Legal
Privacy policy
This site collects one thing: what you type into the request form. There is no analytics, no tracking and nothing loaded from anybody else's server.
Controller and contact
This site is operated under the name ESCATOYS by the team that develops the range described on it, and that team is the controller for the processing set out below.
Write to support@esca.toys for anything concerning your data, including the requests listed under your rights below. The request form on this site reaches the same people.
What is collected
- Your name and email address, so a person can reply.
- Your country, because the rules that apply to most of this range are set nationally.
- Which part of the range you are asking about, if you pick one.
- Your message, if you write one.
- Whether you ticked the consent box, and the moment you sent the form.
- The language the page was showing.
That is the whole of it. The consent box is never ticked for you, and the moment it was ticked is recorded by the server rather than taken from your browser.
Purpose and legal basis
Your details are used to answer your request, and for nothing else. The legal basis is your consent under Article 6(1)(a) of the General Data Protection Regulation, given by ticking the box on the form. You may withdraw it at any time; withdrawal does not affect the lawfulness of what was done before it.
Your details are not used for a newsletter, not used for advertising and not used to build a profile of you.
Whether you have to provide it
You do not. Nothing on this site requires you to identify yourself, and every page can be read without sending anything. Name, email address and country are required by the form itself, because without them a reply cannot be written or scoped to the rules of your country; the message and the subject are optional.
Who else receives it
Nobody. Your request is stored on the server this site runs on and is read by the people who answer it. It is not passed to a marketing platform, a help-desk product, an advertising network or a spreadsheet in somebody's cloud drive, because none of those is connected to anything here. Your details are disclosed to a public authority only where the law obliges us to disclose them.
Transfers outside the European Economic Area
None. Your request is not transferred to a country outside the EEA and is not accessible from one.
How long it is kept
Twenty-four months from the day you send the form, after which the request and your details in it are deleted. The period is long enough to pick a conversation back up and short enough to be justifiable. Ask for deletion sooner and it is deleted sooner — that request is answered whatever stage the correspondence is at.
Cookies
Three, all set by this site, none of them used to follow you and none of them shared. All three are necessary for a function you asked for, which is why you are not asked to accept anything on arrival.
- A security token, so the request form cannot be submitted from somebody else's page on your behalf.
- Your light or dark choice, written only when you press the toggle and kept for a year. Clearing it puts the site back on whatever your device asks for.
- A note that you have dismissed the notice at the foot of the page, kept for a year, so that it is not shown to you again.
No third-party content
There is no analytics package, no tracking pixel, no advertising tag and no social button on this site. The fonts are served from here rather than from a font service. No page makes a request to any other server at all, so no other operator is told which pages you opened or what your address is.
Keeping the form usable
The form accepts a limited number of submissions an hour from one address. To count them without keeping the address, it is combined with a secret held on the server and turned into a fingerprint that cannot be turned back. The fingerprint is held in memory for an hour and is never written to the database. Your address itself is not stored.
The form also carries a field hidden from you and visible to automated submitters. Nothing you can see is a trap, and no puzzle is put in front of you — those services report your visit to somebody else, which is the thing this site avoids.
Security
The site is served over an encrypted connection, the form is protected against submission from another site, and access to what the form collects is limited to the people who answer it.
No automated decision-making
Your request is read and answered by a person. Nothing here scores you, sorts you or decides anything about you automatically, and there is no profiling within the meaning of Article 22 of the General Data Protection Regulation.
Younger visitors
The form is meant for the person who would buy or ask about the equipment, which means an adult. We do not knowingly keep a request sent by a child; if one reaches us it is deleted rather than answered. The brand name invites the opposite assumption, so it is worth writing down.
Your rights
Under the General Data Protection Regulation you have the right to:
- ask what is held about you and receive a copy of it (Article 15);
- have anything inaccurate corrected (Article 16);
- have it erased (Article 17);
- have its use restricted (Article 18);
- receive it in a portable, machine-readable form (Article 20);
- object to its use (Article 21);
- withdraw your consent at any time (Article 7(3)).
Write to support@esca.toys, or use the request form. There is no charge, and an answer follows within one month. You also have the right to complain to the data protection supervisory authority of the member state where you live, where you work, or where you believe something went wrong (Article 77).
Changes to this policy
This policy is updated when what the site does changes. The date at the foot of the page says which version you are reading.
Last updated 9 September 2026.