Privacy Policy

Who is responsible for your information

Nordicmyco OÜ, operating NordicNita, is the controller of the personal data described in this policy.

Company registration number: 17479840
Registered address: Tuukri tn 19-202, Kesklinna district, Tallinn, Harju county, 10120, Estonia
Privacy enquiries: support@nordicnita.com

Information we process

Depending on how you interact with us, we process:

• Order and contact information — your name, email address, telephone number, billing and delivery address, and an optional company name.
• Order details — the items purchased, order status, payment status and transaction references.
• Customer service enquiries — the name, email address, subject and message you send through our contact form or by email.
• Product reviews — where you choose to leave one: your name, email address, rating, review text and any images you attach.
• Technical information — IP address, browser and device details, and server and security logs generated when you visit the website.

We do not offer customer accounts. Orders are placed as a guest, and we do not ask you to create a password or store a login with us.

We receive information directly from you and, where necessary, from our payment provider and delivery partners concerning your transaction or shipment.

Why we use your information

We use order and contact information to process purchases, arrange payment, fulfil orders and provide related customer service. The legal basis is performance of our contract with you, or steps taken at your request before entering into a contract.

We publish product reviews to inform other customers. Where you submit a review, the legal basis is your consent, given when you choose to submit it. Your review text, rating, name and any images you attach may be displayed publicly; your email address is not published.

We retain information required for accounting, tax and other statutory duties on the basis of our legal obligations.

Where necessary and proportionate, we use information to protect our website, investigate suspected fraud and establish or defend legal claims. Our legal basis is our legitimate interest in operating a secure business and protecting our rights, balanced against your rights and interests.

Information needed to process and deliver an order is required to complete your purchase. If it is not supplied, we may be unable to fulfil the order.

Fulfilment and delivery

Orders are fulfilled by our professional logistics partners located in Denmark, Finland and Estonia.

We share the information required to prepare, pack and dispatch your order, such as your name, delivery address, relevant contact details and order contents.

Delivery carriers receive the information needed to transport your parcel, provide tracking and communicate with you about delivery.

Who else receives your information

We keep the number of third parties involved in running this website deliberately small. The following providers process personal data on our behalf, or receive it in order to perform their own role:

• Hostinger (HOSTINGER, UAB, Lithuania, and Hostinger International Ltd, Cyprus) — website hosting. Our website and its database are hosted on servers located in the European Union.
• CookieYes — our consent management service, which displays the cookie banner and records the consent choices made on this website.
• WooCommerce / Automattic — the WooPayments service used to take payments on this website.
• Stripe (contracting entity for businesses in the European Economic Area: Stripe Payments Europe, Limited, Ireland) — WooPayments is built in partnership with Stripe, and Stripe is the payment processor that handles your card details and carries out payment and fraud checks. Your full card number is entered directly into Stripe’s payment form and is not stored on our website.
• Apple and Google — where you choose to pay using Apple Pay or Google Pay, your payment is authorised through their respective wallet services.
• Google (Google Analytics) — where you accept analytics cookies, Google Analytics measures how visitors use this website, as described in the cookies section below.
• Google (Google Workspace) — our email is hosted with Google Workspace, so correspondence you send to us is processed there.
• Our fulfilment and delivery partners — as described in the section above.
• Our web development agency — which maintains this website and may access it, including order data, for technical support and maintenance.
• Professional advisers and public authorities — where we are required or entitled to share information, for example for accounting, tax or legal purposes.

If you publish a product review and have a Gravatar profile associated with your email address, a profile image may be loaded from Gravatar, a service operated by Automattic.

Providers may act as our processors or as independent controllers, depending on their role.

Cookies and tracking

This website uses cookies and similar browser storage. We divide them into two groups: necessary cookies, which the shop needs in order to work, and analytics cookies, which are only used if you agree.

