Version 4.2 | Effective: 4th November, 2026
This Privacy Policy explains how Toys"R"Us ANZ Pty Ltd (ACN 063 886 199, ABN 94 063 886 199), trading as Toys"R"Us Australia ("we", "us", "our"), collects, holds, uses and discloses your personal information, and how you can contact us about it.
We're bound by the Privacy Act 1988 (Cth) ("Privacy Act"), including the Australian Privacy Principles ("APPs") and the Notifiable Data Breaches ("NDB") scheme in Part IIIC, the Spam Act 2003 (Cth), and any registered privacy code that applies to us, including the Children's Online Privacy Code once it is registered.
This policy applies to all personal information we collect, however we collect it, including through our website at www.toysrus.com.au and any associated mobile or app interface we operate (together, our "website"), through other platforms that sell our products on our behalf, and through third-party platforms such as social media and review sites. We have internal practices, procedures, systems and staff training in place to put this policy into practice.
For all privacy enquiries, access requests, correction requests, complaints or questions about this policy, please contact our Privacy Officer:
| Detail | Information |
|---|---|
| Company Name | Toys"R"Us ANZ Pty Ltd |
| ACN | 063 886 199 |
| ABN | 94 063 886 199 |
| Trading Name | Toys"R"Us Australia |
| Privacy Officer | The Privacy Officer |
| Privacy Email | privacy@toysrus.com.au |
| Postal Address | The Privacy Officer, Toys"R"Us Australia, Unit 3, 45–49 McNaughton Road, Clayton VIC 3168, Australia |
| Website | www.toysrus.com.au |
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.
We may collect the following categories of personal information from you:
When you visit our website or use our digital services, we may automatically collect:
Sensitive information includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records and certain biometric information. We do not routinely collect sensitive information. Where sensitive information is provided (for example, health or accessibility information shared in the context of a customer service interaction or warranty claim), we will only collect it with your consent or where required or authorised by law, and we will use it only for the purpose for which it was provided.
If you're under 18, you're welcome to browse our website, but a parent or guardian is required to place your order for you. You can create a customer account at any age. We don't knowingly collect personal information directly from children under 15 without the consent of a parent or guardian. If we find that we have, we'll delete it unless the law requires us to keep it. Where we run a competition or promotion that may appeal to children, entries must be made by a parent or guardian.
We minimise the collection of children's dates of birth, locations, photographs, school information and interests. We don't use children's personal information for behavioural profiling or targeted advertising. We'll review this policy and our practices when the Children's Online Privacy Code is registered, and put in place any additional requirements that apply to us.
We collect personal information through the following channels:
We will not collect personal information about you by unlawful means or without your knowledge where it would be unreasonable to do so.
We collect and use personal information only where reasonably necessary for one or more of the following purposes, or where you have consented to a specific use:
| Purpose | Why we need it |
|---|---|
| Processing and fulfilling orders, including arranging delivery or click-and-collect | To complete the order you've placed |
| Creating and administering your account | To provide the account you've asked for |
| Processing payments and preventing fraud | To protect you and us from fraud, and to meet our legal obligations |
| Providing customer service and resolving complaints | To help you and resolve any issues |
| Sending transactional communications (order confirmations, shipping updates, receipts) | To complete the order you've placed |
| Sending marketing communications (email, SMS, post) | Your express, opt-in consent (see Section 6) |
| Personalising your experience on our website | Your consent (via cookie preferences) |
| Operating competitions, surveys and promotions | To run the promotion you've entered, with your consent where required |
| Seeking your feedback on our products and services | To improve our products and services |
| Complying with legal and regulatory obligations (tax, consumer law, product safety) | Required by law |
| Preventing, detecting and investigating fraud, theft and other unlawful activity | To protect you and us, and to meet our legal obligations |
| Improving our products, services and website | To improve our products, services and website |
| Conducting automated decision-making (see Section 11) | As described in Section 11 |
| Warranty and product-safety matters | Required by law (including the Australian Consumer Law), and to help resolve warranty claims |
| Recruitment (where you apply for a role with us) | To consider your application, with your consent |
We will not use or disclose your personal information for a secondary purpose unless the secondary purpose is directly related to the primary purpose of collection and you would reasonably expect us to use it for that purpose, or you have consented to the secondary use, or use or disclosure is otherwise permitted under the Privacy Act.
We'll only send you marketing communications (including promotional emails, SMS messages, direct mail, social media messages and abandoned-cart reminders) if you've given us your express or implied consent. We don't add customers to marketing lists automatically when they make a purchase or create an account.
