Security & Responsible Disclosure

Effective Date: August 14, 2026

At The Toy Station, protecting our website, systems, and customer information is an important part of maintaining a safe and reliable shopping experience.

We appreciate responsible security researchers who help identify and report potential vulnerabilities in an ethical manner.

If you believe you have discovered a security issue affecting thetoysstation.com, please report it by following the guidelines below.

Responsible Disclosure Guidelines

When investigating or reporting a potential security vulnerability, please:

Act in good faith and use responsible testing practices.
Allow us a reasonable amount of time to investigate and address the issue before making information about it public.
Do not access, modify, download, copy, delete, or disclose customer or business information without authorisation.
Do not perform testing that could disrupt our website, services, systems, or customers.
Do not attempt to gain persistent or unnecessary access to our systems.
Do not use discovered vulnerabilities for financial gain, fraud, extortion, or other malicious purposes.
Do not conduct social engineering, phishing, or physical security attacks against our staff or customers.
Comply with applicable laws and regulations throughout your research and reporting.

How to Report a Security Issue

If you believe you have identified a legitimate security vulnerability affecting our website, please provide as much relevant information as possible.

Your report should ideally include:

A clear description of the potential vulnerability.
The affected page, URL, feature, or service.
Steps required to reproduce the issue.
The potential security impact.
Relevant technical information.
Screenshots or other supporting evidence where appropriate.
Your contact information if you would like us to respond.

Please send security reports to:

Email: help@thetoysstation.com

Please do not include unnecessary customer information, payment information, passwords, or other sensitive personal data in your report.

Our Commitment

We take legitimate security reports seriously and aim to review them appropriately.

Where applicable, our process may include:

Reviewing and validating reported vulnerabilities.
Assessing potential severity and impact.
Investigating confirmed security issues.
Taking appropriate measures to address identified vulnerabilities.
Responding to legitimate reports within a reasonable timeframe where possible.

Resolution times may vary depending on the complexity, severity, and nature of the reported issue.

Scope

This Responsible Disclosure Policy applies to:

Website: thetoysstation.com

It covers systems and services that are directly operated and controlled by The Toy Station.

Third-party services connected to our website are generally outside the scope of this policy.

This may include independent:

Payment processors
Delivery and shipping providers
E-commerce technology providers
Hosting infrastructure
Analytics platforms
Third-party applications and integrations

Security concerns relating to an independent third-party service should normally be reported directly to that service provider through its official security reporting process.

Prohibited Testing

To protect our customers and services, please do not perform:

Denial-of-service (DoS or DDoS) attacks.
Automated testing that generates excessive traffic.
Malware distribution.
Phishing or social engineering.
Credential stuffing or password attacks.
Physical security testing.
Destructive testing.
Unauthorised access to customer accounts.
Unauthorised extraction or modification of customer information.
Testing of third-party systems not controlled by The Toy Station.

If testing could reasonably affect customers or normal website operation, please do not perform it.

Responsible Research

Security research should be limited to what is reasonably necessary to demonstrate the existence and potential impact of a vulnerability.

Researchers should avoid:

Accessing information belonging to other users.
Downloading unnecessary information.
Changing or deleting data.
Creating unnecessary disruption.
Attempting to obtain financial or payment information.
Continuing testing after sufficient evidence of a vulnerability has been obtained.

Safe Harbor

Where permitted by applicable law, The Toy Station does not intend to pursue action against security researchers solely for responsible, good-faith security research conducted in accordance with this policy.

Researchers should:

Act in good faith.
Follow this Responsible Disclosure Policy.
Avoid harming customers, employees, or our business.
Avoid accessing or exposing personal information.
Stop testing if sensitive information is encountered.
Give us a reasonable opportunity to investigate and address a reported vulnerability before public disclosure.

This statement does not authorise activity that would otherwise be unlawful and does not apply to activity involving malicious intent, fraud, extortion, deliberate disruption, or misuse of personal information.

Rewards

Submitting a vulnerability report does not create an entitlement to payment, compensation, products, discounts, or other rewards.

Unless we explicitly state otherwise, The Toy Station does not operate a formal bug bounty programme.

Privacy & Confidentiality

Any personal information submitted as part of a security report will be handled in accordance with our applicable privacy practices.

Please provide only the information reasonably necessary for us to investigate the reported issue.

Policy Updates

We may update this Security & Responsible Disclosure Policy periodically to reflect changes to our website, technology, security practices, or legal requirements.

Updates will be published on this page with a revised Effective Date where appropriate.

Contact Us

If you have questions about this policy or wish to report a potential security issue, please contact us.

The Toy Station

Address:
6 Eton St
Richmond TW9 1EE
United Kingdom

Phone: +44 20 8940 4896