Privacy policy
PRIVACY DISCLOSURES FOR THE SPECIAL OLYMPICS WEBSHOP
Last Updated: August 14, 2026
These Privacy Disclosures apply specifically to the Special Olympics webshop (the “Store”) and supplement the existing Special Olympics Privacy and Data Security Policy available at:
https://www.specialolympics.org/privacy-and-data-security-policy
The Special Olympics Privacy and Data Security Policy continues to apply generally to the Store and related services. These Privacy Disclosures are intended to address ecommerce-specific processing activities associated with the Store.
- Ecommerce Platform and Merchant-of-Record Structure
The Store is operated using the Shopify ecommerce platform and related service providers. Shopify acts as a data processor on behalf of Special Olympics, Inc. in connection with the operation of the Store. Shopify’s privacy policy is available at https://www.shopify.com/legal/privacy.
Special Olympics, Inc. (“SOI,” “we,” “our,” or “us”) is the data controller responsible for personal information collected through the Store, except where Global-e acts as an independent controller as described below. SOI is a nonprofit corporation incorporated in the District of Columbia, United States, with its principal place of business at 2600 Virginia Avenue NW, Washington, DC 20037, United States.
For transactions with customers in the United States, the European Union, and Norway, Special Olympics, Inc. (“SOI,” “we,” “our,” or “us”) acts as the seller and merchant of record. For transactions with customers in all other countries, sales are processed by our partner Global-e, which acts as merchant of record and seller for those transactions.
Where Global-e acts as merchant of record, Global-e may process personal information necessary to:
• process payments;
• calculate taxes and duties;
• facilitate international shipping and customs clearance;
• conduct fraud prevention and security activities; and
• support transaction-related customer service functions.
In connection with these activities, Global-e may independently determine certain processing purposes and means and may therefore act as an independent controller of certain personal information under applicable privacy laws.
For transactions processed by Global-e, additional information regarding Global-e’s privacy practices is available in Global-e’s privacy policy at https://www.global-e.com/legal/privacy-policy.
- Information Collected Through the Store
In connection with the operation of the Store, our service providers and we may collect:
• contact and shipping information;
• billing and payment-related information;
• order and transaction details;
• communications relating to customer support;
• device/browser information;
• localization and currency preferences; and
• cookie and analytics information, subject to applicable consent requirements.
Payment card transactions on the Store are processed by Shopify Payments. Payment card details (such as card numbers and security codes) are collected and processed directly by Shopify Payments and are not stored by Special Olympics, Inc. Shopify Payments processes payment data in accordance with Payment Card Industry Data Security Standards (PCI-DSS). For further information about how Shopify Payments handles payment data, please refer to Shopify’s privacy policy at https://www.shopify.com/legal/privacy.
- How We Use Information
Personal information collected through the Store may be used to:
• process and fulfill orders;
• provide customer support;
• process returns, refunds, and exchanges;
• communicate regarding orders and transactions;
• maintain and improve Store functionality;
• detect fraud, abuse, and security incidents;
• comply with legal and regulatory obligations; and
• send marketing communications where permitted by law or where consent has been provided.
We do not make solely automated decisions about users that produce legal or similarly significant effects. Automated fraud screening may be applied to transactions by Shopify Payments and Global-e as part of their standard fraud prevention operations; however, such screening does not result in automated decisions with legal effect on users beyond the standard transaction approval or decline process. Users who believe a transaction has been incorrectly declined may contact us at privacy@specialolympics.org.
- Sharing of Information
Personal information collected through the Store is shared only as follows:
• Shopify: as the ecommerce platform provider and data processor, to operate the Store and process transactions;
• Global-e: as merchant of record for transactions in countries outside the United States, the European Union, and Norway, for the purposes described above;
• Payment processors: Shopify Payments processes payment card transactions as described above;
• Service providers: other vendors engaged by SOI to support Store operations (such as customer support, logistics, and fraud prevention), who are authorized to use personal information only as necessary to provide services on SOI’s behalf; and
• Legal and regulatory: where required by applicable law, regulation, or legal process, or to protect the safety, rights, or property of SOI or others.
