We are proud to comply with the requirements of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of Personal Information and on the free movement of such data (GDPR). Furthermore, our data processing practices comply with the Slovenian Personal Data Protection Act (ZVOP-2), which governs the implementation of the GDPR within the Republic of Slovenia.
We offer services to our users through our:
- Website chipolo.net (the "Website");
- Website app.chipolo.net (the "Web app");
- Website support.chipolo.net (the "Support Center");
- Chipolo mobile application (the "Chipolo app");
- Social media pages;
- Other associated services that we provide both online and offline.
The services listed above are collectively referred to as "Services".
About us
Chipolo d.o.o., Gabrsko 12, 1420 Trbovlje, Slovenia, is the responsible party and data controller with respect to Personal Information collected through the Services.
For purchases shipped to the United States and Canada through our online store, our US subsidiary Chipolo Inc. acts as the seller of record. In that capacity, Chipolo Inc. determines the purposes for which the order, contact, delivery, and payment information of these customers is processed. This includes calculating applicable taxes and arranging order fulfillment through its own service providers while Chipolo d.o.o. operates the online store, systems, and staff that carry out this processing. For these transactions, Chipolo d.o.o. and Chipolo Inc. therefore act as joint controllers of this transaction data. In all other respects, including your Chipolo account, your use of the Chipolo app, Location Information, and the operation of the Services and the underlying servers and databases, Chipolo d.o.o. is the sole responsible party and data controller.
In this Privacy Policy, the term "Data Processing Partners" refers to the affiliated entities and third-party service providers that process your Personal Information on our behalf, as joint controllers, or, where applicable, as independent data controllers.
Our primary goals in using your data and information are to create your account, provide Services to you, improve our Services, contact you, conduct marketing and research, and create anonymous statistical reports for internal use.
Please note that the scope of this Privacy Policy is limited to information and data collected or received through your use of the Services. We are not responsible for the actions of third-party individuals or companies, the content of their sites, the use of information or data you provide to them, or any products or services they may offer. Any links to those sites do not constitute our sponsorship of, or affiliation with, those individuals or companies.
If you do not agree to these terms, please do not use the Services.
For general information and privacy questions, please feel free to contact us via privacy@chipolo.net.
How we collect and use your information
In this Privacy Policy, the term "Personal Information" means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to a name, an identification number, or, in certain circumstances, Location Information, an IP address or the unique identifier allocated to each Chipolo device. Specifically, we collect, process and use the following information from you, which may include Personal Information:
Placing an order
Contact information
When you place an order on our Website, you'll need to provide an email address, a first and last name, a shipping and billing address and any other information you voluntarily give to us.
Additionally, for shipping to most parts of the world, we will require you to provide a contact phone number used for delivery purposes. This is a requirement from many delivery companies that we work with.
The contact information will be used to complete and fulfill the order. Order and invoice records are retained to meet applicable accounting and tax obligations. For orders where Chipolo d.o.o. is the seller, this is 10 years under Slovenian legislation. For orders shipped to the United States and Canada, where Chipolo Inc. is the seller of record, this is up to 7 years under applicable US regulations.
Information provided by you about others
When providing Personal Information of another person, we rely upon you to obtain the consent necessary for us to process their Personal Information.
For sending Chipolos as a gift, the processing of the gift recipient's Personal Information you provide on the Website (in the cart and during the checkout process) will be consistent with the description for processing contact information from the previous section and any other references to the contact information throughout our Privacy Policy.
Information about you provided by others
If you received a Chipolo as a gift directly from our Website, someone else has provided your Personal Information to us to make it possible to send the package directly to you. The processing of your Personal Information is strictly limited to the minimum required processing to ship the package to you and will be retained in line with the applicable accounting and tax obligations described above. Your Personal Information was shared with our shipping providers and external fulfillment partners (for US, Canadian and UK addresses) solely for delivery purposes, and never for their own use. No additional processing will be done on your Personal Information.
Payment information
In order to complete your order on our Website, you'll need to provide payment information, such as your credit card, PayPal account, Apple Pay or Google Pay. This information is needed in order to process your order and is not stored on our servers, but on the servers of the listed third-party payment providers.
