Privacy policy

Privacy Policy

Last updated: October 1, 2026

This Privacy Policy explains how GCE International, doing business as Thorlo (“Thorlo,” “we,” “us,” or “our”), collects, uses, and shares personal data through thorlo.com (the “Website”). It includes sections for U.S. state privacy rights, California disclosures, and consumer health data. Some sections apply only where broader protection standards apply, such as to users in the European Union. You can print this policy using your browser’s print command.

Owner and data controller

GCE International, doing business as Thorlo
1385 Broadway, 21st Floor, New York, NY 10018-6001, United States
Email: support@thorlo.com
Phone: 888-846-7567

Personal data we collect

We collect the following personal data, directly or through service providers:

• Contact and account details: first and last name, email address, phone number, billing and shipping addresses, and account log-in credentials.

• Order and payment information: products purchased, considered, or returned, and payment information, which is processed by our payment providers.

• Date of birth, if you choose to provide it, for example for a birthday reward.

• Communications: messages, survey responses, reviews, and anything else you send us.

• Device and usage data: IP address, browser and device type, unique identifiers, pages viewed, and other activity collected by cookies, pixels, and similar trackers.

Required fields are marked when we collect them. If you don’t provide required information, we may be unable to complete your order or request. Optional fields can be left blank without affecting the Service. If you give us someone else’s personal data, such as a gift recipient’s address, you confirm you have their permission.

How we process data

We use reasonable administrative, technical, and physical safeguards to protect personal data from unauthorized access, disclosure, modification, or destruction. Our authorized staff and service providers, such as hosting, payment, shipping, customer-service, and marketing providers, may access data as needed to perform their functions. A current list of service providers is available on request.

Legal bases for processing (EU users)

Where EU data protection law applies, we process personal data on one of these bases: your consent; the need to perform a contract with you or take steps before entering one; compliance with a legal obligation; or our legitimate interests, such as preventing fraud and improving the Website, where those interests are not overridden by your rights. You may contact us to learn which basis applies to a specific activity.

Where data is processed

We process data in the United States and wherever our service providers operate. If you are outside the United States, your data will be transferred to the United States. Where EU law applies, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses or a provider’s certification under the EU-U.S. Data Privacy Framework. You may request details of these safeguards using the contact information above.

How long we keep data

We keep each category of personal data only as long as reasonably necessary for the purpose it was collected, considering its sensitivity, our relationship with you, and legal, accounting, and fraud-prevention needs. When data is no longer needed, we delete or de-identify it.

Category	How long we keep it
Account, customer, and order information	While your account or customer relationship is active, then as needed for orders, guarantees, returns, disputes, tax, accounting, and fraud prevention
Payment information	Only as needed to complete and document transactions and address chargebacks or fraud; payment processors keep card data under their own practices
Marketing contact details and preferences	Until you unsubscribe, then as needed to keep a suppression list and show compliance
Device, cookie, and analytics data	According to the cookie, analytics, and advertising settings described in our Cookie Policy
Customer-service messages, forms, and surveys	As long as needed to address the request, keep business records, and resolve disputes
Privacy requests and responses	At least 24 months, or longer if required by law

Why we use personal data

We use personal data to process and deliver orders, honor our guarantees and returns, provide customer service, run the loyalty program, send order updates and marketing you have agreed to, run surveys and reviews, analyze and improve the Website, show relevant advertising, prevent fraud and secure the Website, comply with law, and protect our legal rights.

Service providers we use

These providers process personal data on our behalf, and some place cookies or pixels in your browser. Each provider’s privacy policy explains its own practices.

Purpose	Provider	Privacy policy
Store hosting and checkout	Shopify Inc.	https://www.shopify.com/legal/privacy
Payments and financing	Shopify Inc.	https://www.shopify.com/legal/privacy
Fraud prevention	NoFraud LLC	https://www.nofraud.com/end-user-privacy-policy/
Shipment tracking	AfterShip Ltd.	https://www.aftership.com/legal/privacy-for-end-users
Customer service	Gorgias Inc.	https://www.gorgias.com/privacy/privacy
Reviews, surveys, and loyalty	Yotpo Ltd.	https://www.yotpo.com/privacy-policy/
Email marketing	Klaviyo Inc.	https://www.klaviyo.com/legal/privacy/privacy-notice
Text messaging	Postscript	https://terms.pscr.pt/legal/shop/thorlo-socks/privacy_policy
Analytics	Google Analytics	https://policies.google.com/privacy
Advertising and remarketing	Google Ads	https://policies.google.com/technologies/partner-sites
Advertising and remarketing	Meta (Facebook pixel, Custom Audiences, lead ads)	https://www.facebook.com/privacy/policy/

Advertising and remarketing

Google and Meta use cookies, pixels, and hashed email lists to measure our ads and show you Thorlo ads on other sites and apps based on your activity on our Website. These providers may collect information about your online activity over time and across different websites. To limit this, use the “Do Not Sell or Share My Personal Information” link in our footer, enable Global Privacy Control, adjust your choices under Cookie Preferences, visit the Network Advertising Initiative opt-out page (https://optout.networkadvertising.org), or use your device’s advertising settings.

