Privacy policy

Privacy Policy

Version 4.2 | Effective: 4th November, 2026

Contents

1. About This Policy

This Privacy Policy explains how Toys"R"Us ANZ Pty Ltd (ACN 063 886 199, ABN 94 063 886 199), trading as Toys"R"Us Australia ("we", "us", "our"), collects, holds, uses and discloses your personal information, and how you can contact us about it.

We're bound by the Privacy Act 1988 (Cth) ("Privacy Act"), including the Australian Privacy Principles ("APPs") and the Notifiable Data Breaches ("NDB") scheme in Part IIIC, the Spam Act 2003 (Cth), and any registered privacy code that applies to us, including the Children's Online Privacy Code once it is registered.

This policy applies to all personal information we collect, however we collect it, including through our website at www.toysrus.com.au and any associated mobile or app interface we operate (together, our "website"), through other platforms that sell our products on our behalf, and through third-party platforms such as social media and review sites. We have internal practices, procedures, systems and staff training in place to put this policy into practice.

2. Who We Are / Contact Details

For all privacy enquiries, access requests, correction requests, complaints or questions about this policy, please contact our Privacy Officer:

Detail Information
Company Name Toys"R"Us ANZ Pty Ltd
ACN 063 886 199
ABN 94 063 886 199
Trading Name Toys"R"Us Australia
Privacy Officer The Privacy Officer
Privacy Email privacy@toysrus.com.au
Postal Address The Privacy Officer, Toys"R"Us Australia, Unit 3, 45–49 McNaughton Road, Clayton VIC 3168, Australia
Website www.toysrus.com.au

3. What Personal Information We Collect

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

3.1 Information You Provide to Us

We may collect the following categories of personal information from you:

  • Identity information: full name, date of birth (where needed for competition eligibility) and gender (if you choose to provide it)
  • Contact information: postal address, email address, telephone and mobile numbers
  • Transaction information: purchase history, order details, delivery instructions, gift card balances, wish lists, returns and refund requests
  • Account information: username, encrypted password, account preferences, communication preferences
  • Payment information: billing address and payment method details (note: full card numbers are processed by our third-party payment processor and are not stored by us)
  • Customer service information: emails, online enquiry forms, live chat and written correspondence, including records of your conversations with our 'Ask Geoffrey' virtual assistant
  • Competition and survey information: entries, responses and preferences submitted when you participate in promotions or surveys
  • Product reviews and community content: reviews, ratings, photos, comments and other content you submit through our website (via our review platform, Yotpo), or that you give us permission to use from our social media channels
  • Feedback and complaint information: the content of any complaint or feedback you provide, including health or accessibility information where voluntarily disclosed in that context

3.2 Information We Collect Automatically

When you visit our website or use our digital services, we may automatically collect:

  • Device identifiers (IP address, browser type, operating system, device type)
  • Browsing and session data (pages visited, time spent, links clicked, search queries on our site)
  • Cookies and similar tracking technologies (see Section 8 for details)
  • Location data (suburb or region level, derived from IP address or, if you consent, GPS)
  • Transaction and cart-abandonment data

3.3 Sensitive Information

Sensitive information includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records and certain biometric information. We do not routinely collect sensitive information. Where sensitive information is provided (for example, health or accessibility information shared in the context of a customer service interaction or warranty claim), we will only collect it with your consent or where required or authorised by law, and we will use it only for the purpose for which it was provided.

3.4 Children's Information

If you're under 18, you're welcome to browse our website, but a parent or guardian is required to place your order for you. You can create a customer account at any age. We don't knowingly collect personal information directly from children under 15 without the consent of a parent or guardian. If we find that we have, we'll delete it unless the law requires us to keep it. Where we run a competition or promotion that may appeal to children, entries must be made by a parent or guardian.

We minimise the collection of children's dates of birth, locations, photographs, school information and interests. We don't use children's personal information for behavioural profiling or targeted advertising. We'll review this policy and our practices when the Children's Online Privacy Code is registered, and put in place any additional requirements that apply to us.

4. How We Collect Personal Information

We collect personal information through the following channels:

  • Our website: at checkout, account creation, newsletter sign-up, competition entry, product review submission, contact and returns forms, and through 'Ask Geoffrey'
  • Email and written correspondence: emails, online enquiry forms and letters you send to us
  • Telephone: we don't have a general customer service phone line, but we may call you about your order or a query you've raised. Calls may be recorded for training purposes. We will always ask your permission to record calls.
  • Third-party platforms: social media platforms, platforms that sell our products on our behalf, our layby provider (LayUp), and customer review platforms (including Yotpo and Google Customer Reviews)
  • Third parties: from delivery carriers (e.g. updated delivery address), fraud-prevention services, and publicly available sources, to the extent permitted by law

We will not collect personal information about you by unlawful means or without your knowledge where it would be unreasonable to do so.