Below is a list of third-party payment providers available on our Website who act as independent data controllers of your payment information, along with links to their privacy policies:
Order fulfillment
US and Canadian orders are fulfilled by our external warehousing and fulfillment partner ShipMonk and its network of delivery partners.
UK orders are fulfilled by our external warehousing and fulfillment partner Rapid Pack and its network of delivery partners.
All other orders are shipped from Chipolo d.o.o. using one of the following delivery providers depending on the country and the shipping method selected:
We will share your shipping address with any of the companies listed in this section for the purposes of delivering the items you have ordered to your address. Some are independent data controllers of such data pursuant to EU rules (Pošta Slovenije, etc.) and their rules of data processing are governed and limited by law, while with others we have in place data processing agreements.
Registration for the use of our Services
You can register for the use of our Services by manually creating a Chipolo account or by using an existing third-party account, such as Apple, Google or Meta (Facebook), to create one.
When creating a Chipolo account, you'll need to provide a display name, a valid email address and a password. You can choose whether or not your display name includes your first and/or last name.
When using an existing third-party account, we obtain your profile information and your email address from this account. The information we get from third-party providers often depends on your settings or their privacy policies, so be sure to check what those are.
We do not identify you personally to other users or make your account information available to any third parties in any way that could identify you without your prior consent.
Information from your use of our Services
Chipolo ID and name
When you activate Chipolo using the Chipolo app, that Chipolo's unique identifier (or Chipolo ID) will be associated with your account. If you choose to name your Chipolo, this information will also be associated with your account.
Location Information
Chipolo is designed to tell you where your items are. In order to do that, it's necessary to collect data about your location. We use the term "Location Information" to refer to the combined location data of your phone or device, and your Chipolo.
While the app is running on your device, it periodically transmits your Location Information (even while running in the background). This allows us to show you, on your map, the last place your Chipolo was seen by your device. It is one of the primary ways Chipolo helps you find your lost items.
We may also collect and update Location Information for your Chipolo(s) "anonymously" (i.e. we will not disclose your identity to the other user nor disclose the other user's identity to you) from other Chipolo users who are running the app within Bluetooth range of your device. We do this to provide you with the most recent and accurate location of your Chipolos, even if they are out of your device's Bluetooth range. The Location Information associated with your Chipolo(s) is never made available to these users.
If you use a computer, phone, or other device in relation to the Services, we use the IP address of that computer or device to determine an approximate location (only to the country level). We do this so that we can provide you with a better, more personal experience.
We may also use your Location Information to promote the Services or provide you with personalized offers if you agree to such usage with separate consents. However, your Location Information is never shared with other users unless you choose to share it yourself through the use of sharing features that are part of our Services.
Products utilizing Apple Find My and Google Find Hub apps and networks
Please note that the collection and processing of Location Information differ depending on the specific Chipolo product you are using.
In this Privacy Policy, the term "new CARD" refers to the CARD model (C24R) released in 2025.
Our products designed for third-party tracking networks such as the Chipolo ONE Spot, CARD Spot, ONE Point, CARD Point, POP, LOOP and the new CARD operate differently than standard Chipolo devices. For these specific products, location tracking is facilitated entirely through Apple's Find My network or Google's Find Hub network.
Chipolo does not receive, collect, process, or store any Location Information for devices connected exclusively to the Apple Find My or Google Find Hub networks (i.e. not added to the Chipolo app). When you use these products, Apple or Google acts as the data controller for your Location Information.
Chipolo POP, LOOP and the new CARD can also be connected to the Chipolo app on top of either Find My or Find Hub apps, but in this case, there is no Location Information collected or processed by Chipolo independently when using default settings. Some extra features require the collection and processing of Location Information and you will be informed of this before enabling such features.
We strongly encourage you to review the following privacy policies to understand how your data is securely handled and encrypted:
- Information collected by Apple is treated in accordance with Apple's Privacy Policy (available at https://apple.com/privacy).
- Information collected by Google is treated in accordance with Google's Privacy Policy (available at https://policies.google.com/privacy).
