Privacy Policy

What Information Bandier Collects

At Bandier, we gather information through multiple channels to serve our activewear community effectively. When you subscribe to our newsletter, fill out a contact form, or engage with our platform, we collect details you choose to share — your name, email address, and any preferences you communicate about leggings, sports bras, or other studio-to-street gear.

Our systems automatically capture technical data as you browse: your device type, browser version, IP address, pages visited, and time spent exploring our women’s collections or men’s activewear. This usage information helps us understand which Bandier pieces resonate most and how people navigate between our product categories.

We also receive data from third parties. Amazon’s affiliate tracking system reports when visitors click through to purchase featured activewear, and our analytics providers (Google Analytics, Facebook Pixel) supply aggregated behavioral insights. These third-party tools operate under their own privacy frameworks, which we encourage you to review independently.

How Bandier Uses Your Information

We use collected data to improve every touchpoint in your Bandier experience. Email addresses power our newsletter, delivering curated activewear updates, seasonal collection launches, and styling tips from New York’s fitness culture. When you reach out through our contact form, your information enables us to respond to product questions, partnership inquiries, or feedback about our leggings and sports bras.

Technical data guides our site optimization — page load speeds, mobile responsiveness on product grids, and navigation flow between category pages. Affiliate tracking from Amazon informs which activewear pieces our community finds most compelling, shaping future content and collection curation without altering the objectivity of our product features.

We do not sell your personal information to third parties. Data sharing occurs only with service providers essential to site operation (hosting, analytics, email delivery) or when legally required by valid governmental process.

Cookies and Tracking Technologies Bandier Uses

Bandier employs several cookie categories to maintain site functionality and improve user experience:

• Essential Cookies: Required for basic site navigation, secure access, and form submission — these cannot be disabled without breaking core functionality.
• Analytics Cookies: Google Analytics tracks aggregate visitor behavior (pages viewed, session duration, bounce rates) to help us understand how our activewear content performs. These cookies do not identify you personally but measure overall site engagement.
• Advertising Cookies: Amazon Associates and Facebook Pixel place cookies to track affiliate conversions and retarget visitors with relevant activewear ads. These third-party cookies follow the privacy policies of their respective platforms.

You can manage cookie preferences through your browser settings — most browsers allow you to block or delete cookies entirely, though doing so may limit site features like personalized product recommendations or seamless checkout flows on linked Amazon pages. For granular control, tools like the Network Advertising Initiative opt-out page or browser extensions like Privacy Badger provide additional management layers.

How Bandier Shares Your Information

We share data only when necessary to operate Bandier effectively or fulfill legal obligations:

Service Providers: Hosting platforms (AWS, WP Engine), email marketing tools (Mailchimp, ConvertKit), and analytics providers (Google, Facebook) receive limited data required to deliver their services. These vendors are contractually bound to handle your information according to our privacy standards and applicable regulations.

Affiliate Partners: Amazon receives anonymized click and conversion data through our Associates program. This affiliate tracking does not include your personal identity — Amazon sees only that a visitor from Bandier purchased activewear, not who that visitor is unless you’re already logged into your Amazon account.

Legal Requirements: We disclose information when compelled by valid subpoenas, court orders, or other lawful governmental requests. In cases involving potential harm prevention or fraud investigation, we may share data with law enforcement without prior notice if legally permitted.

If Bandier undergoes a business transition (merger, acquisition, asset sale), your information may transfer to the successor entity. We will notify you via email and prominent site notice before such transfers, giving you the opportunity to request data deletion if the new entity’s privacy practices differ materially from ours.

Data Security Measures at Bandier

We implement industry-standard safeguards to protect your information: SSL encryption for data transmission, secure server configurations, regular software updates, and restricted internal access to personal data. Our hosting providers maintain physical security controls at data center facilities, including surveillance, access logs, and environmental protections.

Despite these precautions, no digital system is completely immune to breach. While we work diligently to secure your data, we cannot guarantee absolute protection against sophisticated cyberattacks or unauthorized access. In the event of a security incident affecting your personal information, we will notify you within the timeframes required by applicable state and federal breach notification laws (typically 72 hours for GDPR, 30–60 days for U.S. state laws).

