Last updated: 1 september 2026
This Privacy Policy explains how JBF Toys & Trains Sàrl, having its registered office at 38, Rue Pilippe II, L-2340 Luxembourg, Grand Duchy of Luxembourg, registered with the Luxembourg Trade and Companies Register (RCS) under number B271654 and VAT LU34308276 (“we”, “us”, “our”), collects, uses, stores, and protects personal data.
This Policy applies to visitors and customers of:
- www.jbftoysandtrains.com
- www.jbftoysandtrains.nl
- www.jbftoysandtrains.lu
- www.jbftoysandtrains.be
- www.jbftoysandtrains.de
- www.jbftoysandtrains.fr
- www.jbftoysandtrains.co.uk
- www.jbftoysandtrains.at
- www.jbftoysandtrains.it
- www.jbftoysandtrains.es
These websites are primarily hosted on the Shopify platform and may include integrations with other market places and third parties.
1. Data Controller
The data controller within the meaning of Article 4(7) GDPR is:
JBF Toys & Trains Sàrl
38, Rue Philippe II
L-2340 Luxembourg
Grand Duchy of Luxembourg
Email: contact@jbftoysandtrains.com
2. Personal Data We Collect
We may collect and process the following categories of personal data:
2.1 Data You Provide Directly
- Name and surname
- Billing and shipping address
- Email address
- Telephone number
- Account login details
- Payment-related information (processed securely via payment providers)
- Information submitted through contact forms
- Information submitted for our Loyalty Programme (e.g., birthday, family members, interests, and preferences)
- Newsletter subscription details
- Order history
2.2 Data Collected Automatically
When you visit our website, we may automatically collect:
- IP address
- Browser type and version
- Device information
- Pages visited
- Date and time of access
- Referring website
- Interaction data
This data may be collected via cookies and similar technologies. Please refer to our Cookie Policy for details.
2.3 Analytics and Technical Data
We use the following tools to analyse website performance, improve usability, and monitor search visibility:
- Google Analytics
- Google Tag Manager
- Google Search Console
3. Purposes and Legal Basis for Processing
We process personal data only where we have a lawful basis under Article 6 GDPR.
3.1 Contractual Necessity (Article 6(1)(b) GDPR)
We process your data to:
- Process and deliver orders
- Manage payments
- Provide customer service
- Create and manage user accounts
Without this data, we cannot fulfil your orders or provide requested services.
3.2 Legal Obligations (Article 6(1)(c) GDPR)
We process data to comply with:
- Tax laws
- Accounting obligations
- Consumer protection regulations
- Regulatory reporting requirements
3.3 Legitimate Interests (Article 6(1)(f) GDPR)
We may process data to:
- Improve website functionality
- Prevent fraud
- Secure our IT systems
- Conduct internal business analysis
We ensure that our legitimate interests do not override your fundamental rights and freedoms.
3.4 Consent (Article 6(1)(a) GDPR)
We rely on your explicit consent for:
- Newsletter subscriptions
- Marketing communications
- Non-essential cookies
- Personalised advertising
- Loyalty Programme communications
You may withdraw your consent at any time.
4. Marketing Communications
If you subscribe to our newsletter or Loyalty Programme, we may send you:
- Promotions and special offers
- Product updates
- Company news
- Rewards notifications (Loyalty Programme points and benefits)
You may unsubscribe or adjust your preferences at any time via the links included in each email or by contacting us directly.
We do not send marketing communications without prior consent unless legally permitted.
5. Loyalty Programme
Our Loyalty Programme allows registered customers to collect points, receive rewards, and access personalised offers based on purchase history, preferences, and interactions with our website.
5.1 Data Collected
- Account information
- Purchase history and points balance
- Birthday, family members, and interests
- Interaction with campaigns and promotional content
5.2 Purposes
We use this data to:
- Allocate points and rewards
- Provide targeted promotions
- Personalise marketing offers
- Improve our products and services
5.3 Legal Basis
- Contractual necessity (Article 6(1)(b) GDPR) – where participation forms part of your account agreement
- Consent (Article 6(1)(a) GDPR) – for personalised marketing and profiling
5.4 Third-Party Providers
The Loyalty Programme is operated via Joy, a third-party Shopify app. Providers will act as data processors under Article 28 GDPR. Any international transfers will comply with Chapter V GDPR using SCCs or other safeguards. The provider’s name will be published once selected.
5.5 Automated Decision-Making
Our Loyalty Programme does not involve automated decisions producing legal or similarly significant effects. If this changes, we will update this Policy.
6. Data Sharing and Recipients
We may share personal data with trusted third parties, including:
- Hosting providers
- Payment service providers
- Shipping and logistics partners
- IT and technical service providers
- Marketing and analytics service providers
Where required, we enter into Data Processing Agreements (DPAs) in accordance with Article 28 GDPR.
We do not sell personal data to third parties.
7. International Data Transfers
Some service providers (e.g., Google) may process data outside the European Economic Area (EEA).
We ensure appropriate safeguards under Chapter V GDPR, including:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions
- Supplementary technical measures
8. Data Retention
We retain personal data only for as long as necessary:
- Order and invoicing data: in accordance with Luxembourg accounting laws
- Customer account data: while the account is active
- Marketing and Loyalty Programme data: until consent is withdrawn
- Analytics data: as per configured retention periods
After these periods, data is securely deleted or anonymised.
9. Data Security
We implement technical and organisational measures to protect personal data against:
- Unauthorised access
- Loss or destruction
- Alteration
- Disclosure
This includes secure hosting, encrypted connections (SSL), restricted access, and regular security monitoring.
10. Your Rights Under the GDPR
You have the following rights:
- Right of access (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to erasure (Article 17 GDPR)
- Right to restrict processing (Article 18 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to object (Article 21 GDPR)
- Right to withdraw consent at any time (Article 7(3) GDPR)
To exercise your rights, contact us at contact@jbftoysandtrains.com.
11. Right to Lodge a Complaint
If you believe your personal data is being processed unlawfully, you may lodge a complaint with:
Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Grand Duchy of Luxembourg
Website: https://cnpd.public.lu
12. Children’s Data
Our website is not intended for children under 16. We do not knowingly collect personal data from minors without parental consent.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The most recent version will always be published on our website with the updated date. Continued use of the website after changes constitutes acknowledgement of the updated Policy.