Usage information
Whenever you use a website, mobile application, or other internet service, there's certain information that almost always gets created and recorded automatically. The same is true when you use our Services. We collect information about how you use our Services (e.g. features used, frequency of use), as well as technical information sent by your device, such as device model, operating system type and version, and timestamps of your interactions. We process this data for the purposes of providing and improving our Services, ensuring their security and functionality, and offering customer support. This processing is based on our legitimate interests (Article 6(1)(f) GDPR) in maintaining and improving our Services and our interest in maintaining a secure, reliable, and user-friendly service. Where possible, we always use aggregated and statistical data to better understand how our Services are used. Such data does not enable us to directly identify individual users.
Where required by applicable law, we obtain your consent before storing or accessing information on your device (e.g. through the use of analytics tools or similar technologies). In such cases, the processing is based on Article 6(1)(a) GDPR. See more in the section "Cookies and similar technologies".
Activity recognition (Physical Activity and Health Data)
The Chipolo app uses activity recognition (physical activity) features available on your mobile device to support certain functionalities, such as triggering Out of Range Alerts and maintaining app performance in the background. This helps reduce false alerts and improve responsiveness.
This data is processed exclusively on your device and is not transmitted to Chipolo or any third parties. Chipolo does not access, view, collect, or store this data on its servers. In particular, any health-related data derived from activity recognition remains solely on your device and never leaves it.
Birthday information
As part of our promotional email campaigns (if you have granted explicit consent), we may ask for your birthday to send you special birthday discounts, gifts, or other exclusive promotions to celebrate your special day. We collect this information solely upon your explicit consent. We will send you a separate email inviting you to share your birthday with us, but you are under absolutely no obligation to provide it. If you choose to share this information, it will be used exclusively for the purpose of delivering these birthday-related promotions and will not be processed or used for any other purpose.
Information collected through Chipolo's Support Services
We provide Support Services via live chat on our Website, email request submissions, recorded inbound and outbound telephone calls and direct email. We collect Personal Information you provide (or choose to provide) to our customer care team. This includes, but is not limited to: your name, email address, phone number, and mailing address. In the absence of such data, we cannot provide you with Support Services. We may use and process your Personal Information, including Location Information, to handle your support request and provide you with the best support possible, including quality assurance control.
As described in greater detail in the section "How we may share your Personal Information with third parties", we may share this information (including Personal Information) with our Data Processing Partners and use it in ways consistent with this Privacy Policy.
Purposes of data processing
We use information collected through our Services for purposes described in this Privacy Policy or disclosed to you in connection with our Services. For example, we may use your information to:
- Operate and improve our Services:
- Fulfill your online orders and enable registration for the use of our Service;
- Understand you and your preferences to enhance and customize your experience and enjoyment using our Services;
- Respond to your comments and questions and provide Support Services;
- Send you Service-related information, including confirmations, invoices, technical notices, updates, security alerts and support and administrative messages;
- Any other processing necessary for the performance of a contract with you.
- Ensure physical, network and information security and integrity:
- This is necessary for our legitimate interest of ensuring that our IT systems and networks are secure and uncompromised, including, for example, backup and archiving, preventing malware, viruses, bugs or other harmful code, preventing unauthorized access to our systems, and any form of attack on, or damage to, our IT systems and networks.
- Deliver marketing and promotional information:
- Communicate with you about our offers, promotions, rewards, upcoming events, and other news about our Services and products only upon your explicit consent;
- When you provide your explicit consent to receive our marketing and promotional communications, you also explicitly agree to our use of email tracking technologies (such as pixels, web beacons, and custom links) within those emails, as well as analytics tools for in-app messaging. We process this data to measure your engagement (such as open rates and link clicks), analyze the effectiveness of our campaigns, and personalize future content, rewards, and offers to better match your preferences. You can withdraw this tracking consent at any time by unsubscribing from the email campaigns by clicking the link in the footer of these emails or revoking your consent inside the Chipolo app.
- For basic telemetry and system maintenance of the promotional marketing flow:
- Separate from your marketing preferences, we automatically collect basic telemetry data from our email and in-app marketing campaigns (such as system functionality metrics, error reports, and other stability indicators). This processing is based on our legitimate interests (Article 6(1)(f) GDPR) to ensure that our systems work properly, remain technically stable, and provide a reliable user experience. Furthermore, this data is strictly processed to detect, prevent, and mitigate technical glitches, security vulnerabilities, or any potential misuse of our Services.