We do not run advertising pixels on pages for diabetic or other condition-specific products, or send those page views or purchases to advertising providers, unless you have given consent.

Email and text messaging

We send email marketing to customers and subscribers. Every marketing email includes an unsubscribe link.

We send marketing text messages only to people who opt in through a separate checkbox at checkout, our signup form, or a keyword. Consent to receive marketing texts is not a condition of purchase. If you provide a phone number at checkout without opting in, we use it only for order and delivery messages. You may receive up to 30 marketing messages per month, and message and data rates may apply.

You can stop text messages at any time by replying STOP or with any other reasonable request, such as “quit,” “cancel,” or “unsubscribe,” by using an unsubscribe link, or by contacting us. Reply HELP for help. Our Messaging Terms (https://terms.pscr.pt/legal/shop/thorlo-socks/terms_of_service) and Messaging Privacy Policy also apply.

Your rights

Depending on where you live, you may have the right to:

• Withdraw consent you have given, at any time.

• Access your personal data and get a copy of it.

• Correct inaccurate data.

• Delete your data, subject to legal exceptions.

• Receive your data in a portable format.

• Object to or restrict certain processing, and object at any time to direct marketing.

• Opt out of the sale or sharing of personal data and targeted advertising.

• Lodge a complaint with your data protection authority or state attorney general.

To exercise a right, submit a request through https://thorlo.com/pages/contact-us, email support@thorlo.com, or call 888-846-7567. Requests are free unless they are manifestly unfounded or excessive.

Response times depend on the law that applies to you. For EU users, we respond within one month, extendable by two further months for complex requests. California and other U.S. state timelines are described in the sections below.

Global Privacy Control and Do Not Track

We treat Global Privacy Control (GPC) and other legally recognized universal opt-out signals as a request to opt out of the sale or sharing of personal data and targeted advertising. We apply the signal to the browser or device that sends it, and to your account when you are logged in and the signal can be linked to it.

The Website does not respond to “Do Not Track” browser signals, which are a separate, older standard. To check whether a third-party service honors Do Not Track, see its privacy policy.

Cookies

The Website uses cookies, pixels, and similar trackers. Our Cookie Policy explains each type and how to manage them through Cookie Preferences in the site footer.

Other uses and disclosures

We may use or disclose personal data to establish, exercise, or defend legal claims; to comply with a court order, subpoena, or request from public authorities; to protect the rights, property, or safety of Thorlo, our customers, or others; and in connection with a merger, financing, acquisition, or sale of assets. We and our providers also keep system logs, including IP addresses, to operate and secure the Website.

Changes to this policy

We may update this policy by posting the new version on this page and changing the “Last updated” date. For material changes, we will also notify account holders by email or a notice on the Website. If a change affects processing based on your consent, we will ask for your consent again where required.

California privacy notice

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). Where it conflicts with the rest of this policy, this section controls for California residents. Terms such as “personal information,” “sell,” and “share” have the meanings given in the CCPA.

Personal information we collected in the past 12 months

Category	Examples	Sold or shared?
Identifiers	Name, email, phone, address, IP address, device and cookie IDs	Yes, with advertising and analytics partners
Customer records (Cal. Civ. Code § 1798.80(e))	Billing address, payment information	No
Protected classifications, if provided	Age or date of birth	No
Commercial information	Products purchased, considered, or returned	Yes, with advertising partners
Internet activity	Pages viewed, clicks, interactions with emails and ads	Yes, with advertising and analytics partners
Approximate geolocation	Location derived from IP address	No
Electronic communications	Customer-service messages, reviews, surveys	No
Inferences	Shopping preferences drawn from activity	Yes, with advertising partners
Sensitive personal information	Account log-in credentials; payment card details with security codes	No

We collect this information from you, from your browser or device, and from service providers that support our e-commerce, payment, shipping, fraud-prevention, customer-service, analytics, and marketing operations. We use it for the purposes described in “Why we use personal data.” We disclose it for business purposes to the provider categories listed in “Service providers we use,” under contracts that restrict their use of the data. Retention periods are listed in “How long we keep data.”

Sale and sharing. We do not sell personal information for money. Our use of Google and Meta advertising pixels is a “sale” or “sharing” under the CCPA, for advertising, measurement, and attribution. We do not sell or share sensitive personal information, and we do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use it only to provide the goods and services you request, secure transactions and accounts, and prevent fraud, which are purposes for which the CCPA does not require a right to limit. We do not use it to infer characteristics about you.

Your rights. You have the right to know what personal information we collect, use, disclose, sell, and share; to get a copy in a portable format; to delete it; to correct it; to opt out of its sale or sharing; and not to be discriminated or retaliated against for exercising these rights.