Your Privacy Rights — All Users

Every Bandier visitor possesses baseline privacy rights regardless of location:

• Access: You may request a copy of the personal information we hold about you.
• Correction: If your data is inaccurate or outdated, you can request updates or corrections.
• Deletion: You may ask us to delete your personal information, subject to legal retention requirements (e.g., tax records, fraud prevention logs).
• Opt-Out: Unsubscribe from marketing emails via the link in every newsletter, or contact us directly to cease promotional communications.

Enhanced Rights Under GDPR (European Union Users)

If you access Bandier from the European Union, the General Data Protection Regulation grants additional protections:

• Data Portability: Request your personal information in a machine-readable format to transfer to another service.
• Restriction of Processing: Limit how we use your data in specific circumstances (e.g., while disputing accuracy).
• Objection: Object to processing based on legitimate interests, including profiling for marketing purposes.
• Withdrawal of Consent: Revoke consent for data processing at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a Complaint: File a complaint with your national data protection authority if you believe we’ve violated GDPR.

Our lawful bases for processing under GDPR include: consent (newsletter subscriptions), contractual necessity (responding to contact form inquiries), legitimate interests (site analytics, affiliate program operation), and legal obligations (tax compliance, fraud prevention).

Enhanced Rights Under CCPA and CPRA (California Residents)

California’s Consumer Privacy Act and California Privacy Rights Act provide robust data protections:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we’ve collected, the sources, business purposes, and third parties we’ve shared it with.
• Right to Delete: Request deletion of your personal information, with exceptions for legal compliance, fraud prevention, and security purposes.
• Right to Opt-Out: Opt out of the “sale” or “sharing” of personal information (as defined by CPRA). Bandier does not sell data in the traditional sense, but affiliate tracking may qualify as “sharing” under CPRA’s broad definition.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: If we process sensitive data (precise geolocation, health information), you may limit its use to necessary business purposes only.
• Non-Discrimination: We will not discriminate against you for exercising CCPA/CPRA rights — no denial of service, different pricing, or reduced functionality.

To exercise these rights, email us at the address below. We’ll verify your identity (typically by matching the email you provide with our records) and respond within 45 days, with an optional 45-day extension for complex requests.

Enhanced Rights Under VCDPA, CPA, CTDPA, and UCPA (Multi-State Compliance)

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) grant privacy rights similar to California’s framework, with state-specific nuances:

• Access and Portability: Request a copy of your personal data in a portable format.
• Correction and Deletion: Correct inaccuracies or request deletion, subject to legal exceptions.
• Opt-Out of Targeted Advertising: Decline participation in targeted advertising driven by cross-site tracking. Bandier’s affiliate cookie usage may fall under this category.
• Opt-Out of Profiling: Object to automated profiling that produces legal or similarly significant effects. Our use of analytics for content optimization does not typically meet this threshold, but you may still request opt-out.
• Appeal: If we deny your privacy request, you may appeal the decision. We’ll review and respond to appeals within 60 days (Virginia, Colorado, Connecticut) or 90 days (Utah).

These state laws define “sale” and “targeted advertising” expansively — Amazon’s affiliate tracking, while not a traditional data sale, may trigger opt-out rights under these statutes. To opt out of this tracking, disable third-party cookies in your browser or use our contact method below to request manual exclusion from affiliate tracking scripts.

How to Exercise Your Privacy Rights

To submit an access, deletion, correction, or opt-out request under any of the frameworks above, email us with “Privacy Request” in the subject line. Include your full name, the email address associated with any Bandier interactions, and a clear description of your request (e.g., “Delete all personal information,” “Provide a copy of data collected,” “Opt out of targeted advertising”).

We will verify your identity by matching the email you provide with our records or requesting additional confirmation if needed. Responses typically arrive within 30–45 days, depending on the complexity and applicable law’s timeline requirements. For GDPR requests, we aim for 30 days; for CCPA/CPRA, 45 days; for multi-state laws, 45–60 days. If an extension is necessary, we’ll notify you and explain the reason.

You may authorize an agent to submit requests on your behalf by providing written permission and verifying the agent’s authority. We’ll confirm directly with you before processing agent-initiated requests to prevent unauthorized disclosures.

Children’s Privacy Under COPPA

Bandier’s activewear content is not directed to children under 13. We do not knowingly collect personal information from users in this age group. If you’re a parent or guardian who discovers your child has provided us with data, contact us immediately — we will delete that information promptly upon verification.

