. Analytics and advertising cookies are only set after you click Accept on our cookie banner. We use Google's Consent Mode: until you accept, Google Analytics sets no cookies and only receives basic, cookie-free signals (for example, that a page was viewed, with your browser type), which Google can't use to identify or follow you and which we only see as anonymous totals. You can change your choice at any time from (also in the footer). If your browser sends a Global Privacy Control signal, we treat it as a "no" to analytics and advertising.
| Name | Provider | Purpose | Kept for |
|---|---|---|---|
tb_session (cookie) | TógBlocks | Keeps you signed in. Strictly necessary | 30 days, or until you sign out |
oauth_state (cookie) | TógBlocks | Protects Google sign-in against forgery. Strictly necessary | 10 minutes |
togblocks_cart (local storage) | TógBlocks | Remembers your basket. Strictly necessary | Until checkout or you clear it |
togblocks_vibe (local storage) | TógBlocks | Remembers the site colour style you picked | Until you clear it |
tb_consent (local storage) | TógBlocks | Remembers your cookie choice | Until you clear it |
__stripe_mid, __stripe_sid | Stripe | Fraud prevention during payment. Set on the checkout page only. Strictly necessary | 1 year / 30 minutes |
_ga, _ga_* | Google Analytics | Counting visits and purchases. Only with your consent | Up to 2 years |
_fbp | Meta (Facebook, Instagram) | Measuring our ads. Only with your consent | 3 months |
Our fonts are hosted on our own server, so loading a page doesn't contact Google Fonts or other font services.
5. Who we share data with
We don't sell your personal data. We share it only with the companies that help us run the shop, each under a contract that limits how they can use it:
- Stripe (Stripe Payments Europe Ltd, Ireland): card, Apple Pay and Google Pay payments, and fraud prevention.
- Hetzner Online GmbH (Germany): hosts our website and database in a data centre in Germany.
- Microsoft (Outlook): sends our order emails and holds our customer-service mailbox.
- Google: only if you choose "Sign in with Google", and Google Analytics only with your consent.
- Meta Platforms: only with your consent, to measure our ads.
- Delivery companies (such as An Post, DHL or UPS): your name and address to deliver your parcel.
- Authorities and advisers: when the law requires it, for example tax records, or to protect our legal rights.
6. International transfers
We keep our own systems in the EU. Some providers above (Stripe, Microsoft, Google and Meta) may process data in the United States or other countries. Where that happens, the transfer is protected by the EU–US Data Privacy Framework (and its UK extension) where the company is certified, or by the European Commission's Standard Contractual Clauses.
7. How long we keep data
| Data | How long |
|---|---|
| Orders, invoices and payment records | 6 years after the order, as Irish tax law requires |
| Design pictures attached to an order | As long as the order record |
| Design pictures never used in an order | Deleted automatically after 30 days |
| Your account and saved basket | Until you ask us to delete your account |
| Sign-in sessions | 30 days, or until you sign out |
| Customer-service emails | Up to 2 years after your last message |
| Published reviews | Until you ask us to remove them |
8. Security
The whole site uses HTTPS. Passwords are stored only as secure hashes, payment details stay with Stripe, and only the people who run TógBlocks can access order data. No system is perfectly secure, but if a breach affected your data we would tell you and the Data Protection Commission as the law requires.
9. Your rights (EU, EEA and UK)
Under the GDPR and the UK GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct anything that's wrong or incomplete;
- delete your data, unless we must keep it, for example tax records;
- restrict or object to how we use it, including our legitimate-interest uses;
- data portability: receive your data in a common, machine-readable format;
- withdraw consent at any time, for cookies or reviews, without affecting what happened before.
Email togblocks@outlook.com. It's free, and we'll reply within one month. We may ask you to confirm your identity first. You can also complain to the Data Protection Commission in Ireland, the supervisory authority where you live in the EU/EEA, or, in the UK, the Information Commissioner's Office. We'd appreciate the chance to sort it out with you first.
10. California and other US states
If you live in California or another US state with a privacy law (such as Colorado, Connecticut, Virginia or Texas), you have the right to know what personal information we collect and how we use it, and to ask us to access, correct or delete it. The categories we collect, their sources and purposes are listed in section 2, and who receives them in section 5.
We do not sell personal information, and we don't knowingly sell or share the data of anyone under 16. If you accept advertising cookies, using the Meta pixel may count as "sharing" for cross-context behavioural advertising under California law. You can opt out at any time by rejecting those cookies in , and we honour Global Privacy Control signals as an opt-out. We don't use sensitive personal information beyond what's needed to fulfil orders, and we won't treat you differently for using your rights. You can use an authorised agent; we'll need to verify the request.
11. Canada, Australia and elsewhere
Wherever you live, you can ask to access or correct your personal information, or withdraw consent, by emailing us. We apply the same protections described here to every customer. In Canada you can also contact the Office of the Privacy Commissioner of Canada, and in Australia the Office of the Australian Information Commissioner.
12. Changes and contact
If we change this policy, we'll update the date at the top, and tell customers directly about any significant change. Questions? Email togblocks@outlook.com or visit our contact page. See also our Terms of Sale.