5. Why We Collect and How We Use Your Personal Information

We collect and use personal information only where reasonably necessary for one or more of the following purposes, or where you have consented to a specific use:

Purpose Why we need it
Processing and fulfilling orders, including arranging delivery or click-and-collect To complete the order you've placed
Creating and administering your account To provide the account you've asked for
Processing payments and preventing fraud To protect you and us from fraud, and to meet our legal obligations
Providing customer service and resolving complaints To help you and resolve any issues
Sending transactional communications (order confirmations, shipping updates, receipts) To complete the order you've placed
Sending marketing communications (email, SMS, post) Your express, opt-in consent (see Section 6)
Personalising your experience on our website Your consent (via cookie preferences)
Operating competitions, surveys and promotions To run the promotion you've entered, with your consent where required
Seeking your feedback on our products and services To improve our products and services
Complying with legal and regulatory obligations (tax, consumer law, product safety) Required by law
Preventing, detecting and investigating fraud, theft and other unlawful activity To protect you and us, and to meet our legal obligations
Improving our products, services and website To improve our products, services and website
Conducting automated decision-making (see Section 11) As described in Section 11
Warranty and product-safety matters Required by law (including the Australian Consumer Law), and to help resolve warranty claims
Recruitment (where you apply for a role with us) To consider your application, with your consent


We will not use or disclose your personal information for a secondary purpose unless the secondary purpose is directly related to the primary purpose of collection and you would reasonably expect us to use it for that purpose, or you have consented to the secondary use, or use or disclosure is otherwise permitted under the Privacy Act.

We'll only send you marketing communications (including promotional emails, SMS messages, direct mail, social media messages and abandoned-cart reminders) if you've given us your express or implied consent. We don't add customers to marketing lists automatically when they make a purchase or create an account.

At checkout and at our newsletter sign-up, we use a separate, unticked opt-in for marketing communications. Consent to receive email marketing is not treated as consent to receive SMS, telephone or social media marketing; you may select your preferred channels.

For each marketing consent, we record the date, wording, source (e.g. checkout, newsletter form), channel and platform. This record is retained for as long as necessary to demonstrate compliance.

You may withdraw your consent at any time at no cost:

  • Email marketing: click the unsubscribe link in any marketing email, or contact us using the details in Section 2
  • SMS marketing: reply STOP to any marketing SMS, or contact us using the details in Section 2
  • Post: contact our Privacy Officer using the postal address in Section 2
  • Account preferences: update your communication preferences in your account settings when logged in (login is not required to unsubscribe)

We'll process opt-out requests within five business days and add you to our suppression list. You'll continue to receive transactional messages needed to fulfil your order or manage your account.

7. Disclosure of Personal Information

7.1 When We Disclose

We may disclose personal information to third parties in the following circumstances:

  • To complete a transaction: delivery carriers, fulfilment partners, freight and logistics providers
  • To process payments: payment gateway operators, card processors, buy now, pay later providers (Afterpay and Zip), our layby provider (LayUp), and fraud-detection and chargeback services. These providers also handle your information under their own privacy policies.
  • To operate our website and systems: our e-commerce platform provider (Shopify), cloud hosting and infrastructure providers, and content delivery networks
  • To communicate with you: email and SMS platform providers (including Klaviyo), and customer service and live chat software providers
  • To operate 'Ask Geoffrey': Gorgias (gorgias.io), which provides the technology behind our virtual assistant and our customer service platform
  • For analytics and advertising: Google Analytics 4 (GA4), Google Ads, Google Tag Manager (GTM), Google Tag, Meta/Facebook Pixel, TikTok Pixel, Microsoft Clarity, Hotjar, Klaviyo, Shopify Analytics, Shopify Web Pixels, Shopify Monorail and Instant Custom Pixel, and our customer review platforms (Yotpo and Google Customer Reviews)
  • To protect our business: fraud-prevention and identity-verification services, cybersecurity providers, insurers
  • To professional advisers: lawyers, accountants, auditors and consultants, bound by confidentiality
  • Where required by law: to regulators, courts, law enforcement agencies and government bodies where required or authorised by Australian law, a court order, or equivalent legal process
  • Product safety and warranty: to manufacturers, distributors and regulators where required in connection with a product recall, safety issue or warranty claim
  • Business transfer: to a prospective purchaser or acquirer in connection with the sale, merger or restructure of our business, subject to confidentiality obligations

We do not sell, rent or trade your personal information to unrelated third parties for their own marketing purposes.

7.2 Third-Party Contractors

Where we engage third-party contractors to handle personal information on our behalf, those contractors are bound by written agreements that restrict them to using personal information only for the specific purpose for which it was provided, and that require them to maintain adequate security and notify us of any data breach.