- For statistical and research purposes:
- We will aggregate and/or pseudonymize your data and use it for our legitimate interests of processing Personal Information for research purposes, including market research, better understanding of our customers, and tailoring our products and Services to their needs;
- Sharing aggregated data with business partners.
- For purposes of tracking your Location Information:
- We will store your last known location to operate our Services for products where the Chipolo app is the primary app handling your Location Information (e.g. Chipolo ONE);
- We will store your historical Location Information and use it for improving and personalizing our Services only upon your explicit consent.
- For compliance and legal purposes:
- Indicating possible criminal acts or threats to public security to a competent authority. This is necessary for our legitimate interest of promoting the success of our business, preventing crime, for compliance with a legal obligation to which we are subject;
- In connection with any legal or potential legal dispute or proceedings. This is necessary for our legitimate interest of promoting and ensuring the success of our business, resolving disputes and making such disclosures as are required by law or which we consider, acting reasonably, are required by law.
- For business or share sale purposes:
- In connection with disclosure requests and in the case of a business or share sale, or purchase of a business and/or assets, whether actual or potential. This is necessary for our legitimate interests of selling and/or ensuring and promoting the success of our business.
We may use AI-assisted tools (for example, to support customer service, analyze usage patterns, and improve our Services). These tools help us identify general trends and optimize user experience, but they do not make decisions independently without human oversight.
Your Personal Information is not used to train artificial intelligence models. Where such tools are provided by third parties (such as OpenAI or Anthropic), they act as our data processors under enterprise or API agreements that explicitly prohibit the use of your Personal Information to train or improve their AI models. We take appropriate steps to ensure that these tools operate under our strict instructions, maintain robust security and privacy safeguards, and operate in a fair and non-discriminatory manner.
We may use limited profiling, such as analyzing your app usage behavior, to provide helpful in-app features and suggestions. This processing is based on our legitimate interests (Article 6(1)(f) GDPR) in improving user experience. This processing does not produce legal or similarly significant effects on you.
Where profiling is used for marketing purposes, this will be done only with your consent.
How we may share your Personal Information with third parties
We may share your data (including Personal Information) with our affiliates and with Data Processing Partners. Depending on the partner and the purpose, they may act as our processors (processing only on our documented instructions), as independent controllers (for example, Pošta Slovenije), or as joint controllers together with us. The categories of recipients are:
- IT Services and Infrastructure Providers
- Order Fulfillment Services
- Analytics Providers
- Marketing Platforms
- Third-party Advertising Providers
- Referral Program Partners
- Payment Processors
- Other Services
- Affiliates and subsidiaries
- Chipolo Inc.
This list may change from time to time. We may share information that can be used to personally identify your device (e.g. persistent identifiers such as IDFA, IDFV, advertising ID and IP address) for the purposes of delivering our Services, displaying advertisements, conducting analysis and research, and measuring our Data Processing Partners' advertising campaign performance.
For the third-party advertising providers listed above, the provider's role depends on the specific product and configuration. For some functions (such as certain conversion measurements carried out on our documented instructions), the provider acts as our processor. For others, the provider acts as an independent controller that uses the data for its own purposes under its own privacy policy. In broad terms, we decide which audiences should see our advertising, while the provider operates the advertising platform and the underlying technologies. You may exercise your data protection rights against us for the processing we control, and directly against the relevant provider for the processing it controls, and you can opt out of this advertising as described in the "Cookies and similar technologies" and "Additional rights for US residents" sections.
The privacy policies of Data Processing Partners may include additional terms and disclosures regarding their data collection and use practices and tracking technologies. We encourage you to review those policies to learn more about their use of cookies and similar tracking technologies.
We cannot guarantee that our Data Processing Partners will always adhere to their contractual or legal obligations. We strive to protect the information shared with them, and where they act as independent controllers, their use of your information is governed by their own privacy policies.
We may also release your information as mandated by law, such as to respond to binding requests from courts or public authorities, investigate fraud, respond to a government request, enforce or apply our rights, or protect the rights, property, or safety of us or our users, or others. This includes exchanging information with other companies and organizations for fraud protection.
