Privacy policy

This notice explains how Polo Exchange handles website enquiries, browser storage and optional analytics.

Who handles your information

PX INTERNATIONAL LIMITED is responsible for the personal information used to respond to Polo Exchange enquiries. Contact Ata for enquiries or privacy requests at ata@poloexchange.com.

Company

PX INTERNATIONAL LIMITED

Incorporated in

Hong Kong

Business registration no.

72295889

Business address

Rooms 1008–1009, 10/F, Tower B, Regent Centre
63–73 Wo Yi Hop Road, Kwai Chung
New Territories, Hong Kong

What we collect and why

The enquiry form collects your name, email address, optional message, any watch references you include and your acknowledgement of this notice. Your name and email are required so we can respond. Please do not include sensitive personal information.

We use these details to answer your enquiry and discuss a possible business relationship. Where GDPR applies, we rely on our legitimate interests in responding to business contacts and protecting the form against misuse. If you enquire about a contract with you personally, the steps you request before entering that contract may instead be the relevant basis. The checkbox acknowledges this notice; it is not consent to marketing. We do not use enquiries for automated decisions or profiling.

How your enquiry reaches us

Resend sends the message to Polo Exchange’s shared enquiries mailbox, enquiries@poloexchange.com, with your email address as the reply address. Ata handles enquiries; authorised IT support can access this mailbox when needed to operate and maintain the service. New messages and contact details are not stored in a separate website enquiry inbox. Limited delivery records, protected identifiers derived from submission information and email or IP addresses, and short-lived rate counters help prevent duplicate sends and abuse.

We use Cloudflare, through the Polo Exchange account, to host, deliver and secure the website and process form submissions; Resend to deliver form enquiries; and Microsoft 365 to receive and manage email. Our authorised technical team, Generative Studio, supports these services on our behalf. Access is limited to what is needed to operate the website, maintain security and respond to enquiries. Hosting providers also process technical request and security information to provide their services. We do not sell enquiry information or pass it to other distributors for their own marketing.

If you choose direct email or WhatsApp, your draft and selected watch references are passed to that service when you use the link. Those messages bypass the website’s Resend delivery route. WhatsApp processes information under its own privacy policy.

Protecting the enquiry form

We use Cloudflare Turnstile to check submissions for automated abuse. When the enquiry form is available, Cloudflare processes technical signals such as your IP address, browser information and the website origin. We use this security check to protect our enquiry service, separately from optional Analytics. The verification token is used only to check your submission and is not included in the enquiry email or stored in our delivery database. Cloudflare also uses these signals to improve its bot detection under its Turnstile Privacy Addendum. Our widget does not enable pre-clearance cookies. You can contact us directly by email if you cannot complete verification.

How long we keep it

Messages in our shared enquiries mailbox are subject to a 365-day deletion policy, normally measured from when each message was received or created. Microsoft processes deletion in batches, so removal may occur after that period. Deleted messages remain recoverable for a further 14 days. For a new or low-volume mailbox, processing may need to be requested manually. This policy applies to the shared mailbox, not automatically to copies in other mailboxes or WhatsApp. For correspondence held elsewhere that does not lead to a business relationship, we review and delete it within 12 months of the last meaningful contact, or sooner when no longer needed. Records needed for an ongoing relationship, a legal obligation or a dispute may be held separately for that purpose. The 12-month period is our retention policy, not a fixed period required by GDPR.

Website delivery records become eligible for deletion after 30 days. Cleanup is scheduled daily and also runs in batches during later form activity; removal is not guaranteed at the exact 30-day boundary. Personal abuse counters use hourly windows and a daily IP-based limit. Separate daily and monthly sending totals contain no personal identifiers. Expired counters are cleared by the same cleanup processes. Older preview enquiries remain access-restricted and are reviewed separately.

Resend publishes a standard email-content and delivery-log retention period of 30 days, with backups retained for 7 days. Email, hosting, security and account records may follow separate provider retention arrangements. Deleting a website delivery record does not delete the email from a mailbox.

International processing

Our service providers operate internationally, including in the United States, so information may be processed outside your country. Resend stores customer data in the United States. Cloudflare’s data-processing addendum, Resend’s data-processing agreement and Microsoft’s product data-protection terms describe their safeguards, including standard contractual clauses where applicable. These safeguards depend on the service and the relevant transfer. Contact ata@poloexchange.com for information about the arrangements relevant to your enquiry.

Cookies and browser storage

You can accept or reject optional storage, or choose categories in Cookie settings in the footer. Optional categories are off until you choose them. Changing your mind is as easy as reopening those settings. Refusing does not prevent browsing or sending an enquiry.

• Essential: your privacy choices are stored in local storage for 180 days (polo-privacy-v2), together with the choice date and the version of the notice and settings shown. A material change to these settings or activation of Analytics requires a fresh choice. Your requested shortlist uses local storage (polo-exchange-shortlist-v1) until you clear it or your browser data. Hosting and sign-in services use storage to provide and secure the website. Cloudflare may use necessary security cookies when its security checks are active. Private reviewer areas use CF_Authorization for their authorised sign-in session; public browsing does not require this sign-in.
• Presentation preferences, optional: with your permission, session storage remembers intro playback and motion preferences (polo-intro-seen, polo-opening-film-20261026 and polo-smooth). These values last for the browser session and are removed when you withdraw permission.
• Analytics, optional: Google Analytics loads only after you accept Analytics in our privacy choices. It measures page visits and technical information about the device and visit. Rejecting Analytics keeps the Google tag off. It excludes enquiry text, names, email addresses and selected watch lists from its page-view events. Its first-party _ga and _ga_* cookies are limited to 180 days without renewal on activity. Advertising features are off.

We rely on consent for optional storage and Analytics where consent is required. Withdrawing Analytics consent stops our tag and removes its first-party cookies; data already collected is not automatically erased. Google’s data-processing terms and privacy policy explain its processing and international-transfer arrangements. User-level and event-level retention is set to 2 months, without resetting on new activity. Aggregated reports are not subject to the same retention setting.

Your choices and rights

Contact ata@poloexchange.com to request access to or correction of your personal information, or to ask us to delete it. Where the relevant law applies, you may also object to processing based on legitimate interests and request restriction or portability. Rights depend on the circumstances and applicable law. We may need to verify your identity. Hong Kong access and correction requests generally have a 40-day response limit; where GDPR applies, the usual limit is one month, subject to its permitted extensions.

You may complain to Hong Kong’s Privacy Commissioner for Personal Data or another competent data-protection authority. EU authorities are listed by the European Data Protection Board; UK information is available from the Information Commissioner’s Office.

Last updated: 11 November 2026. Notice version: 2026-11-11-enquiries-verification.