Privacy Policy u2014 Polymer 80 Frames

Last updated: October 26, 2023
Version: 2.1

Polymer 80 Frames (“we,” “us,” or “our”) operates the website polymer80frames.com. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information in connection with the sale of Polymer 80 frames and related products. We are committed to compliance with applicable data protection laws, including but not limited to the California Consumer Privacy Act (CCPA) and, where relevant, the General Data Protection Regulation (GDPR). We do not sell your personal data to third parties and do not share it with marketers for promotional purposes.

1. Information We Collect

We collect information that you provide directly to us and information automatically collected during your use of our website. The categories are as follows:

Information You Provide:

Identity & Contact Data: Full name, shipping address, billing address, email address, and phone number.
Transaction & Financial Data: Details of products purchased, order history, and payment information. Note: We do not store full payment card numbers; this data is processed directly by our PCI-DSS compliant payment processor.
Communications Data: Records of your correspondence with our customer support team, including emails and support tickets.
Verification Data: Information required for age and identity verification to ensure compliance with federal and state regulations regarding the sale of firearm components. This may include, but is not limited to, a copy of a government-issued ID (provided only when explicitly required for a specific compliance purpose and handled with extreme security).

Information Collected Automatically:

Technical & Usage Data: Internet protocol (IP) address, browser type, operating system, device information, pages viewed, links clicked, and the dates/times of your visits.
Cookies & Similar Technologies: See Section 4 for detailed information.

2. How We Use Your Information

We use the collected information solely for legitimate business and compliance purposes, including:

Order Fulfillment: To process, ship, and deliver your purchases, and to communicate regarding order status.
Customer Service: To respond to your inquiries, provide support, and manage returns or warranties.
Compliance & Legal Obligations: To verify customer identity and age, maintain records as required by tax and other regulatory authorities (including Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) and state-level regulations), and prevent fraud.
Website Operation: To ensure the technical functionality and security of our website, conduct internal analytics to improve user experience, and prevent malicious activity.
Communication: To send you transactional messages (e.g., order confirmations, shipping notifications). We do not engage in promotional marketing emails.

3. Third-Party Sharing of Information

We share your personal information only with a limited set of third-party service providers essential to our operations and as required by law. We do not sell, rent, or trade your data.

Third-Party Category	Purpose of Sharing	Data Shared
Payment Processors (e.g., Stripe, PayPal)	To securely process your payment transactions.	Contact details, transaction amount, and payment instrument information (handled directly by the processor).
Shipping Carriers (e.g., USPS, UPS, FedEx)	To deliver your purchased products to you.	Name, shipping address, phone number, and order details necessary for delivery.
Tax & Regulatory Authorities	To comply with legal obligations, including sales tax reporting and other regulatory requirements.	Transaction records, customer identity, and address information as mandated by law.
Professional Advisors (e.g., lawyers, accountants)	To obtain professional services in the context of our business operations and legal compliance.	Limited data necessary for the specific service (e.g., transaction records for tax preparation).

All third-party providers are contractually obligated to protect your data and use it only for the services they provide to us.

4. Cookies & Tracking Technologies

We use only first-party cookies and similar technologies. We do not employ third-party advertising or marketing tracking networks.

Essential Cookies: Required for the basic functionality of the website, such as maintaining your session and shopping cart.
Analytics Cookies: We use a first-party analytics service (e.g., a self-hosted or privacy-focused solution) to understand aggregate website traffic and performance. This data is anonymized and not used to identify individual users.

You can control cookie settings through your browser preferences. Disabling essential cookies may impair website functionality.

5. Data Retention Periods

We retain your personal information only as long as necessary for the purposes outlined in this policy, or as required by law. Our standard retention schedule is:

Tax and Compliance Records: 7 years, as required by federal and state tax laws and other regulatory frameworks governing firearm components.
Customer Support Records & Transaction History: 3 years from the date of last interaction to facilitate warranty support and service inquiries.
Website Analytics Data: Anonymized and aggregated data may be retained indefinitely for trend analysis.

After the retention period expires, data is securely deleted or anonymized.

6. Data Security Measures

We implement technical and organizational measures designed to protect your personal information. These include:

Encryption in Transit: Use of HTTPS/TLS protocols for all data transmitted between your browser and our servers.
Encryption at Rest: Sensitive data stored in our databases is encrypted.
Access Controls: Strict limitation of employee access to personal data on a need-to-know basis, governed by strong authentication protocols.
Regular Security Assessments: We periodically review and update our security practices to address evolving risks.
Secure Payment Processing: All payment transactions are handled by certified third-party processors; we do not store full credit card data on our systems.

While we employ robust security practices, no electronic transmission or storage method is 100% secure. We cannot guarantee absolute security.

7. Your Rights & Choices

Depending on your jurisdiction, you may have certain rights regarding your personal data. We will comply with verifiable requests in accordance with applicable law.

Access & Portability: You can request a copy of the personal data we hold about you.
Deletion: You can request the deletion of your personal data, subject to legal exceptions (e.g., our obligation to retain records for compliance).
Correction: You can request correction of inaccurate or incomplete personal data.
Opt-Out of Sale/Sharing: We do not sell your data. For California residents, see Section 9.
Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the information in Section 12. We may need to verify your identity before processing your request.

8. Children’s Privacy

Our website and products are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with information, please contact us immediately. If we learn we have collected such data, we will delete it promptly.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the CCPA/CPRA provides you with specific rights:

Right to Know: You may request, up to twice in a 12-month period, details about the categories and specific pieces of personal information we have collected about you, its sources, purposes for collection, and third parties with whom it is shared.
Right to Delete: Subject to exceptions, you may request deletion of your personal information.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We only share it with service providers as described in Section 3, which is not considered a “sale” under the CCPA.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, a California resident may contact us via the methods in Section 12. We will respond within 45 days as required by law.

10. International Users & GDPR (Where Applicable)

Our business and servers are located in the United States. If you are accessing our site from outside the U.S., including the European Economic Area (EEA) or United Kingdom (UK), your data will be transferred to and processed in the U.S. For individuals protected by the GDPR, we note the following:

Lawful Basis: Our processing is based on the necessity to perform a contract (fulfill