Rakuten Advertising
We partner with Rakuten Advertising, who may collect Personal Information when you interact with our site. The collection and use of this information are subject to the privacy policy located here: https://rakutenadvertising.com/privacy-policy/
Your rights:
https://rakutenadvertising.com/legal-notices/privacy-request-forms/
Cookies and similar technologies
We and our analytics service providers use technologies such as cookies, scripts, advertising IDs and tags to identify a user's device and to remember things about your visit. For details, please consult our Cookie Policy.
Your rights in relation to your Personal Information
You have the following rights in relation to your Personal Information, which you can exercise by writing to the following address privacy@chipolo.net:
- To request access to your Personal Information and information related to our use and processing of your Personal Information;
- To request the correction or deletion of your Personal Information;
- To request that we restrict our use of your Personal Information if technically viable;
- To receive Personal Information which you have provided to us in a structured, commonly used and machine-readable format (e.g. an Excel spreadsheet) and the right to have that Personal Information transferred to another data controller (including a third-party data controller);
- To object to the processing of your Personal Information for certain purposes (for further information, see the section below entitled "Your right to object to the processing of Personal Information for certain purposes");
- To withdraw your consent to our use of your Personal Information at any time where we rely on your consent to use or process that Personal Information. If you withdraw your consent, this will not affect the lawfulness of our use and processing of your Personal Information on the basis of your consent before the point in time when you withdraw your consent.
In accordance with applicable data protection laws, including the ZVOP-2 and the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Article 77 GDPR). For the purposes of Slovenia, this is the Information Commissioner, the contact details of which are available here: www.ip-rs.si
You also have the right to an effective judicial remedy (Article 79 GDPR). In Slovenia, this includes the possibility to seek judicial protection before the competent courts.
For further information about your rights in relation to your Personal Information, including certain limitations that apply to some of those rights, please see Articles 12-23 of the General Data Protection Regulation (GDPR).
We will respond to your request without undue delay and in any event within one month of receipt of the request, in accordance with Article 12(3) GDPR. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. In such cases, we will inform you of the extension and the reasons for the delay within one month of receiving your request.
We may refuse to act on a request or charge a reasonable fee where requests are manifestly unfounded or excessive, in particular because of their repetitive character, in accordance with Article 12(5) GDPR.
In such cases, we will inform you without undue delay of the reasons for not taking action and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
Your right to object to the processing of Personal Information for certain purposes
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Information where such processing is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.
In such cases, we will no longer process your Personal Information unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
You also have the right to object at any time to the processing of your Personal Information for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. If you object, your Personal Information will no longer be processed for these purposes.
You can exercise your right to object to direct marketing at any time by:
Clicking the unsubscribe link included in any marketing email we send you;
- Sending an email to privacy@chipolo.net asking that we stop sending you marketing communications.
Whenever you object to direct marketing from us by a different communication method from that of the marketing communications you have received from us, you must provide us with your name and sufficient information to enable us to identify you in relation to the communications you have received.
Security safeguards
We take appropriate technical and organizational measures to secure your Personal Information and to protect it against unauthorized or unlawful use or processing as well as against the accidental loss or destruction of, or damage to, your Personal Information, including:
- Only sharing and providing access to your Personal Information to the minimum extent necessary and subject to confidentiality restrictions;
- Training our employees about the importance of confidentiality and maintaining the privacy and security of your information;
- Committing to taking appropriate disciplinary measures to enforce our employees' privacy responsibilities;
- Updating and testing our security technology on an ongoing basis;
- Using secure server providers to store your Personal Information;
- Requiring proof of identity from any individual who requests access to Personal Information;
- Appointing an independent data protection officer.
Although we make good faith efforts to store the information collected on the Service in a secure operating environment that is not available to the public, we cannot guarantee the absolute security of that information during its transmission or its storage on our systems. Further, while we attempt to ensure the integrity and security of our network and systems, we cannot guarantee that our security measures will prevent third-party "hackers" from illegally obtaining access to this information. We do not warrant or represent that your information will be protected against loss, misuse, or alteration by third parties. No method of transmission over the Internet or method of electronic storage is 100% secure.
