Privacy Policy
1. General Provisions
1.1. This Privacy Policy governs the principles of collecting, processing, and storing personal data. The controller of personal data is OÜ Flaka (registry code 12508614, address Ojakalda, Muru village, 44218 Rakvere parish, Lääne-Viru county) (hereinafter the controller).
1.2. A data subject within the meaning of this Privacy Policy is a customer or any other natural person whose personal data is processed by the controller.
1.3. A customer is a person who purchases goods or services from the online store www.nordrc.ee.
1.4. The controller processes personal data in accordance with applicable legislation, including the General Data Protection Regulation (GDPR).
2. Collection, Processing and Storage of Personal Data
2.1. Personal data is collected via the online store (www.nordrc.ee), email (info@nordrc.ee), and customer communication.
2.2. By submitting personal data, the data subject gives consent to its processing in accordance with this Privacy Policy.
2.3. The data subject is responsible for the accuracy of the data provided.
2.4. The controller is not liable for damages caused by the submission of incorrect data.
3. Processing of Personal Data
3.1. Types of Data Collected
- first and last name
- phone number
- email address
- delivery and billing address
- payment data (not stored by the controller, but processed securely via payment service providers)
- purchase history
- IP address and cookie data
3.2. Sources of Data
Personal data is collected directly from the customer and, where necessary, from public registers.
3.3. Legal Basis
Personal data is processed on the following legal bases:
- performance of a contract
- compliance with legal obligations
- consent
- legitimate interest
3.4. Purposes and Retention
- Order processing – up to 3 years
- Customer management – up to 3 years from the last purchase
- Operation of the online store (Shopify platform) – until account deletion
- Accounting – 7 years
- Marketing – until consent is withdrawn
- Security and fraud prevention – up to 2 years
3.5. Data Sharing
Personal data may be shared with the following partners:
-
Payment service provider:
Montonio Finance UAB (registry code 305205122, Lithuania) -
Courier services:
Omniva
DPD -
IT service providers and hosting providers
-
Accounting service providers
3.6. Shopify Platform
The online store operates on the Shopify platform (Shopify Inc., Shopify International Ltd, or Shopify Europe Ltd).
Shopify processes personal data as a data processor to ensure the operation, hosting, and order management of the online store.
Shopify servers may be located outside the European Economic Area. Data transfers are carried out based on the European Commission’s Standard Contractual Clauses (SCCs) to ensure adequate data protection.
3.7. Data Security
To protect personal data, the following measures are used:
- secure connection (HTTPS)
- restricted access to data
- technical and organizational security measures
3.8. Cookies
The website www.nordrc.ee uses cookies.
Cookies are used to:
- ensure proper functioning of the online store
- improve user experience
- collect statistics
- support marketing activities
Users have the right to disable or delete cookies via their browser settings.
3.9. Data Retention
Personal data is stored for up to 7 years unless a longer retention period is required by law.
4. Rights of the Data Subject
The data subject has the right to:
- access their personal data
- request correction of data
- request deletion of data
- restrict processing
- object to processing
- withdraw consent
To exercise these rights, please contact: info@nordrc.ee
The data subject also has the right to contact the Estonian Data Protection Inspectorate.
5. Final Provisions
5.1. This Privacy Policy is prepared in accordance with the GDPR and applicable Estonian legislation.
5.2. The controller has the right to amend these terms. Changes will be announced on the website www.nordrc.ee