Personal information collected through the Store is not shared with other Special Olympics entities, Accredited Programs, or Local Organizing Committees, except where a customer makes a donation through the Store, in which case donation-related information may be shared in accordance with the Special Olympics Privacy and Data Security Policy.
Where applicable under GDPR, UK GDPR, or similar laws, processing is generally based on:
• performance of a contract (for example, processing and fulfilling orders and providing customer support);
• compliance with legal obligations (for example, tax, accounting, and fraud reporting requirements);
• our legitimate interests, which include the operation and security of the Store, fraud prevention and detection, improvement of Store functionality, and resolution of customer support matters — in each case where those interests are not overridden by the interests or fundamental rights of users; and/or
• user consent where required by applicable law (for example, for non-essential cookies and marketing communications).
- Cookies and Similar Technologies
The Store uses cookies and similar technologies to support:
• shopping cart functionality;
• localization and currency preferences;
• fraud prevention and website security;
• website analytics; and
• user experience functionality.
Certain cookies are necessary for the operation of the Store and do not require consent under applicable law. These include cookies used by Shopify to support core platform functionality and Google reCAPTCHA cookies used to distinguish between human users and automated bots for fraud prevention and security purposes. Other cookies, including analytics or marketing cookies, are only activated where required consent has been obtained.
Users may manage cookie preferences, including viewing a list of specific cookies in use and their purposes and durations, through the cookie consent banner available on the Store. Cookie preferences may also be adjusted at any time through browser settings, although disabling certain cookies may affect Store functionality. Withdrawing consent for non-essential cookies does not affect the lawfulness of processing based on consent before its withdrawal.
- Marketing Communications
Users may receive marketing or promotional communications relating to the Store where permitted by law or where consent has been provided.
Users may unsubscribe from marketing communications at any time using the unsubscribe link included in the communication. For residents of Canada, marketing communications are sent in compliance with Canada’s Anti-Spam Legislation (CASL), and consent will be obtained in the manner required by applicable Canadian law.
Transactional communications relating to purchases, shipping, returns, or customer support may still be sent even where marketing communications are declined. We do not share your contact information or personal information with third parties for their own marketing purposes.
- U.S. State Privacy Disclosures
This section provides additional disclosures for residents of U.S. states with applicable consumer privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), and similar laws in effect in Virginia, Colorado, Connecticut, Texas, and other states.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes. We do not share your personal information with third parties for their own marketing purposes.
We do not use personal information collected through the Store for profiling in furtherance of automated decisions that produce legal or similarly significant effects. We do not discriminate against users who exercise their privacy rights under applicable state law.
Payment-related information collected through the Store is processed solely for the purposes of completing your transaction and is not used for any other commercial purpose. To exercise your privacy rights under applicable U.S. state law, please refer to the Your Privacy Rights section below or contact us at privacy@specialolympics.org.
- EU Representative
In accordance with Article 27 of the General Data Protection Regulation (GDPR), Special Olympics, Inc. has designated Special Olympics Ireland as its representative in the European Union for matters relating to the processing of personal data under the GDPR. EU residents and supervisory authorities may contact our EU representative as follows:
Special Olympics Ireland
Sport Ireland Campus, Snugborough Road
Blanchardstown, Dublin 15, D15 PC63
Ireland
Email: privacy@specialolympics.org
The designation of Special Olympics Ireland as EU representative does not constitute a transfer of data controllership. Special Olympics, Inc. remains the data controller responsible for the processing of personal information collected through the Store.
- International Transfers
Personal information collected through the Store may be transferred to and processed in countries outside the user’s country of residence. SOI is based in the United States and processes order and customer data there. Shopify processes data primarily in the United States and Canada. For customers outside the United States, the European Union, and Norway, transactions are processed by Global-e, which operates across multiple international jurisdictions. Where personal information is transferred from the European Economic Area, the United Kingdom, or other jurisdictions that restrict international data transfers, SOI implements appropriate safeguards as described below.
