Last Updated: 1 September 2026

Privacy Policy

How MengSNS collects, processes, and protects your personal data in compliance with the UK GDPR and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is MengSNS Limited, registered in England & Wales (Company No. 11983021), with its registered office at Unit 4 Logistics Park, Milton Keynes, MK17 8EB, United Kingdom. You may contact our Data Protection Officer at [email protected].

2. Information We Collect

Category	Data Points	Legal Basis
Identity & Contact	Full name, email address, phone number, delivery address	Contract performance
Transaction Data	Order history, payment references, refund records	Contract performance & legal obligation
Teddy Perks Account	Points balance, tier status, reward redemptions, birthday month	Consent & legitimate interest
Technical & Usage	IP address, browser type, device info, page views, referral source	Legitimate interest

3. Payment Security

We never store, log, or have access to your full card numbers or CVV codes. All payment processing is handled exclusively through PCI-DSS Level 1 certified payment gateways: Stripe, PayPal, and Apple Pay / Google Pay. Transactions are encrypted end-to-end using TLS 1.3.

4. How We Use Your Data

Order Fulfillment

Processing your purchases, dispatching parcels via Royal Mail or DPD, and providing tracking updates.

Teddy Perks Rewards

Calculating loyalty points, managing VIP tiers, and delivering birthday surprises and exclusive member offers.

Store Analytics

Understanding browsing patterns to improve product discovery and optimize our soft toy catalog.

5. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined above. Order records are retained for 6 years following the last transaction, in line with HMRC tax record-keeping requirements. Teddy Perks accounts are automatically anonymized after 24 months of inactivity. Marketing consent records are kept until you withdraw consent.

6. Third-Party Data Sharing

We never sell your personal data. We share information only with trusted service providers who process data on our behalf under strict contractual obligations:

Royal Mail & DPD — Delivery name, address, and parcel tracking
Stripe & PayPal — Secure payment processing
Judge.me — Verified product review collection
Google Analytics 4 — Anonymized website usage statistics

7. Your Rights Under GDPR

Right of Access Request a copy of all data we hold about you

Rectification Correct inaccurate or incomplete data

Erasure Request deletion of your personal data

Portability Receive your data in a structured format

To exercise any of these rights, please visit our GDPR Privacy Requests page or email [email protected]. We will respond within 30 calendar days.

Supervisory Authority

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.