Data breach notification
In the event of a Personal Information breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (such as the Slovenian Information Commissioner) without undue delay and, where feasible, not later than 72 hours after having become aware of it. If the data breach is likely to result in a high risk to your rights and freedoms, we will also communicate the Personal Information breach to you without undue delay, outlining the nature of the breach, its likely consequences and the steps we are taking to mitigate any potential impacts.
For Canadian residents, where a breach of security safeguards creates a real risk of significant harm, we will report the breach to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. We maintain records of breaches as required under PIPEDA.
Data retention
We retain your information:
- For as long as you have not deleted your account;
- To comply with any legal obligation to continue to process your information, such as any record-keeping and tax obligations imposed by applicable law or where we have any other legal basis to continue to process your Personal Information, such as your consent;
- To retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
As indicated above, we will store your information for no longer than necessary. When information is no longer needed, we will delete it using reasonable measures to protect the information from unauthorized access or use.
For more information on where and how long your Personal Information is stored, and for more information on your rights of erasure and portability, please contact us at privacy@chipolo.net.
Our policy regarding children
We do not knowingly collect or solicit Personal Information from or direct or target interest-based advertising to anyone under the age of sixteen (16) or knowingly allow such persons to use our Services. If you are under 16, please do not send any information about yourself to us, including your name, address, telephone number, or email address. No one under the age of 16 may provide any Personal Information. In the event that we learn that we have collected Personal Information from a child under age 16, we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under the age of 16, please contact us at privacy@chipolo.net.
International transfer
We may transfer your Personal Information to affiliated entities and to third-party service providers located in countries outside your country of residence, including outside the European Economic Area (EEA).
Where Personal Information is transferred outside the EEA, we ensure that an adequate level of data protection is provided in accordance with applicable data protection laws.
In particular, transfers may take place:
To countries that are subject to an adequacy decision by the European Commission (Article 45 GDPR), or on the basis of appropriate safeguards pursuant to Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission.
- For transfers to the United States, where the recipient is certified under the EU-US Data Privacy Framework (DPF), we may rely on the European Commission's adequacy decision for the DPF. Where the recipient is not DPF-certified, we rely on appropriate safeguards under Article 46 GDPR, in particular the Standard Contractual Clauses.
Where required, we assess whether the laws of the destination country ensure an adequate level of protection and implement supplementary measures where necessary to protect your Personal Information.
You may request further information about the safeguards we use for international data transfers by contacting us at privacy@chipolo.net.
Data protection officer
Our data protection officer is Vesna Stanković - ITLAW, legal consultancy, Vesna Stanković s.p.
You can get in touch with our DPO at privacy@chipolo.net.
Additional rights for US residents
If you are a resident of a US state that grants specific privacy rights and if the applicable legal thresholds are met, you may have additional rights under applicable state law, including the right to request access to, correction of, or deletion of your Personal Information, and the right to opt out of certain processing activities. We will honor such rights where required by applicable law.
Certain US state privacy laws (for example, the California Consumer Privacy Act, as amended by the CPRA) treat precise geolocation as "sensitive personal information". Because locating your items is the core function of our Services, we use precise location data only for the purposes described in this Privacy Policy - principally to provide the Services and help you find your items, together with related security, functionality, and support. Any use of your location for promotional or personalized offers is carried out only with your separate consent, as described in the "Location Information" section. We do not use your precise geolocation to infer characteristics about you, and we do not sell it. Where applicable state law grants this right, you may limit our use and disclosure of your sensitive personal information to these purposes by contacting us at privacy@chipolo.net.
We do not sell your Personal Information in exchange for money. However, apart from service providers who process data on our behalf under contractual obligations, we may share online identifiers, IP addresses, device IDs, and browsing activity with third-party advertising partners (such as Google, Meta, TikTok, and Rakuten) to deliver personalized, cross-context behavioral advertising. Under certain US state laws, this sharing may be considered a "sale" or "sharing" of Personal Information for targeted advertising, and you have the right to opt out of it.
You can manage your preferences or opt out directly via our Cookie Policy page (also accessible at any time via the "Cookie policy" link in our Website footer) by toggling off "FOR PERSONALIZATION" and "FOR USER DATA" toggles.
