Privacy Policy

Updated on 24 October 2026.

Who is responsible for your data?

The controller for the Exitsport.eu online shop is XBOARD OÜ, registry code 14026256, Kadaka tee 7, 12915 Tallinn, Estonia. For privacy enquiries, email info@exitsport.eu or call +372 511 8337.

What data do we use, and why?

• Orders and delivery. We use your name, email address, phone number, delivery and billing details and order contents to enter into and perform the sales contract, deliver goods and handle returns and warranty enquiries. The legal basis is performance of a contract or steps taken at your request before entering into one.
• Payments and accounting. We process payment amounts, references and status, and an account number where needed for a refund. Accounting records are retained to comply with a legal obligation. When using a bank link or instalment payment, you enter the required payment details in the payment provider's environment.
• Customer account. Account details and order history allow you to use your account and track purchases. We process these data to provide the account service.
• Enquiries and chat. We use the contact details and messages you send by email, contact form or live chat to respond. Pre-purchase enquiries are handled at your request before entering into a contract; other customer correspondence is based on our legitimate interest in resolving enquiries.
• Security. IP addresses, browser and device information and security logs may be processed to prevent fraud, spam and misuse. The basis is our legitimate interest in protecting the shop and customer data.
• Newsletters and optional cookies. Newsletters are sent with consent. Non-essential analytics and marketing cookies also require consent. You can unsubscribe using the link in the email and change cookie choices at the bottom of the website.

Fields required to fulfil an order are marked as mandatory. Without these details, we may be unable to sell or deliver the goods. Marketing consent is not a condition of purchase.

Who receives the data?

We share the data needed to provide the service with your selected payment or instalment provider (including Montonio or ESTO when you use the corresponding payment method), delivery partners, and hosting, IT, email and accounting service providers. Hosting is provided by Zone. Payment and instalment providers also process data under their own privacy notices.

The shop uses Google reCAPTCHA to prevent spam and Chatway for live chat. These providers may receive technical information and, when you use chat, the messages and contact details you enter. We use Google Analytics according to cookie choices. Further information is available in Google's and Chatway's privacy notices. We disclose data to public authorities where required by law.

Where a service involves transfers outside the European Economic Area, an appropriate safeguard must apply: a European Commission adequacy decision or another applicable safeguard, such as standard contractual clauses. The EU–US Data Privacy Framework applies only to US organisations covered by that framework. Contact us for information about transfers associated with a particular service.

How long do we keep data?

• Account data are retained until the account is closed. Closure does not remove documents required by law or needed for an ongoing dispute.
• Guest order history is retained for three years. Accounting source documents are retained for seven years from the end of the financial year in which the transaction was recorded.
• Enquiries and chat messages are retained until the enquiry is resolved. Messages forming part of an order, return or dispute file follow the retention rules for that file.
• Data relating to claims and disputes are retained until final resolution and for the applicable limitation periods.
• Newsletter contact details are used until consent is withdrawn. We may retain the minimum information needed to record your unsubscribe request and honour it.

Cookies and your choices

Essential cookies support functions such as the basket, login, language selection and cookie preferences. They are needed to provide the service you request. Analytics cookies help measure use of the shop; marketing cookies may measure advertising performance and personalise advertising. You can allow or refuse non-essential cookies.

To change your choice, open Cookie settings at the bottom of the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can also delete cookies in your browser settings. Session cookies expire at the end of the session; persistent cookies remain until their set expiry or deletion. The exact duration depends on the cookie and service configuration.

Your rights

Subject to the applicable conditions, you may request a copy of your data, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests and withdraw consent at any time.

Send requests to info@exitsport.eu. We may ask for information necessary to verify your identity. We normally respond within one month. If a complex request requires an extension permitted by law, we will inform you within the first month. Accounting records and other legally required data cannot always be deleted immediately.

You may lodge a complaint with the Estonian Data Protection Inspectorate if you consider that your data have been processed unlawfully.

Security and changes

We use appropriate technical and organisational measures to restrict unauthorised access. Please do not send banking passwords, PINs or card security codes by email or chat. We update this policy when our services or processing change; the current version date appears at the top.