Privacy policy

1. What we collect

When ordering: name, email, phone, delivery address or parcel locker, order contents and total.

For payment: payment method and status. We never see or store card or bank credentials — payment happens in the payment provider's environment.

Newsletter: email address and the time consent was given.

When visiting: technical logs and cookies (see section 6).

2. Why and on what basis

To fulfil the order and provide support — performance of a contract (GDPR art. 6(1)(b)).

For accounting and tax obligations — legal obligation (art. 6(1)(c)). Estonian law requires source documents to be kept for 7 years.

To send the newsletter — consent (art. 6(1)(a)), withdrawable via the link in every email.

For security and troubleshooting — legitimate interest (art. 6(1)(f)).

3. Who we share with

Processors acting on our behalf: hosting and database (Vercel Inc., Supabase Inc. — servers in the EU), payments (Montonio Finance UAB), email (Resend, EU region), carriers (DPD Eesti AS, Omniva) and our accountant.

Data is never sold or passed on for third-party marketing.

Where a provider is outside the EEA, transfers are covered by the European Commission's standard contractual clauses.

4. Retention

Order and accounting data: 7 years from the end of the financial year.

Newsletter address: until consent is withdrawn.

Support correspondence: up to 3 years.

5. Your rights

You may access your data, have inaccurate data corrected, request erasure or restriction, object to processing, and receive your data in a portable format.

Send requests to info@nordkit.ee. We reply within one month.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Tatari 39, Tallinn, info@aki.ee).

6. Cookies

We use only cookies and browser storage necessary for the shop to work: cart contents, selected vehicle and language choice. They are not used for tracking or advertising.

If analytics or marketing cookies are added later, we will ask for separate consent.