You may also opt out by enabling a recognized Universal Opt-Out Mechanism in your browser, such as the Global Privacy Control (GPC) signal.
Subject to applicable law, you may also request access to, correction of, or deletion of your Personal Information by contacting us at privacy@chipolo.net.
Additional rights for Canadian residents
If you are a resident of Canada, the following additional provisions apply to our collection, use and disclosure of your Personal Information under the Personal Information Protection and Electronic Documents Act (PIPEDA).
Accountability
Chipolo remains accountable for Personal Information transferred to a third party for processing on our behalf, including our order fulfillment partners. Using a service provider does not transfer that accountability. You may direct any question, access request or complaint concerning your Personal Information to privacy@chipolo.net, whichever Chipolo entity or service provider handled it.
Processing outside Canada
Personal Information relating to Canadian orders is processed in the United States, including by our fulfillment partner ShipMonk and other service providers listed in this Privacy Policy. While that information is in another country, it is subject to the laws of that country and may be accessible to its courts, law enforcement authorities and national security authorities under those laws. We require our service providers, through contract, to protect your Personal Information with safeguards comparable to those we apply ourselves.
Access, correction and response times
You may request access to your Personal Information and to information about how it has been used and to whom it has been disclosed. You may also challenge its accuracy and completeness. We will respond within 30 days of receiving your request. Where an extension is permitted, we will notify you within that 30 day period of the extension and the reason for it. Access is provided at no cost or at minimal cost.
Complaints
If you are not satisfied with how we have handled your Personal Information or your request, you may complain to us at privacy@chipolo.net. You also have the right to complain to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.
Additional rights for South Korean residents
If you are a resident of the Republic of Korea, the following additional provisions apply to our collection and processing of your Personal Information in accordance with the Personal Information Protection Act (PIPA) and the guidelines of the Korea Internet & Security Agency (KISA).
Legal basis for processing
Where our standard Privacy Policy outlines "legitimate interests" as the legal basis for processing your data, for residents of South Korea, we rely on your explicit, prior consent for such processing activities, unless otherwise legally permitted by PIPA (such as processing strictly necessary for the performance of a contract).
Procedure and method of data destruction
When your Personal Information is no longer required (either because the retention period has expired, you have withdrawn your consent, or the purpose of processing has been achieved), we will destroy the data without delay. Our specific destruction methods are as follows:
- Electronic data is permanently and irreversibly deleted using technical methods that render the files unrecoverable.
- Physical paper records are destroyed via cross-cut shredding or incineration.
Overseas transfer of Personal Information
To provide and operate our Services, your Personal Information may be transferred to, stored, and processed on servers located overseas.
- Transfers to the EU/EEA
- Cross-border transfers to the European Union are conducted lawfully without requiring separate consent, based on the PIPC's (Personal Information Protection Commission) official "recognition of equivalence" regarding the EU's data protection standards.
- Transfers to the US
- Your Personal Information may also be transferred to the United States (such as to our US subsidiary or specific US-based Data Processing Partners). However, this transfer will only be conducted upon obtaining your explicit, prior consent.
All transferred data is strictly limited to the purposes and retention periods outlined in the "Purposes of data processing" and "Data retention" sections of this policy. You may refuse or withdraw your consent to US data transfers by contacting our Privacy Team; however, please note that doing so may prevent us from providing you with certain functionalities of our Services.
Chief Privacy Officer (CPO) and grievance handling
To protect your Personal Information and efficiently handle any complaints or inquiries related to South Korean privacy laws, we have designated Vesna Stanković as our Chief Privacy Officer (CPO).
You can get in touch with our Chief Privacy Officer at privacy@chipolo.net.
Changes to this Privacy Policy
We will occasionally update this Privacy Policy as necessary to protect our users, furnish current information, and respond to legal and technical changes. If we make any material changes, we will notify you by email (sent to the email address specified in your account) or by means of a notice on our Website prior to the change becoming effective. We encourage you to periodically review our Website for the latest information on our privacy practices.
If you have any questions or concerns about our data privacy practices, or if you have any requests for resolving issues with your Personal Information, please contact us at privacy@chipolo.net. Customer support is available in English.
