Privacy policy & cookie notice
Last updated 1 October 2026. This notice explains what we collect, why we collect it, how long we keep it and how you can exercise your rights.
1. Who is responsible for your data
The data controller is NORDVIK ApS, 1209 Orange Street, Wilmington, DE 19801, United States, registered company number 00000000. For any privacy question, including data subject requests, write to privacy@pobxbx.com. We respond to requests within 30 days.
2. What we collect and why
| Data | Why we need it | Legal basis |
|---|---|---|
| Name, delivery address, email address, phone number | To process, dispatch and deliver your order and to send order and dispatch confirmations | Performance of a contract |
| Payment confirmation data (transaction ID, last four digits, billing country). We never receive or store full card numbers | To take payment, prevent fraud and handle refunds | Performance of a contract; legitimate interests |
| Order history and return history | To handle returns, exchanges, repairs and warranty claims | Performance of a contract; legal obligation |
| Email address, if you opt in to marketing | To send newsletters about new arrivals, restocks and offers | Consent (withdrawable at any time) |
| Device, browser and page-view data, IP address | To run the shop securely, measure aggregate traffic and fix errors | Legitimate interests; consent for non-essential cookies |
| Correspondence with customer care | To answer your enquiry and keep a record of the resolution | Legitimate interests |
We do not sell your personal data, and we do not use it to make automated decisions that produce legal effects for you.
3. How long we keep data
- Order and invoice records: seven years, to meet tax and accounting obligations.
- Customer care correspondence: three years from the last contact.
- Marketing consent records: until you unsubscribe, plus six months as proof of consent.
- Server and analytics logs: 26 months, in aggregated form where possible.
- Abandoned-cart data: 30 days, unless you complete the order.
4. Who we share data with
We share the minimum necessary with the following categories of processors, each bound by a data processing agreement:
- Payment processors — PayPal and Stripe, which handle card and wallet payments in their own PCI-DSS compliant environments.
- Carriers — tracked postal services, DHL Express and FedEx, to deliver your parcel and provide tracking.
- Hosting and infrastructure — a static hosting provider and a content delivery network that serve this website.
- Email and customer support tools — to send transactional and, with your consent, marketing email, and to manage support tickets.
Some processors are located outside the European Economic Area. Where that is the case we rely on the European Commission's Standard Contractual Clauses, plus additional technical measures such as encryption in transit.
5. Cookies and local storage
This site uses a small amount of browser storage. In the demo storefront that runs on this template, the following are stored locally in your browser only and are never transmitted to us:
| Name | Type | Purpose | Duration |
|---|---|---|---|
nordvik_cart_v1 | Local storage | Remembers the items in your bag between visits | Until you clear it |
nordvik_currency | Local storage | Remembers your USD or EUR choice | Until you clear it |
nordvik_address_v1 | Local storage | Prefills checkout if you tick "save this information" | Until you clear it |
| First-party cookies | Cookie | Set by the payment processor during checkout to secure the session | Session, up to 30 days |
Once you connect a payment provider, an analytics tool and a mailing list, you must add a cookie consent banner that blocks non-essential scripts until the visitor agrees, and update this table. Delete the local storage entries above at any time from your browser settings — your bag and preferences will simply be forgotten.
6. Security
The site is served over TLS (HTTPS) and forces encrypted connections. Access to order data is limited to staff who need it, protected by two-factor authentication. Card data never touches our servers: it is entered directly into the payment processor's hosted fields or hosted checkout page. We keep encrypted backups and review access quarterly. No system is perfectly secure, but we notify affected individuals and supervisory authorities of a personal data breach where the law requires it.
7. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted ("right to be forgotten"), subject to our legal record-keeping duties.
- Restrict or object to certain processing, including direct marketing.
- Receive your data in a portable, machine-readable format.
- Withdraw consent for marketing at any time, using the unsubscribe link in any email.
- Lodge a complaint with your local supervisory authority. EU and UK residents can complain to the authority in their country of residence; California residents have additional rights under the CCPA/CPRA, including the right to opt out of the sale or sharing of personal information — we do not sell personal information.
To exercise any of these rights, email privacy@pobxbx.com with enough detail for us to identify your order. We may ask for proof of identity to protect your data. There is no charge unless a request is manifestly unfounded or repetitive.
8. Children
This shop is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with data, contact us and we will delete it.
9. Changes to this notice
We may update this notice to reflect changes in our practices or the law. The "last updated" date at the top will always reflect the current version, and material changes affecting existing customers will be communicated by email.
10. Contact
- Privacy requestsprivacy@pobxbx.com
- Customer caresupport@pobxbx.com
- PostalNORDVIK ApS, 1209 Orange Street, Wilmington, DE 19801, United States