Privacy policy
Polingo GmbH – Website and Pre-Order Shop at polingo.io
As of: September 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Polingo GmbH
Mergenthalerallee 73–75
65760 Eschborn, Germany
represented by Managing Director Nicole Spielmann
Email: hello@polingo.io
Commercial Register: Local Court of Frankfurt am Main, HRB 144392
Contact for data protection matters:
Nicole Spielmann
Email: hello@polingo.io
If you have any questions regarding data protection, you can contact our data protection contact person directly or reach us using the contact details above.
2. General Information
2.1 Scope
This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data when visiting our website, polingo.io, and when using our online shop, including pre-orders and deposits.
A separate Privacy Policy applies to the Polingo app and the associated use of our voice companion products. This is available to you in the app.
2.2 Children and Adolescents
Our website and shop are aimed at adults, in particular parents and legal guardians. We do not knowingly collect personal data from children under the age of 16 through our website. The processing of data in connection with children’s use of the Polingo app is governed by the app’s separate Privacy Policy.
2.3 Legal Bases
Where we obtain consent for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract or for the implementation of pre-contractual measures, Article 6(1)(b) GDPR serves as the legal basis. Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR serves as the legal basis. Where processing is necessary for the purposes of a legitimate interest and the interests, fundamental rights and freedoms of the data subject do not override that interest, Article 6(1)(f) GDPR serves as the legal basis. In addition, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to the storage of, and access to, information on your device, for example through cookies.
2.4 Recipients and Data Processing on Our Behalf
We use external service providers to operate our website and shop. These providers act on our behalf as processors pursuant to Article 28 GDPR. We have entered into data processing agreements with them. We only disclose data otherwise where this is necessary for the performance of a contract, for example to payment and shipping providers, where you have given your consent, or where we are legally obliged to do so.
2.5 Transfers to Third Countries
Some of the service providers we use process data outside the European Economic Area (EEA), in particular in Canada and the United States. The European Commission has issued an adequacy decision for Canada. Transfers to the United States are based on the EU–US Data Privacy Framework (DPF), where the recipient is certified under it, and additionally or alternatively on the European Commission’s Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. We will provide information on the relevant safeguards upon request.
2.6 Retention Period
We retain personal data only for as long as necessary for the respective purpose. Once the purpose no longer applies, the data will be deleted unless statutory retention obligations prevent this. In particular, we retain commercial and accounting records for six years in accordance with Section 257 of the German Commercial Code (HGB) and for ten years in accordance with Section 147 of the German Fiscal Code (AO). Processing is restricted during these periods.
2.7 Data Security
The website is provided exclusively via a TLS-encrypted connection (https). Payment data is not processed by us, but only by the payment providers named in Section 8.
2.8 No Automated Decision-Making
No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.
3. Hosting and Shop System: Shopify
Our website and shop are operated using the Shopify e-commerce platform. The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, a subsidiary of Shopify Inc., 151 O’Connor Street, Ottawa, Ontario K2P 2L8, Canada.
Shopify provides the technical infrastructure, including hosting, content delivery network, shop system and checkout. All data collected through the website, including order, customer and access data, is stored on Shopify servers. These servers are located in the EU, Canada and the United States. According to Shopify, Shopify Inc. is certified under the EU–US Data Privacy Framework. The European Commission’s Standard Contractual Clauses also apply. We have entered into a data processing agreement with Shopify, the Shopify Data Processing Addendum.
The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the secure, reliable and efficient provision of our online offering. Where data is processed for the handling of orders, Article 6(1)(b) GDPR is the legal basis.
Further information: https://www.shopify.com/de/legal/datenschutz
3.1 Server Log Files
Whenever the website is accessed, information that your browser transmits is automatically recorded in server log files: IP address, date and time of access, page accessed, referrer URL, browser type and version, and operating system. This data is not combined with other data sources. Processing is carried out on the basis of Article 6(1)(f) GDPR to ensure operation, security and error analysis. Log files are deleted after a short period unless further retention is required as evidence in the event of a security incident.