7.3 Overseas Disclosure

Some of our service providers are located overseas or store data overseas. Depending on the provider, your information may be disclosed to recipients in the Australia, United States, France, Ireland, Singapore or Canada.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with the APPs. Where we are unable to take such steps, we will seek your consent to the overseas disclosure, or rely on another exception permitted by APP 8. Where we make an overseas disclosure, we remain accountable for the recipient's handling of that information unless the exception in APP 8.2(b) applies.

8. Cookies and Tracking Technologies

8.1 What We Use

Our website uses cookies, web beacons, pixels, device identifiers and similar technologies ("tracking technologies"). Some are set by us (first-party) and some by our service providers (third-party). The providers we use are listed in Section 7.1 and in Part 6 of our Terms & Conditions of Sale.

Tracking technologies may collect or transmit personal information when they are linked or linkable to an identifiable individual. We treat such information as personal information and handle it in accordance with this policy and the APPs.

8.2 Types of Cookies

Type Purpose Can You Opt Out?
Essential Required for the website to function (e.g. shopping cart, session management, fraud prevention) No: the site can't function without these
Analytics Help us understand how visitors use our website (e.g. Google Analytics) Yes, via cookie preferences
Functional Remember your preferences (e.g. language, location, recently viewed items) Yes, via cookie preferences
Advertising Enable us to show you relevant advertising across the internet based on your browsing activity Yes, via cookie preferences


Typical durations: essential cookies last for your session or up to 1 year, analytics cookies up to 2 years, functional cookies up to 1 year and advertising cookies up to 2 years. See Part 6 of our Terms & Conditions of Sale for more detail.

You can change your cookie preferences via the "Cookie Consent" tool that appears in the bottom right-hand corner when you first visit our website. You can also manage cookies through your browser settings. Blocking some cookies may affect how our website works. Opting out of advertising cookies doesn't mean you'll stop seeing ads; it just means the ads you see will be less relevant to you.

8.4 Google Customer Reviews

We take part in the Google Customer Reviews program. When you complete a purchase, Google may receive transaction data so it can ask you for a review. Google's privacy policy applies to that information.

9. Security of Your Personal Information

We take reasonable technical and organisational measures appropriate to the nature and sensitivity of the personal information we hold to protect it from misuse, interference, loss, unauthorised access, modification and disclosure, as required by APP 11.

Our security measures include (but are not limited to):

  • Access controls, role-based permissions and multi-factor authentication
  • Encryption of data in transit (SSL/TLS) and at rest where appropriate
  • Secure payment architecture (we do not store full card numbers)
  • Firewall protection, anti-virus and intrusion-detection systems
  • Vulnerability scanning and periodic penetration testing
  • Patch and update management
  • Staff privacy and cybersecurity training
  • Vendor security assessments for third-party processors

No system is completely secure, particularly when information is sent over the internet or held on third-party platforms, but we work hard to protect your information. If you have any concerns about the security of your information, please contact our Privacy Officer.

When personal information is no longer required, we take reasonable steps to destroy it or ensure it is de-identified in accordance with our retention schedule (see Section 10).

10. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, taxation, product-safety, fraud-prevention and dispute-resolution obligations.

Data Category Indicative Retention Period Basis
Orders and financial transaction records 7 years from transaction date Taxation and accounting obligations
Customer account information (active) Duration of account plus 3 years after last activity Dispute resolution, consumer law
Customer account information (closed) 3 years after closure Dispute resolution
Customer service communications 3 years from last communication Dispute resolution, consumer law
Delivery and logistics records 2 years from delivery Consumer law, dispute resolution
Marketing consent records Duration of consent plus 3 years Spam Act compliance
Suppression and opt-out records Indefinitely Spam Act compliance
Competition and survey entries 12 months after competition close Consumer law
Product reviews and community content Duration of publication plus 2 years Legitimate purpose
Fraud records 7 years Legal obligation, fraud prevention
Warranty and product-safety records Life of product plus 7 years Product safety obligations
Live chat and Ask Geoffrey transcripts 3 years Customer service, dispute resolution
Unsuccessful recruitment applications 6 months after notification APP 3, APP 11

When retention periods expire, we securely destroy or de-identify personal information in accordance with our internal data-destruction procedures.

11. Automated Decision-Making

From 10 December 2026, the Privacy Act (APP 1.7–1.9) requires us to explain in this policy where we use personal information in computer programs that make, or substantially help make, decisions that could reasonably be expected to significantly affect your rights or interests.

