Privacy Policy
We are committed to protecting your personal data and respecting your privacy rights under EU law.
Last updated: June 2025
Right to Access
Request a copy of the data we hold on you at any time.
Right to Erasure
Ask us to delete your personal data (“right to be forgotten”).
Data Security
All data is encrypted in transit and at rest using industry standards.
No Selling
We never sell, rent, or trade your personal data to third parties.
Data Controller
The Polo Point (“we”, “us”, “our”) is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, contact us at privacy@thepolopoint.com.
What Data We Collect
Account & Order Data
- Name, email address, phone number
- Billing and shipping address
- Order history, product preferences
- Account login credentials (passwords are hashed and never stored in plain text)
Payment Data
- Payment transactions are processed by our payment provider (Stripe or equivalent)
- We do not store full card numbers — only the last 4 digits and card type for display purposes
- Payment data is subject to PCI-DSS compliance by our processor
Usage & Technical Data
- IP address, browser type, device information
- Pages visited, time on site, referral source
- Cookies and similar tracking technologies (see our Cookie Policy)
Communications Data
- Emails or messages you send us
- Newsletter subscription status and preferences
- Customer support ticket content
Legal Basis for Processing (GDPR Article 6)
| Purpose | Legal Basis |
|---|---|
| Processing and fulfilling your orders | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations and transactional emails | Performance of a contract (Art. 6(1)(b)) |
| Fraud prevention and security checks | Legitimate interests (Art. 6(1)(f)) |
| Marketing emails and newsletters | Consent (Art. 6(1)(a)) — you can withdraw at any time |
| Analytics and site improvement | Legitimate interests (Art. 6(1)(f)) / Consent |
| Legal and tax compliance | Legal obligation (Art. 6(1)(c)) |
Who We Share Your Data With
We share your data only with trusted service providers who help us operate our store. All processors are bound by data processing agreements and must comply with GDPR.
- Payment processors — to securely handle card transactions (e.g. Stripe)
- Shipping carriers — to deliver your orders (name, address, phone)
- Email service providers — to send transactional and marketing emails
- Analytics providers — to understand site usage (data is anonymised where possible)
- Cloud infrastructure — to host and operate our store securely
We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.
International Data Transfers
Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your data to the same standard required within the EEA.
How Long We Keep Your Data
- Account and order data: retained for 7 years for legal and tax purposes, then deleted
- Marketing preferences: until you withdraw consent or unsubscribe
- Technical and analytics data: up to 26 months, then anonymised or deleted
- Support communications: up to 3 years after resolution
Your Rights Under GDPR
If you are located in the EU/EEA, you have the following rights regarding your personal data:
Right of access
Request a copy of the personal data we hold on you.
Right to rectification
Ask us to correct inaccurate or incomplete data.
Right to erasure
Request deletion of your data where there is no legitimate reason to keep it.
Right to restriction
Ask us to pause processing your data in certain circumstances.
Right to portability
Receive your data in a structured, machine-readable format.
Right to object
Object to processing based on legitimate interests or for direct marketing.
Right to withdraw consent
Withdraw consent for marketing at any time via the unsubscribe link.
Right to lodge a complaint
Contact your national data protection authority (e.g. Garante in Italy, CNIL in France, ICO in the UK).
To exercise any of these rights, email privacy@thepolopoint.com. We will respond within 30 days.
Cookies
We use cookies and similar technologies to operate our store, remember your preferences, and analyse site traffic. You can manage your cookie preferences at any time via the cookie banner or our Cookie Policy. Refusing non-essential cookies will not affect your ability to shop.
Privacy Enquiries
For any data protection questions or to exercise your rights, contact our privacy team at privacy@thepolopoint.com. We aim to respond within 5 business days and are legally required to respond within 30 days.