Privacy Policy

Last updated: 27 July 2026

Tomi Legacy respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you visit our online store, place an order, contact us or otherwise interact with our services.

1. Data Controller and Contact Details

Trading name: Tomi Legacy
Business address: Spyrou Kyprianou Avenue 14, Office 1, 3070 Lemesos, Cyprus
Email: support@tomilegacy.com

2. Personal Data We Collect

Depending on how you use our store, we may collect:

• Your name and surname;
• Email address and telephone number;
• Billing and delivery addresses;
• Order history and transaction information;
• Payment status and payment-related information;
• Account and login information;
• Customer-support communications;
• Reviews, photographs and other content submitted by you;
• IP address, browser type, device type and operating system;
• Pages viewed, referring pages and website activity;
• Approximate location information;
• Marketing and cookie preferences;
• Fraud-prevention and security information.

Full payment-card details are generally processed directly by our payment providers and are not stored by Tomi Legacy.

3. How We Use Personal Data

We may use your personal data to:

• Process, confirm and deliver orders;
• Process payments, cancellations, returns and refunds;
• Communicate with you regarding your order;
• Provide customer support;
• Verify identity, payment or delivery information;
• Prevent fraud, abuse and security incidents;
• Comply with tax, accounting and legal obligations;
• Improve our products, website and customer experience;
• Analyse website performance;
• Send marketing communications where permitted;
• Provide personalised advertising where legally allowed.

4. Legal Bases for Processing

Where applicable, we rely on:

• Performance of a contract to process orders, deliveries, returns and refunds;
• Legal obligations to comply with tax, accounting and consumer-protection requirements;
• Legitimate interests to operate and improve our business, prevent fraud and provide support;
• Consent for marketing, analytics and advertising technologies where required;
• Legal claims to establish, exercise or defend our rights.

5. Shopify and Service Providers

Our online store is hosted on Shopify. Shopify may process personal data to provide the e-commerce platform and related services.

We may also share personal data with service providers that assist with:

• Payment processing;
• Order fulfilment;
• Shipping and delivery;
• Fraud prevention;
• Customer support;
• Email and SMS communications;
• Analytics;
• Advertising and marketing;
• Accounting, legal and professional services.

6. Sale or Sharing of Personal Data

We do not sell personal data for money.

However, certain disclosures involving advertising technologies may be considered a sale, sharing or targeted advertising under some privacy laws. Where applicable, you may opt out through our cookie preference tool or by contacting us.

7. International Data Transfers

Your personal data may be processed outside your country of residence.

Where required, we use legally recognised safeguards, such as adequacy decisions, standard contractual clauses or other approved transfer mechanisms.

8. Data Retention

We retain personal data only for as long as reasonably necessary to:

• Fulfil orders;
• Maintain accounting and tax records;
• Resolve disputes;
• Prevent fraud;
• Enforce agreements;
• Comply with legal obligations.

When information is no longer required, we delete or anonymise it where reasonably possible.

9. Cookies and Similar Technologies

Necessary cookies may be used to operate the store, maintain your shopping cart, process checkout, protect against fraud and remember privacy preferences.

With your consent, we may also use cookies for analytics, personalisation, advertising and campaign measurement.

Where consent is legally required, non-essential cookies should not be activated before you provide consent.

10. Marketing Communications

You may unsubscribe from marketing emails at any time by using the unsubscribe link in the message or by contacting support@tomilegacy.com.

Unsubscribing from marketing does not prevent us from sending order confirmations, security notices or other necessary service communications.

11. Your Privacy Rights

Depending on your location, you may have the right to:

• Access your personal data;
• Correct inaccurate information;
• Request deletion;
• Restrict processing;
• Object to certain processing;
• Request data portability;
• Withdraw consent;
• Opt out of targeted advertising, sale or sharing;
• Complain to a data-protection authority.

To exercise a privacy right, contact support@tomilegacy.com. We may need to verify your identity.

12. Children’s Privacy

Our store is not directed to children. We do not knowingly collect personal data from children below the age at which they may legally consent under applicable law.

13. Data Security

We use reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, loss, alteration, misuse or disclosure.

No internet transmission or electronic storage method is completely secure.

14. Automated Decision-Making

We and our service providers may use automated tools to identify fraud, payment risks or security threats.

Where applicable law provides rights concerning automated decisions, you may contact us to request information or human review.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal, technical, operational or business changes.

16. Contact Us

Tomi Legacy
Spyrou Kyprianou Avenue 14, Office 1
3070 Lemesos
Cyprus
support@tomilegacy.com