11.1 Automated Decisions We Make

System / Process Personal Information Used Nature of Decision
Fraud screening and order risk assessment Name, address, IP address, device identifier, order value, payment method, purchase history Automated flagging for human review; in high-risk cases, automatic cancellation with a full refund
Promotional eligibility Account history, purchase history, promotional code usage Automated determination of eligibility for discounts or promotional offers
Purchase-limit and order-quantity checks Name, delivery address, email address, payment method and order history Matching related orders to apply published purchase limits and reasonable retail quantities, which may lead to cancellation of orders or items with a full refund
Spam and abuse detection Email address, IP address, behavioural patterns Filtering abusive or spam-generated reviews, competition entries or contact-form submissions

11.2 Your Rights Regarding ADM

Where an automated decision significantly affects your rights or interests, you may contact our Privacy Officer to:

  • Request information about how the decision was made
  • Request that the decision be reviewed by a human
  • Correct personal information that you believe led to an inaccurate automated outcome

We will respond to such requests within 30 days.

12. Your Rights: Access, Correction and Complaints

12.1 Right of Access

You have the right to request access to the personal information we hold about you. To make an access request, please contact our Privacy Officer using the details in Section 2. We will:

  • Acknowledge your request within 2 business days
  • Provide a substantive response, or a decision on access, within 30 days
  • Verify your identity before providing access to ensure your information is not disclosed to another person

We may charge a reasonable fee for providing access to reflect our reasonable costs in locating, retrieving and preparing the information, but we will not charge a fee simply for lodging the request, and any fee charged must not be excessive.

We may refuse access in limited circumstances permitted by the Privacy Act. If we refuse access, we will give you written reasons and advise you of the applicable exception.

12.2 Right of Correction

If you believe that personal information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree with your correction request, we will note your request alongside the relevant record and advise you of our reasons in writing.

You may also update certain personal information (such as your delivery address and communication preferences) at any time through your account settings.

12.3 Complaints

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer in the first instance using the details in Section 2. We will:

  • Acknowledge your complaint within 2 business days
  • Investigate and provide a substantive response within 30 days
  • Keep you informed if more time is required for a complex matter

If you are not satisfied with our response, or if you do not hear from us within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Post: GPO Box 5218, Sydney NSW 2001

13. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe that an eligible data breach has occurred (that is, there has been unauthorised access to, or disclosure of, personal information that is likely to result in serious harm to one or more affected individuals), we will:

1. Assess the suspected breach as quickly as possible and in any case within 30 days

2. Notify affected individuals and the OAIC as soon as practicable after determining that an eligible breach has occurred, unless a law enforcement exception applies

3. Take reasonable steps to contain the breach and prevent further harm

Notification to individuals will include: a description of the breach, the kinds of information involved, the steps we recommend you take to protect yourself, and our contact details.

If we make a ransomware payment, we'll report it to the Australian Signals Directorate within 72 hours, as required by the Cyber Security Act 2024 (Cth).

We maintain a written data-breach response plan and conduct regular reviews. If you become aware of or suspect a data breach involving our systems, please notify our Privacy Officer immediately using the contact details in Section 2.

14. Point-of-Collection Notices (APP 5)

In addition to this Privacy Policy, we provide concise collection notices at each material point of collection. These notices identify the collecting entity, the purpose of collection, the consequences of not providing the information, the usual types of recipients, any likely overseas disclosures, and where this full Privacy Policy can be found. Collection points at which notices are provided include:

  • Checkout
  • Account creation
  • Newsletter and promotional sign-up
  • Competition and survey entry
  • Product review and community content submission
  • Customer service, online enquiry forms and live chat (including Ask Geoffrey)
  • Contact forms

15. Third-Party Websites

Our website contains links to third-party websites and platforms whose privacy practices differ from ours. We are not responsible for the privacy practices of third-party sites. We encourage you to read the privacy policy of any website you visit before submitting personal information.

If you submit personal information to any third-party website (including social media platforms on which we have a presence), your information is governed by that third party's privacy policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, technology or the law. The current version of this policy will always be available on our website at www.toysrus.com.au/policies/privacy-policy

When we make a material change to this policy, we'll publish the updated version on our website and update the version number and date at the top of this page.

17. Definitions

Term Meaning
APPs Australian Privacy Principles under Schedule 1 of the Privacy Act 1988 (Cth)
NDB scheme Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth)
OAIC Office of the Australian Information Commissioner
Personal information Information or an opinion about an identified or reasonably identifiable individual
Sensitive information A subset of personal information including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records and certain biometric data
APP entity An organisation or agency bound by the Australian Privacy Principles
ADM Automated decision-making: a decision made by a computer program with no, or minimal, human involvement

This policy was last reviewed in November 2026 and reflects the law at that date, including the Privacy and Other Legislation Amendment Act 2024 (Cth) and the automated decision-making obligations starting on 10 December 2026.

TOYS"R"US ANZ PTY LTD | ACN 063 886 199 | ABN 94 063 886 199