The Children’s Online Privacy Protection Act (COPPA) requires parental consent before collecting data from children under 13. Our newsletter signup, contact forms, and affiliate tracking mechanisms do not include age verification, so we rely on users to self-certify they meet the minimum age requirement. If evidence emerges that a user under 13 has engaged with our platform, we will remove their data and block further data collection without parental consent.

Third-Party Links and External Platforms

Bandier features links to Amazon product pages, brand partner sites, and social media platforms (Instagram, Facebook, Pinterest). These external sites operate under their own privacy policies — we do not control and are not responsible for their data practices. Before providing personal information to any third-party site, review their privacy policy independently.

When you click an affiliate link to Amazon, you leave Bandier’s privacy framework and enter Amazon’s. Amazon’s data collection (browsing history, purchase behavior, login credentials) is governed by Amazon’s Privacy Notice, not ours. Similarly, embedded social media widgets (like Instagram feeds or Facebook share buttons) may place cookies and track your activity according to those platforms’ policies.

International Data Transfers

Bandier operates primarily within the United States, but our site is accessible globally. If you access Bandier from outside the U.S., your information may be transferred to, stored, and processed on servers located in the United States, where data protection laws differ from those in your jurisdiction.

For European Union visitors, we rely on adequacy decisions, Standard Contractual Clauses (SCCs), or other lawful transfer mechanisms under GDPR Article 46 when transferring data to the U.S. By using Bandier, you consent to this cross-border transfer, subject to the protections outlined in this Privacy Policy and applicable law.

Data Retention Periods

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy or comply with legal obligations:

• Newsletter Subscriptions: Retained until you unsubscribe or request deletion.
• Contact Form Submissions: Stored for up to 2 years to maintain correspondence history and address follow-up inquiries.
• Analytics Data: Google Analytics retains user-level data for 14–26 months (configurable); we periodically delete older aggregated data that no longer serves optimization purposes.
• Affiliate Tracking: Amazon Associates data is anonymized and aggregated by Amazon; we retain click-through reports for up to 3 years for tax and audit purposes.
• Legal and Compliance Records: Financial records, tax documents, and fraud-prevention logs may be retained for 7 years to satisfy IRS and state requirements.

After retention periods expire, we securely delete or anonymize personal information to prevent reconstruction. Anonymized data (stripped of identifiers) may be retained indefinitely for statistical analysis and historical reference.

Email Communications and Unsubscribe

When you subscribe to Bandier’s newsletter, you’ll receive curated activewear updates, new collection announcements, and styling insights from our New York fitness culture perspective. Every marketing email includes a one-click unsubscribe link at the bottom — clicking it removes you from our promotional list immediately.

Even after unsubscribing from marketing emails, you may still receive transactional messages if you submit a contact form inquiry or request specific information. These non-promotional emails are necessary to fulfill the service you requested and are not subject to unsubscribe (though they will cease once the transaction is complete).

To unsubscribe manually or update your email preferences, contact us at the address below. We’ll process your request within 10 business days.

Do Not Track Signals

Some browsers offer “Do Not Track” (DNT) settings that send a signal to websites requesting not to be tracked. There is currently no universal standard for how sites should respond to DNT signals, and technology platforms interpret them inconsistently. Bandier does not alter its data collection practices in response to DNT signals at this time.

If you wish to limit tracking, we recommend managing cookies directly through browser settings, using privacy-focused browser extensions (Privacy Badger, uBlock Origin), or opting out via the Network Advertising Initiative or Digital Advertising Alliance tools. These methods provide more granular control than DNT signals and are compatible with Bandier’s affiliate and analytics tracking mechanisms.

Changes to This Privacy Policy

Bandier may update this Privacy Policy periodically to reflect new data practices, legal requirements, or platform features. When changes occur, we’ll revise the “Last Updated” date at the top of this page and notify you via prominent site banner or email if the modifications materially affect your rights.

Continued use of Bandier after policy updates constitutes acceptance of the revised terms. If you disagree with changes, discontinue use of the site and request deletion of your personal information before the new policy takes effect. For GDPR users, we’ll seek explicit re-consent if changes significantly alter the lawful basis for processing your data.

Contact Bandier About Privacy

For privacy requests, questions about this policy, or concerns about how Bandier handles your information, reach us at:

Include “Privacy Request” in your subject line and provide sufficient detail for us to locate your information and address your inquiry. We aim to respond within the timeframes specified by applicable privacy laws (30–60 days, depending on jurisdiction and request complexity).

Last Updated: 2026-08