Where personal information is transferred from the European Economic Area, the United Kingdom, or other jurisdictions that restrict international data transfers, Special Olympics, Inc. implements appropriate safeguards in accordance with applicable law. These safeguards may include Standard Contractual Clauses approved by the European Commission, reliance on adequacy decisions, or other lawful transfer mechanisms. For further information regarding the transfer mechanisms applicable to your personal information, please contact us at privacy@specialolympics.org.
- Retention of Information
We retain personal information collected through the Store for as long as reasonably necessary to fulfill the purposes described in these Privacy Disclosures, comply with legal, tax, accounting, and reporting obligations, resolve disputes, and enforce agreements and policies. The following retention periods apply to personal information collected through the Store:
• Order and transaction records (including contact, shipping, and billing information associated with a purchase): retained for 7 years from the date of the transaction, in accordance with applicable tax, accounting, and legal obligations.
• Customer contact and account information (where an account is created): retained for the duration of the active customer relationship and for 7 years thereafter.
• Payment-related data: payment card details are processed by our payment processor and are not stored by SOI beyond the immediate transaction. Transaction metadata is retained for 13 months to support fraud prevention and dispute resolution, or for such longer period as required by our payment processor or applicable law.
• Customer support records: retained for 3 years from the date of resolution of the relevant inquiry or dispute.
• Cookie and analytics data: retained for a maximum of 13 months from the date of collection, in accordance with applicable cookie consent requirements.
• Marketing consent records: retained for the duration of the consent and for 5 years thereafter, to demonstrate compliance with applicable consent requirements.
Where retention of personal information beyond these periods is required by applicable law or regulation, we will retain the information for the minimum period required. At the end of the applicable retention period, personal information is deleted or anonymized in a manner that prevents re-identification.
- Your Privacy Rights
Depending on applicable law and your jurisdiction, you may have rights relating to your personal information, including rights to:
• access personal information;
• request correction or deletion;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• request portability of certain information.
Additional information regarding privacy rights and how to exercise them is available in the Special Olympics Privacy and Data Security Policy. To submit a privacy rights request, please contact us at privacy@specialolympics.org. We will respond to valid requests within the timeframe required by applicable law (generally within 30 days under GDPR and UK GDPR, and within 45 days under applicable U.S. state privacy laws, in each case subject to permitted extensions).
If you are not satisfied with our response, or believe we are processing your personal information unlawfully, you have the right to lodge a complaint with a data protection supervisory authority. Depending on your jurisdiction, the relevant authority may include:
• European Union: The data protection supervisory authority in your EU member state of residence. As Special Olympics Ireland is our designated EU representative, the Irish Data Protection Commission (www.dataprotection.ie) may also be contacted.
• United Kingdom: The Information Commissioner’s Office (ICO) at www.ico.org.uk.
• Australia: The Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
• Other jurisdictions: Please contact the data protection or privacy authority in your country or region of residence.
- Children’s Privacy
The Store is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16 without appropriate parental or guardian consent. If you believe that we have inadvertently collected personal information from a child under 16, please contact us at privacy@specialolympics.org, and we will take prompt steps to delete such information.
For residents of the United States, the Store is not directed to children under 13, and we do not knowingly collect personal information from children under 13 as defined under the Children’s Online Privacy Protection Act (COPPA). Parents or guardians who believe their child under 13 has provided personal information to the Store should contact us at privacy@specialolympics.org.
- Contact Information
Questions regarding these Privacy Disclosures or webshop privacy practices may be directed to:
SOI has appointed a Global Data Privacy Coordinator responsible for overseeing data privacy compliance across Special Olympics organizations. The Global Data Privacy Coordinator may be contacted at privacy@specialolympics.org for matters relating to the processing of personal information, including questions about this policy, requests to exercise privacy rights, or concerns about data protection practices.
Special Olympics, Inc.
2600 Virginia Avenue NW
Washington, DC 20037
United States
Email: privacy@specialolympics.org