4. Cookies and Consent Management
Our website uses cookies and similar technologies, such as local storage. Cookies are small text files stored on your device. We distinguish between:
- Technically necessary cookies: These are required for the operation of the website, for example for the shopping cart, checkout, security functions and storing your cookie preferences. The legal basis is Section 25(2) No. 2 TDDDG in conjunction with Article 6(1)(f) GDPR.
- Non-essential cookies for analytics and marketing: We only use these with your express consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. Details can be found in Section 11.
We use Shopify’s consent banner to obtain and manage your consent. When you first visit the website, you will be asked for your consent. You may withdraw your consent at any time with effect for the future or change your selection by reopening the cookie settings using the relevant link in the website footer. Your selection is stored in a cookie so that it can be considered during future visits.
You can also configure your browser to permit cookies only in individual cases, reject them generally, or delete them automatically when the browser is closed. Disabling cookies may limit the functionality of the shop.
5. Contacting Us
If you contact us by email, telephone or through the contact form on our website, we process the data you provide in order to handle your request. Through the contact form, we collect your name, email address and message, as well as your telephone number on a voluntary basis. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns the conclusion or performance of a contract; otherwise, Article 6(1)(f) GDPR applies on the basis of our legitimate interest in responding to your request.
The data will be deleted once your request has been fully resolved and no statutory retention obligations prevent deletion. We retain business correspondence in accordance with commercial and tax retention periods.
6. Customer Account
You may optionally create a customer account in our shop. Your email address, name, address and order history will be stored for this purpose. The customer account allows you to view orders and pre-orders and to store your information for future orders. The legal basis is Article 6(1)(b) GDPR.
When using Shop Pay by Shopify, your payment and address data may be stored by Shopify so that it can be reused for future purchases in Shopify shops. This occurs only if you actively select this option during checkout; Shopify acts as an independent controller in this respect.
You may request the deletion of your customer account at any time by emailing hello@polingo.io. Data that we must continue to retain due to statutory retention obligations will be blocked from further processing.
7. Orders, Pre-Orders and Deposits
When you place an order or pre-order through our shop, we process the data required for fulfilment:
- First and last name, billing address and delivery address
- Email address and, where applicable, telephone number for order confirmation, shipping information and enquiries
- Order data, including products, prices, time of order and order number
- Payment method and payment status; actual payment data is processed exclusively by the relevant payment provider
The purpose of processing is the performance of the purchase agreement, including pre-orders, deposits, management of the outstanding payment, delivery, invoicing, warranty, cancellation and refund. The legal basis is Article 6(1)(b) GDPR. Contract and accounting documents are retained on the basis of Article 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO.
7.1 Special Features of Pre-Orders
For a pre-order with a deposit, we store your data until the order has been fully processed, meaning delivery and full payment, or until the transaction is reversed. As part of the contractual process, we will inform you by email about the production status, expected delivery date and due date of the remaining payment. These messages form part of the contract processing and are not newsletters; they do not contain advertising for other products unless you have separately consented to this.
7.2 Disclosure to Third Parties
To process the contract, we disclose data to the following recipients only to the extent necessary: payment providers, as described in Section 8; shipping providers, as described in Section 9; our external tax and accounting office; and legal advisers only in the event of a dispute. Data is not disclosed for advertising purposes.
7.3 Fraud Prevention
Shopify automatically checks orders for signs of fraud, for example by comparing the IP address with billing and delivery addresses. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in preventing payment defaults and misuse. Orders are not automatically rejected on this basis; suspicious orders are reviewed manually by us.
8. Payment Providers
At checkout, you can choose from various payment methods. Data required for payment, including name, billing address, amount, order number and card details for card payments, is transmitted directly to the relevant payment provider and processed by that provider under its own responsibility. We do not receive complete card details. The legal basis is Article 6(1)(b) GDPR.
8.1 Shopify Payments
Shopify Payments is offered by Shopify International Limited, whose address is listed in Section 3. Technical payment processing is carried out in cooperation with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Shopify Payments processes credit and debit card payments, as well as Apple Pay and Google Pay where activated.
Privacy information: https://www.shopify.com/de/legal/datenschutz and https://stripe.com/de/privacy
8.2 PayPal
When paying through PayPal, your data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out a credit assessment for certain payment methods, such as direct debit or purchase on account through PayPal. PayPal is independently responsible for this.
