Last updated 9 October 2026

This policy explains what personal data Toddler Ride on Toys (https://toddlerrideontoys.net) processes, why, and what rights you have. We keep it short and specific; every section names the actual tool involved.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

Thorsten Meyer, trading as “Toddler Ride on Toys”
Blombergstrasse 11 C
82393 Iffeldorf
Germany
Email: contact@toddlerrideontoys.net

There is no obligation to appoint a data protection officer; all requests go to the address above.

2. What we do — and do not — do

You can read this site without giving us any personal data. We measure how the site is used with two tools we operate ourselves on servers in Germany (sections 5 and 6), we earn commissions from affiliate links (section 9), and we offer an optional newsletter (section 10). We do not sell personal data, we do not build advertising profiles, and we do not track you across other websites.

3. Hosting and server logs

This site is hosted by ALL-INKL.COM – Neue Medien Münnich GmbH, Hauptstraße 68, 02742 Friedersdorf, Germany. When you open a page, the web server records the requested address, date and time, HTTP status, the referring page, your browser’s user agent and your IP address in its access log. This is necessary to deliver the site, keep it secure and diagnose faults (Art. 6(1)(f) GDPR). Logs are kept by the provider for a limited period and then deleted. A data-processing agreement with the provider is in place.

Requests to the analytics services in sections 5 and 6 pass through Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which routes traffic to our servers and provides DDoS protection. Cloudflare processes connection data (including your IP address) in transit on our behalf under a data-processing agreement; transfers to the USA are covered by the EU–US Data Privacy Framework and standard contractual clauses.

This site sets only the cookies listed here. When you first visit, a consent banner (CookieYes, running on this site — no data is sent to CookieYes) asks which optional categories you allow. Your choice is stored in a cookie named cookieyes-consent for up to one year so we do not ask again.

Cookie Set by Purpose Lifetime Category
cookieyes-consent consent banner remembers your choice 12 months necessary
wordpress_*, wp-settings-* WordPress only when you log in or comment session / 12 months necessary
gf_camp_seen_<id> Grimfaste only if this site runs on-site campaigns: counts how often you have seen a particular banner so it is not shown too often; contains a number, no identifier up to 7 days (per campaign) functional
IDE, __gads, __gpi, test_cookie Google AdSense ad personalisation and measurement up to 13 months advertising (consent)

Our own analytics (sections 5 and 6) do not use cookies. Third parties may set cookies only after you click through to them (section 9) or after you consent to embedded content (section 12).

5. Grimfaste Analytics

Applies to every site that runs the Grimfaste Tracker plugin.

Grimfaste is analytics and publishing software we operate ourselves. Its tracker collects, for each page you view:

  • the page address and title, and the page you came from (referrer);
  • your browser’s user agent (browser and operating system family, device type);
  • your country, derived by our network provider from your IP address at the moment of the request — the IP address itself is not stored;
  • how far you scrolled and how long the page stayed open;
  • clicks on outbound and affiliate links, and impressions and clicks of product boxes shown on the page;
  • a random session identifier that lives in your browser’s sessionStorage and disappears when you close the tab or browser. It is not a cookie and cannot recognise you on a later visit.

The data is sent to our own server in Germany and is deleted after 90 days; only aggregated statistics are kept longer. We use it to see which content is read, where readers come from and which product recommendations are useful (Art. 6(1)(f) GDPR — legitimate interest in running and improving this site). It is not combined with any data that could identify you by name, and it is not shared with anyone.

6. Grynlume web analytics

Applies to sites where Grynlume is switched on.

Grynlume is a self-hosted analytics tool we operate on our own server in Germany. It counts visits, pages, sources, devices and goals without cookies and without storing anything in your browser.

When you open a page, your browser sends the page address, the referring page, your browser type and screen size, and your IP address to that server. The IP address and browser type are combined with a random secret that changes every day and are stored only as a hash; the raw IP address is never written to disk, and yesterday’s secret is destroyed, so you cannot be recognised from one day to the next or across other websites.

Events such as a click on an outbound link, a file download, a page that was not found, or the variant of a page element that was shown to you (used to compare two versions of the same element) are sent the same way.

Grynlume also records the language your browser prefers. Only the primary language code is kept, such as “de” or “en”, taken from the Accept-Language header your browser sends with every request; it is not used to recognise you. When you use this website’s search function, the search term is counted. A search term is stored only as a daily count for this website, without any visitor identifier, session or time of day. Terms that contain an @ sign, a web address or a sequence of four or more digits are discarded before they are stored, and only terms searched at least five times are displayed.

To keep automated traffic out of the statistics, user-agent strings and the host names of referring websites are sent to TypeSafe (typesafe.ai), whose service classifies them. No IP address and no identifier is sent with them.

Statistics are kept 14 months (at the latest until the end of the following calendar month), aggregates indefinitely. Legal basis: Art. 6(1)(f) GDPR. You may object at any time by writing to contact@toddlerrideontoys.net.

7. Google AdSense

Applies to sites that show Google AdSense advertising.