At checkout and at our newsletter sign-up, we use a separate, unticked opt-in for marketing communications. Consent to receive email marketing is not treated as consent to receive SMS, telephone or social media marketing; you may select your preferred channels.
For each marketing consent, we record the date, wording, source (e.g. checkout, newsletter form), channel and platform. This record is retained for as long as necessary to demonstrate compliance.
You may withdraw your consent at any time at no cost:
We'll process opt-out requests within five business days and add you to our suppression list. You'll continue to receive transactional messages needed to fulfil your order or manage your account.
We may disclose personal information to third parties in the following circumstances:
We do not sell, rent or trade your personal information to unrelated third parties for their own marketing purposes.
Where we engage third-party contractors to handle personal information on our behalf, those contractors are bound by written agreements that restrict them to using personal information only for the specific purpose for which it was provided, and that require them to maintain adequate security and notify us of any data breach.
Some of our service providers are located overseas or store data overseas. Depending on the provider, your information may be disclosed to recipients in the Australia, United States, France, Ireland, Singapore or Canada.
Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient handles the information in a manner consistent with the APPs. Where we are unable to take such steps, we will seek your consent to the overseas disclosure, or rely on another exception permitted by APP 8. Where we make an overseas disclosure, we remain accountable for the recipient's handling of that information unless the exception in APP 8.2(b) applies.
Our website uses cookies, web beacons, pixels, device identifiers and similar technologies ("tracking technologies"). Some are set by us (first-party) and some by our service providers (third-party). The providers we use are listed in Section 7.1 and in Part 6 of our Terms & Conditions of Sale.
Tracking technologies may collect or transmit personal information when they are linked or linkable to an identifiable individual. We treat such information as personal information and handle it in accordance with this policy and the APPs.
| Type | Purpose | Can You Opt Out? |
|---|---|---|
| Essential | Required for the website to function (e.g. shopping cart, session management, fraud prevention) | No: the site can't function without these |
| Analytics | Help us understand how visitors use our website (e.g. Google Analytics) | Yes, via cookie preferences |
| Functional | Remember your preferences (e.g. language, location, recently viewed items) | Yes, via cookie preferences |
| Advertising | Enable us to show you relevant advertising across the internet based on your browsing activity | Yes, via cookie preferences |
Typical durations: essential cookies last for your session or up to 1 year, analytics cookies up to 2 years, functional cookies up to 1 year and advertising cookies up to 2 years. See Part 6 of our Terms & Conditions of Sale for more detail.
You can change your cookie preferences via the "Cookie Consent" tool that appears in the bottom right-hand corner when you first visit our website. You can also manage cookies through your browser settings. Blocking some cookies may affect how our website works. Opting out of advertising cookies doesn't mean you'll stop seeing ads; it just means the ads you see will be less relevant to you.
We take part in the Google Customer Reviews program. When you complete a purchase, Google may receive transaction data so it can ask you for a review. Google's privacy policy applies to that information.
We take reasonable technical and organisational measures appropriate to the nature and sensitivity of the personal information we hold to protect it from misuse, interference, loss, unauthorised access, modification and disclosure, as required by APP 11.
Our security measures include (but are not limited to):
No system is completely secure, particularly when information is sent over the internet or held on third-party platforms, but we work hard to protect your information. If you have any concerns about the security of your information, please contact our Privacy Officer.
When personal information is no longer required, we take reasonable steps to destroy it or ensure it is de-identified in accordance with our retention schedule (see Section 10).
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, taxation, product-safety, fraud-prevention and dispute-resolution obligations.
| Data Category | Indicative Retention Period | Basis |
|---|---|---|
| Orders and financial transaction records | 7 years from transaction date | Taxation and accounting obligations |
| Customer account information (active) | Duration of account plus 3 years after last activity | Dispute resolution, consumer law |
| Customer account information (closed) | 3 years after closure | Dispute resolution |
| Customer service communications | 3 years from last communication | Dispute resolution, consumer law |
| Delivery and logistics records | 2 years from delivery | Consumer law, dispute resolution |
| Marketing consent records | Duration of consent plus 3 years | Spam Act compliance |
| Suppression and opt-out records | Indefinitely | Spam Act compliance |
| Competition and survey entries | 12 months after competition close | Consumer law |
| Product reviews and community content | Duration of publication plus 2 years | Legitimate purpose |
| Fraud records | 7 years | Legal obligation, fraud prevention |
| Warranty and product-safety records | Life of product plus 7 years | Product safety obligations |
| Live chat and Ask Geoffrey transcripts | 3 years | Customer service, dispute resolution |
| Unsuccessful recruitment applications | 6 months after notification | APP 3, APP 11 |
When retention periods expire, we securely destroy or de-identify personal information in accordance with our internal data-destruction procedures.