Necessary cookies. These support the shopping cart, the checkout, secure payment, fraud prevention and remembering your cookie choice. Because they are strictly necessary to provide the service you have asked for, they do not require your consent:

• Your cookie choice — the cookieyes-consent cookie stores the choice you make in our cookie banner, so that we do not ask you again on every page.
• Shopping cart and checkout — WooCommerce cookies (wp_woocommerce_session_*, woocommerce_items_in_cart and woocommerce_cart_hash) and similar browser storage keep your cart and checkout working. They are set when you use the cart or checkout.
• Payment security and fraud prevention — on product, cart and checkout pages, the payment form provided by Stripe sets cookies such as __stripe_mid and __stripe_sid. On the checkout page, our payment service WooPayments also uses Sift, a fraud-prevention service, which sets the __ssid cookie. These are used to process payments securely and to detect fraud.

Analytics cookies. If you accept analytics cookies, we use Google Analytics, a web analytics service provided by Google, to understand how visitors use this website, for example which pages are viewed and how visitors arrive at the site. Google Analytics is only loaded after you have given your consent, and only then sets its cookies (_ga and _ga_*). If you reject analytics cookies, or later withdraw your consent, Google Analytics does not collect further data about your visit. We use Google Consent Mode to pass your choice to Google.

Managing your choice. When you first visit, our cookie banner lets you accept all, reject all or customise your choice. You can change or withdraw your consent at any time using the Cookie Settings link in the footer of every page. You can also delete cookies through your browser settings. Our cookie banner is provided by CookieYes, a consent management service, which records the consent choice you make.

We want to be explicit about what we do not do:

• We do not use Google Tag Manager, Google Ads tracking, the Meta pixel or any other advertising or remarketing technology.
• We do not profile you, and we do not build advertising audiences from your visit.
• We do not sell or rent your personal data.

The fonts used on this website are served from our own servers, so viewing a page does not send your IP address to an external font provider.

We do not currently operate a newsletter or marketing mailing list. If we introduce one, it will be opt-in, and we will update this policy before doing so.

International transfers

Our website hosting, our shop database and our fulfilment partners are located within the European Union.

Some of the providers listed above belong to international groups and may process personal data outside the European Economic Area, in particular in the United States. This applies principally to the payment and email services we use.

Where such a transfer takes place, it is carried out under a lawful transfer mechanism, such as an adequacy decision by the European Commission or the European Commission’s standard contractual clauses, together with supplementary measures where required. These mechanisms are set out in each provider’s own data processing terms.

You may contact us for further information about the safeguards that apply and how to obtain a copy of them.

How long we keep information

We retain personal data only for as long as it is needed for the purpose it was collected for, and for any period required by law.

• Order and accounting records — retained for the period required by Estonian accounting and tax law, calculated from the end of the relevant financial year.
• Customer service correspondence — retained for as long as needed to deal with your enquiry and to handle any follow-up question, complaint or warranty matter arising from it.
• Product reviews — retained for as long as the review is published, or until you ask us to remove it.
• Technical and security logs — retained for the short period applied by our hosting provider for security and troubleshooting, after which they are overwritten.

We may retain limited information for longer where this is necessary for a legal obligation or an ongoing dispute.

Your rights

Subject to the applicable conditions, you may request access to, correction of, deletion of, restriction of or portability of your personal data. You may also object to processing based on our legitimate interests.

Withdrawing consent does not affect processing lawfully carried out before the withdrawal.

To exercise your rights, contact support@nordicnita.com. We may ask for proportionate information to verify your identity before we act on a request.

You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or with the competent supervisory authority in the country where you live or work.

Automated decisions

Nordic Nita does not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you.

Our payment provider carries out automated checks on payments in order to detect fraud, and a payment may be declined as a result of those checks. If your payment is declined, you are welcome to contact us at support@nordicnita.com and we will look at the order ourselves.

Security

We apply appropriate technical and organisational measures to protect personal data, and we limit access to those who need it. The website is served over an encrypted connection, and card details are handled by our payment provider rather than by us.

Changes to this policy

We may update this policy to reflect changes in our services or practices. The date at the top of this page shows when it was last revised, and we will provide additional notice where this is required.