Privacy information: https://www.paypal.com/de/legalhub/privacy-full
8.3 Klarna
When paying through Klarna, including invoice, instalment purchase or instant bank transfer, your data is transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna carries out identity and credit checks for invoice and instalment purchases and is independently responsible for this.
Privacy information: https://www.klarna.com/de/datenschutz/
9. Shipping
To deliver your order, we transmit your name and delivery address to our appointed shipping provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. The legal basis is Article 6(1)(b) GDPR.
We transmit your email address and/or telephone number to the shipping provider only where this is necessary for delivery, in particular for parcel notifications and delivery coordination. The legal basis is Article 6(1)(b) GDPR.
10. Newsletter
If you subscribe to our newsletter, we process your email address in order to send you information about Polingo, our products, news and offers. The legal basis is your consent pursuant to Article 6(1)(a) GDPR.
To document your consent, we record the time of registration. The legal basis is Article 6(1)(f) GDPR based on our legitimate interest in being able to demonstrate consent.
You may unsubscribe from the newsletter at any time using the unsubscribe link at the end of each email or by emailing hello@polingo.io. After unsubscribing, your email address will be removed from the mailing list; we may retain it on a suppression list to ensure that you do not receive further newsletters, pursuant to Article 6(1)(f) GDPR.
We use Shopify Email, provided by Shopify International Limited, as our processor for managing and sending newsletters. Our newsletters may contain tracking pixels that allow us to evaluate whether and when an email was opened and which links were clicked. This evaluation is covered by your consent and is used to improve our content.
10.1 Marketing to Existing Customers
If you have purchased or pre-ordered a product from us, we may send you information about similar products in our range by email in accordance with Section 7(3) of the German Unfair Competition Act (UWG), without requiring separate consent. The legal basis is Article 6(1)(f) GDPR. You may object at any time without incurring costs other than transmission costs at the basic rates, using the unsubscribe link in every email or by emailing hello@polingo.io.
11. Web Analytics
Shopify provides us with aggregated statistics regarding visitor numbers, origin, conversions and shopping cart behaviour through Shopify Analytics. Shopify processes this data as a processor; its address is listed in Section 3. Where non-essential cookies are set for this purpose, this occurs exclusively with your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. Without your consent through the cookie banner, these cookies will not be set. You may withdraw your consent at any time through the cookie settings.
We currently do not use any additional third-party analytics or marketing services. In particular, neither Google Analytics nor the Meta Pixel is integrated.
12. Social Media Presence
We maintain an Instagram profile in order to communicate with interested parties and customers and to provide information about our products. Our website contains only links to these profiles and no embedded social media plugins; no data is transferred to the platforms merely by visiting our website.
When you visit or interact with our profiles, the relevant platform operator processes your data under its own responsibility. Where platforms provide us with aggregated statistics on the use of our profiles, such as Instagram Insights, we are jointly responsible with the operator within the meaning of Article 26 GDPR. The legal basis for our processing is Article 6(1)(f) GDPR; our legitimate interest lies in public relations and communication. You may exercise your data protection rights both against us and against the respective platform operator. We recommend exercising these rights directly with the operator, as only the operator has access to the complete data.
13. Your Rights
You have the following rights in relation to your personal data:
- Access to processed data, Article 15 GDPR
- Rectification of inaccurate data, Article 16 GDPR
- Erasure, provided that no retention obligations prevent it, Article 17 GDPR
- Restriction of processing, Article 18 GDPR
- Data portability, Article 20 GDPR
- Withdrawal of consent with effect for the future, Article 7(3) GDPR
To exercise your rights, an informal email to hello@polingo.io or a letter to the address listed in Section 1 is sufficient.
13.1 Right to Object, Article 21 GDPR
Where we process your data on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where your data is processed for direct marketing purposes, you may object at any time without giving reasons; we will then no longer process your data for this purpose.
13.2 Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR. The authority responsible for us is:
The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Telephone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
https://datenschutz.hessen.de
14. Changes to This Privacy Policy
We will amend this Privacy Policy if the legal situation, our website or the services we use change. The current version is available at polingo.io/datenschutz. In the case of material changes that require your consent, we will obtain your consent again.