From 10 December 2026, the Privacy Act (APP 1.7–1.9) requires us to explain in this policy where we use personal information in computer programs that make, or substantially help make, decisions that could reasonably be expected to significantly affect your rights or interests.
| System / Process | Personal Information Used | Nature of Decision |
|---|---|---|
| Fraud screening and order risk assessment | Name, address, IP address, device identifier, order value, payment method, purchase history | Automated flagging for human review; in high-risk cases, automatic cancellation with a full refund |
| Promotional eligibility | Account history, purchase history, promotional code usage | Automated determination of eligibility for discounts or promotional offers |
| Purchase-limit and order-quantity checks | Name, delivery address, email address, payment method and order history | Matching related orders to apply published purchase limits and reasonable retail quantities, which may lead to cancellation of orders or items with a full refund |
| Spam and abuse detection | Email address, IP address, behavioural patterns | Filtering abusive or spam-generated reviews, competition entries or contact-form submissions |
Where an automated decision significantly affects your rights or interests, you may contact our Privacy Officer to:
We will respond to such requests within 30 days.
You have the right to request access to the personal information we hold about you. To make an access request, please contact our Privacy Officer using the details in Section 2. We will:
We may charge a reasonable fee for providing access to reflect our reasonable costs in locating, retrieving and preparing the information, but we will not charge a fee simply for lodging the request, and any fee charged must not be excessive.
We may refuse access in limited circumstances permitted by the Privacy Act. If we refuse access, we will give you written reasons and advise you of the applicable exception.
If you believe that personal information we hold about you is inaccurate, incomplete, out of date, irrelevant or misleading, you may request that we correct it. We will take reasonable steps to correct the information or, if we disagree with your correction request, we will note your request alongside the relevant record and advise you of our reasons in writing.
You may also update certain personal information (such as your delivery address and communication preferences) at any time through your account settings.
If you have a complaint about how we have handled your personal information, please contact our Privacy Officer in the first instance using the details in Section 2. We will:
If you are not satisfied with our response, or if you do not hear from us within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we have reasonable grounds to believe that an eligible data breach has occurred (that is, there has been unauthorised access to, or disclosure of, personal information that is likely to result in serious harm to one or more affected individuals), we will:
1. Assess the suspected breach as quickly as possible and in any case within 30 days
2. Notify affected individuals and the OAIC as soon as practicable after determining that an eligible breach has occurred, unless a law enforcement exception applies
3. Take reasonable steps to contain the breach and prevent further harm
Notification to individuals will include: a description of the breach, the kinds of information involved, the steps we recommend you take to protect yourself, and our contact details.
If we make a ransomware payment, we'll report it to the Australian Signals Directorate within 72 hours, as required by the Cyber Security Act 2024 (Cth).
We maintain a written data-breach response plan and conduct regular reviews. If you become aware of or suspect a data breach involving our systems, please notify our Privacy Officer immediately using the contact details in Section 2.
In addition to this Privacy Policy, we provide concise collection notices at each material point of collection. These notices identify the collecting entity, the purpose of collection, the consequences of not providing the information, the usual types of recipients, any likely overseas disclosures, and where this full Privacy Policy can be found. Collection points at which notices are provided include:
Our website contains links to third-party websites and platforms whose privacy practices differ from ours. We are not responsible for the privacy practices of third-party sites. We encourage you to read the privacy policy of any website you visit before submitting personal information.
If you submit personal information to any third-party website (including social media platforms on which we have a presence), your information is governed by that third party's privacy policy.
We may update this Privacy Policy from time to time to reflect changes in our business practices, technology or the law. The current version of this policy will always be available on our website at www.toysrus.com.au/policies/privacy-policy
When we make a material change to this policy, we'll publish the updated version on our website and update the version number and date at the top of this page.
| Term | Meaning |
|---|---|
| APPs | Australian Privacy Principles under Schedule 1 of the Privacy Act 1988 (Cth) |
| NDB scheme | Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) |
| OAIC | Office of the Australian Information Commissioner |
| Personal information | Information or an opinion about an identified or reasonably identifiable individual |
| Sensitive information | A subset of personal information including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records and certain biometric data |
| APP entity | An organisation or agency bound by the Australian Privacy Principles |
| ADM | Automated decision-making: a decision made by a computer program with no, or minimal, human involvement |
This policy was last reviewed in November 2026 and reflects the law at that date, including the Privacy and Other Legislation Amendment Act 2024 (Cth) and the automated decision-making obligations starting on 10 December 2026.
TOYS"R"US ANZ PTY LTD | ACN 063 886 199 | ABN 94 063 886 199