How to opt out of sale or sharing. Use the “Do Not Sell or Share My Personal Information” link in the Website footer, enable Global Privacy Control, or email support@thorlo.com. You don’t need an account, and we don’t verify opt-out requests. We process opt-outs within 15 business days and wait at least 12 months before asking you to opt back in.

How to submit other requests. Submit a request to know, delete, or correct through https://thorlo.com/pages/contact-us, by emailing support@thorlo.com, or by calling 888-846-7567. To verify your request, we will ask you to:

• provide information that lets us reasonably match you with the records we hold, which may vary by the type of request and the sensitivity of the data; and

• describe your request in enough detail for us to understand and respond to it.

We use the information you provide only to verify and respond to your request. If we cannot verify a request, we may deny it in whole or in part and will explain why. You may use an authorized agent; we may require signed permission from you and verification of your identity, unless the agent has a valid power of attorney. A parent or guardian may submit a request for a minor.

Response timing. We confirm receipt of requests to know, delete, or correct within 10 business days, and respond within 45 calendar days. If needed, we may extend that once by up to 45 more days, with notice during the first 45-day period. We are not required to respond to more than two requests to know from the same person in 12 months.

Shine the Light. California residents may request information about disclosures of personal information to third parties for their own direct marketing in the prior calendar year. Use the contact methods above and mark the request “Shine the Light Request.”

Contact. GCE International, 1385 Broadway, 21st Floor, New York, NY 10018-6001; support@thorlo.com; 888-846-7567.

Privacy rights in other U.S. states

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with consumer privacy laws may have these rights, as their state law provides:

• Confirm whether we process your personal data, and access it.

• Correct inaccuracies.

• Delete your personal data, subject to legal exceptions.

• Get a portable copy.

• Opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects.

• Control the processing of sensitive personal data.

• Get a list of the third parties, or categories of third parties, we disclosed data to, where your state provides this right (such as Oregon and Minnesota).

• Appeal a decision on your request.

We collect only data that is reasonably necessary for the purposes we disclose, and we get consent before processing sensitive data where the law requires it. We do not use personal data for decisions that produce legal or similarly significant effects. If you use buy-now-pay-later financing, the financing provider makes its own decisions under its own privacy policy.

To opt out of sale or targeted advertising, use the footer link or Global Privacy Control, or contact us. For other requests, use the contact methods in “Your rights.” We respond within the time your state law requires, typically 45 days, and may extend it as that law allows with notice to you.

Appeals. If we deny your request, you may appeal within 60 days by emailing support@thorlo.com with “Privacy Appeal” in the subject line and explaining why. We will respond within the time your state law requires. If we deny the appeal, we will tell you how to contact your state attorney general.

Nevada. Nevada residents may submit a verified request to opt out of future sales of covered information using the contact methods above. We do not sell covered information for money as Nevada law defines “sale.”

Consumer health data privacy notice

This notice covers consumer health data under the Washington My Health My Data Act, Nevada’s consumer health data law, and similar state laws. The full notice is also posted as its own page https://thorlo.com/pages/consumer-health-data-privacy-notice, linked from the Website footer.

What we collect. Information you provide about foot, mobility, comfort, or health-related needs; customer-service messages, reviews, or surveys mentioning a health condition; and searches or purchases of diabetic or other condition-specific products, from which a health condition could be inferred.

Sources. You, your interactions with our Website and customer service, your browser or device when linked to health-related activity, and our service providers.

How we use it. To provide the products and services you request, fulfill and support orders, respond to your questions and reviews, keep the Website secure, prevent fraud, and comply with law.

Who we share it with. Only the providers needed for these purposes: e-commerce and hosting, payment, shipping, customer-service, security and fraud-prevention providers, professional advisers, and government authorities when required by law. We do not share consumer health data with advertising providers, and we do not run advertising pixels on condition-specific product pages, unless you give consent.

No sale or geofencing. We do not sell consumer health data. We do not use geofences around health care facilities to identify, track, or advertise to consumers.

Your rights. You may confirm whether we collect, share, or sell your consumer health data; access it, including a list of the third parties we shared it with; withdraw consent; and request deletion, including by our processors. Use the contact methods in “Your rights,” and appeal a denial as described above.

Children and teens

The Website is not directed to children under 13, and we do not knowingly collect their personal data. We do not knowingly sell or share personal data, or use it for targeted advertising or profiling, for anyone we know is under 18 unless the authorization required by law has been given. A parent or guardian may exercise privacy rights for a child as the law allows.

Biometric information

We do not collect biometric information to identify individuals. If that changes, we will give notice, get consent, and set retention and destruction rules as the law requires before we begin.

Contact us

GCE International, doing business as Thorlo
1385 Broadway, 21st Floor, New York, NY 10018-6001, United States
Email: support@thorlo.com
Phone: 888-846-7567
Online: https://thorlo.com/pages/contact-us