This site shows advertising delivered by Google AdSense (Google Ireland Limited, address above). Publisher: ca-pub-9594148017784900. The tag is loaded when you open a page, before you interact with the cookie banner; you can object at any time by declining the corresponding category in the banner, which stops the tag on subsequent page loads. When an ad is displayed, Google receives your IP address, the page you are viewing and information about your browser, and Google and its advertising partners may set cookies such as IDE, __gads, __gpi and test_cookie (up to 13 months) to show ads that match your interests and to measure their performance. With your consent, ads are personalised on the basis of a profile Google builds across websites; without consent, only non-personalised ads are shown, which still use your IP address and coarse location. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG; for non-personalised ads Art. 6(1)(f) GDPR — financing this site. You can withdraw consent in the cookie banner and manage ad personalisation at adssettings.google.com. The advertising partners Google works with are listed at business.safety.google/adsservices. Google’s privacy policy: policies.google.com/privacy.

8. Meta (Facebook) social plugins

Applies to sites that load the Meta JavaScript SDK for share buttons or embedded posts.

This site loads the JavaScript SDK of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Meta”) to render Facebook share buttons and embedded posts. The tag is loaded when you open a page, before you interact with the cookie banner; you can object at any time by declining the corresponding category in the banner, which stops the tag on subsequent page loads. When the SDK is loaded, Meta receives your IP address, the page you are viewing and technical browser data, and, if you are logged in to Facebook, Meta can link the visit to your account. We do not run the Meta Pixel and do not receive personal data from Meta. Meta may transfer data to Meta Platforms, Inc. in the USA under the EU–US Data Privacy Framework. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, where the banner asks for it; otherwise Art. 6(1)(f) GDPR — offering share functions — and you may object at any time by writing to contact@toddlerrideontoys.net or by blocking connect.facebook.net in your browser. Meta’s privacy policy: facebook.com/privacy/policy.

Applies to every site that recommends products.

This site takes part in the Amazon Associates Programme and may take part in other affiliate programmes. Links marked as affiliate links, and the product boxes we show, lead to the retailer’s site; if you buy something there, we may receive a commission at no extra cost to you. See our Affiliate Disclosure for details.

Product boxes show images, prices and availability that we retrieve from Amazon and cache on our server. Product images are loaded from Amazon’s servers when the page is displayed, so Amazon (Amazon Europe Core S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg) receives your IP address and the page you are viewing at that moment. Once you click through to a retailer, that retailer’s privacy policy applies, and it may set cookies to attribute a purchase to this site. We count clicks on these links in aggregate (section 5); we do not learn what you buy.

10. Newsletter and email capture

Applies only where a sign-up form is shown.

If you enter your email address in a sign-up form, we store it together with the date and time and the page on which you signed up, on our own server in Germany, and send you a confirmation email. Your subscription becomes active only after you confirm it (double opt-in). We use the address solely to send the newsletter you asked for (Art. 6(1)(a) GDPR — consent). You can unsubscribe at any time using the link in every email or by writing to contact@toddlerrideontoys.net; we then delete the address, keeping only a record of the withdrawal.

11. Comments

Applies only if comments are enabled.

If you comment, WordPress stores your name, email address, the comment and the IP address at the time of posting, to publish the comment and to defend against abuse (Art. 6(1)(f) GDPR). Your email address is not published. Comments stay online until you ask for their removal.

12. Embedded content from other providers

Some pages embed content from other providers, such as YouTube videos or social-media posts. These embeds are loaded only after you consent to the corresponding category in the banner. Once loaded, the provider receives your IP address and may set its own cookies; its privacy policy applies. Providers that may appear on this site: YouTube (Google Ireland Ltd.), Instagram and Facebook (Meta Platforms Ireland Ltd.), X (X Corp.), Pinterest (Pinterest Europe Ltd.).

13. Contact

If you write to us, we keep your message and address for as long as needed to answer it and to document the correspondence (Art. 6(1)(b) and (f) GDPR). We do not add you to any list.

  • Delivering and securing the site, server logs, our own analytics, affiliate measurement, comments: Art. 6(1)(f) GDPR — legitimate interest in operating, improving and financing this site.
  • Newsletter and optional embeds: Art. 6(1)(a) GDPR — your consent, which you may withdraw at any time with effect for the future.
  • Answering enquiries: Art. 6(1)(b) and (f) GDPR.

15. How long we keep data

Server logs: the provider’s short retention period. Grimfaste analytics rows: 90 days. Grynlume statistics: 14 months (at the latest until the end of the following calendar month). Newsletter address: until you unsubscribe. Comments: until removal is requested. Correspondence: as long as needed to handle it, plus statutory retention periods where they apply.

16. Who receives data

Our hosting provider and Cloudflare act as processors under data-processing agreements. Amazon and other retailers receive data only through your own click or through product images, as described in section 9. We do not pass personal data to anyone else unless the law requires it.

17. Your rights

You have the right to access the personal data we hold about you, to have it rectified or erased, to restrict or object to its processing, and to data portability (Art. 15–21 GDPR). Where processing is based on consent, you may withdraw it at any time. To exercise these rights, write to contact@toddlerrideontoys.net.

You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).

18. No automated decisions

We make no decisions about you by automated means and do no profiling in the sense of Art. 22 GDPR.

19. Changes

We update this policy when the site or the law changes. The date at the top tells you when it was last revised.