Privacy Policy - Nordkapp.NU

Nordkapp e-Com AB, company registration no. 559024-0486, is the data controller for the processing of personal data that takes place in connection with purchases, customer service, complaints, deliveries, customer accounts, marketing and use of the website.

This privacy policy describes what personal data we process, why we process it, the legal basis, storage period, recipients, transfers outside the EU/EEA and the rights you have under GDPR.

1. Personal data

Nordkapp e-Com AB, company registration no. 559024-0486, is the data controller for the processing of personal data that takes place in connection with purchases, customer service, complaints, deliveries, customer accounts, marketing and use of the website.

In this section, the same definitions as above are used: “Nordkapp.NU”, “we”, “us” and “our” refer to the data controller, unless the context indicates otherwise.

Practical information about how you exercise your rights under GDPR is available in section 9. There is also a pre-filled email template that helps us structure the case.

2. When we collect personal data

We collect personal data when you:

• place an order or make a purchase,
• enter contact, delivery or billing details at checkout,
• choose a payment method, apply for an instalment plan or undergo a credit assessment,
• create or use a customer account,
• contact customer service or use a contact form,
• make a complaint, request a return, make a warranty claim or report transport damage,
• arrange, receive or communicate about delivery and transport,
• subscribe to or unsubscribe from newsletters and other marketing,
• give consent or change your cookie and privacy settings,
• visit and use the website,
• interact with our email communications or digital marketing, if you have consented to such processing,
• communicate with a payment provider, carrier, supplier or other partner about your purchase,
• provide information needed to prevent fraud, maintain security or troubleshoot technical problems,
• otherwise provide personal data to us in connection with our business.

The data may be provided directly by you, collected automatically through the website and cookies, or received from payment providers, carriers and other partners.

3. What personal data we process

Depending on how you use the website, we may process the following personal data:

• name,
• address and delivery address,
• email address,
• telephone number,
• personal identity number or company registration number when required for payment, invoice, credit assessment or business purchases,
• order number, order history and purchase information,
• payment information and payment status,
• delivery information and transport details,
• communication with customer service,
• information in complaint, return or warranty cases,
• IP address,
• technical information about browser, device, operating system and use of the website,
• cookie settings and consent status,
• information about how you interact with the website, our email communications or digital marketing, if you have consented to such processing.

We do not process more personal data than is necessary for each purpose.

4. Why we process personal data, legal basis and storage period

Recipients and categories of recipients are set out in section 5. For cookies and similar technologies, issuers, third-party sharing and countries or regions are set out in our separate Cookie Policy.

5. Recipients of personal data

We share personal data only when necessary for the purposes described in this Privacy Policy or when we are required to do so by law.

Personal data may be shared with the following categories of recipients:

• payment providers,
• checkout, invoice and payment intermediaries, such as Kustom AB, Fortnox AB, Fortnox Finans AB and, where relevant, their payment partners,
• banks and payment recipients when needed to handle advance payment via internet banking, refunds or payment reconciliation,
• carriers and logistics partners,
• suppliers and manufacturers when needed for delivery, complaint, warranty or spare parts,
• IT and operations providers,
• providers of e-commerce platform and technical support,
• bookkeeping and financial systems,
• marketing and analytics services, if you have consented to such processing,
• authorities when required by law,
• advisers or legal representatives in the event of a dispute or legal claim.

When a supplier processes personal data on our behalf, we engage only processors that provide sufficient guarantees that the processing will comply with the GDPR and protect your rights. The processing is governed by a data processing agreement and may take place only on our documented instructions.

When you use Kustom Checkout, Kustom AB may process personal data as an independent data controller for the parts of the checkout service provided by Kustom. Kustom’s processing of personal data is described in Kustom’s own privacy information. Processing carried out by the payment service provider you choose in the checkout may be subject to that provider’s own terms and privacy information.

When Fortnox Fakturaservice is used, Fortnox AB, Fortnox Finans AB and/or their payment partners may process personal data to handle invoices, the payment portal, payment options, credit assessment, payment status, reminders, debt collection or other measures arising from the selected payment solution and applicable terms. Fortnox Finans AB may process certain personal data as an independent data controller. Fortnox currently publishes the relevant provider documents in Swedish. If you need help understanding the applicable information in English, you can ask us about Fortnox’s privacy information or ask us about the applicable Fortnox Finans terms before choosing the payment solution.

6. Transfer of personal data outside the EU/EEA

We strive to process personal data within the EU/EEA. In some cases, personal data may be processed or made available in countries outside the EU/EEA, for example when we use technical providers, analytics tools, marketing services or payment and IT services with international infrastructure.

If personal data is transferred to a country outside the EU/EEA, we ensure that the transfer is made with the support of applicable safeguards under GDPR, for example an adequacy decision, the European Commission’s standard contractual clauses or another lawful transfer mechanism.

Our separate Cookie Policy states whether personal data may be shared with third parties or transferred to countries or regions outside the EU/EEA due to the use of cookies or similar technologies.

7. How we protect personal data

We use technical and organisational measures to protect personal data against unauthorised access, loss, alteration, misuse or unauthorised disclosure.

The measures may include access controls, password protection, encrypted website, restricted access to systems, security procedures, logging and internal instructions for handling personal data.

Nordkapp.NU uses HTTPS to protect information transferred via the website.

8. Your rights under GDPR

You have the right to receive information about how we process your personal data. You also have the right to exercise the following rights under GDPR:

• Right of access - You have the right to receive confirmation as to whether we process personal data about you and, if so, to receive a copy of the data and information about the processing.
• Right to rectification - You have the right to request that incorrect or incomplete personal data is corrected or completed.
• Right to erasure - In certain cases, you have the right to request that your personal data is erased. However, we may need to retain certain data if required by law, for example bookkeeping rules, consumer law obligations or to handle legal claims.
• Right to restriction of processing - In certain cases, you have the right to request that the processing of your personal data is restricted, for example if you believe the data is incorrect or if you have objected to the processing.
• Right to object - You have the right to object to processing based on our legitimate interest. You always have the right to object to direct marketing.
• Right to data portability - When the processing is based on consent or contract and is automated, you may have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format.
• Right to withdraw consent - If the processing is based on your consent, you have the right to withdraw consent at any time. The withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
• Right to lodge a complaint - You have the right to lodge a complaint with the Swedish Authority for Privacy Protection, IMY, if you believe that our processing of your personal data violates data protection legislation.

9. How you exercise your rights

You are welcome to use the button below to send a pre-filled GDPR request by email. 

Send GDPR request by email

You can also use the page Contact us if you want to contact us without an email template.

We acknowledge receipt of your request within 48 hours on business days. We respond without undue delay and no later than one month after receiving it. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. If we extend the period, we will inform you within the first month and explain why.

To protect your personal data, we may need to verify your identity before handling a request.

Version: Applies from 2026-06-01.

Contact: cs@nordkapp.nu · Contact us