Privacy Policy

This Privacy Policy explains how NordaArt (a brand of Norda Technology OÜ) collects, uses, discloses, and protects personal data when you visit our website, contact us, or use our services. We process your data in line with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

1. Data controller

The data controller responsible for your personal data is:

2. What personal data we collect

Depending on how you interact with us, we may collect:

• Contact-form data: name, email, company, country, and the message you submit.
• Email correspondence: when you write to info@nordatech.eu.
• Technical data: IP address, browser type, device type, operating system, referring URL, pages visited, and timestamps — collected automatically by our web server and (where applicable) privacy-friendly analytics.
• Cookie data: limited essential cookies only (see Section 7).

3. Purposes and legal basis for processing

Purpose	Data	Legal basis
Responding to your inquiry submitted via our contact form	Name, email, message	Art. 6(1)(b) GDPR — pre-contractual / contractual measures
Operating and securing our website	IP, browser, device info	Art. 6(1)(f) GDPR — legitimate interest in a secure, functioning site
Complying with legal obligations (e.g., accounting, VAT records)	Invoices, transaction records	Art. 6(1)(c) GDPR — legal obligation

4. Recipients of your data

We do not sell or rent your personal data. Data is shared only with:

• Service providers acting as processors under written agreements — currently web hosting (Hostinger), email, and form-handling providers.
• Public authorities, courts, or law-enforcement bodies when we are legally obliged to disclose.
• Successor entities in the event of a merger, acquisition, or reorganisation.

5. International transfers

Our primary servers and operations are located within the European Economic Area. Where a sub-processor is located outside the EEA, we ensure an adequate transfer mechanism is in place (Standard Contractual Clauses, EU–US Data Privacy Framework, or adequacy decision).

6. Data retention

• Contact-form submissions: up to 24 months from last interaction, unless a business relationship is established.
• Email correspondence: up to 7 years where required by accounting / commercial law.
• Server logs: typically 30–90 days, anonymised thereafter.

7. Cookies

Our website uses only strictly necessary cookies required for the site to function (for example, to remember your submitted form state). We do not use advertising, tracking, or third-party analytics cookies. Where future optional cookies are introduced, we will request your prior consent via a cookie banner in line with GDPR Article 7.

8. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Request erasure ("right to be forgotten") (Art. 17).
• Restrict or object to processing (Arts. 18, 21).
• Data portability (Art. 20).
• Withdraw consent at any time, where processing is based on consent (Art. 7(3)).
• Lodge a complaint with a supervisory authority — in Estonia, the Andmekaitseamet (Estonian Data Protection Inspectorate, www.aki.ee); or with your local EU/EEA supervisory authority.

To exercise any of these rights, email info@nordatech.eu with the subject line "Privacy request". We will respond within one calendar month.

9. Security

We use HTTPS/TLS encryption in transit, restrict access to personal data to a need-to-know basis, and require our processors to maintain equivalent safeguards.

10. Children

Our website is not directed at children under 16, and we do not knowingly collect their data.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be announced on the home page and the "Last updated" date above.

12. Contact

For any privacy-related question or request, write to info@nordatech.eu.