Privacy Policy

DATA CONTROLLER

NordicPosterStore is the controller responsible for the processing of your personal data described in this Privacy Policy.

For data protection enquiries, including any of the rights described below, contact us at hey@nordicposterstore.com.

This Privacy Policy applies to personal data we process when you visit our websites or purchase our products, regardless of which market you are in. References to "GDPR" mean the EU General Data Protection Regulation (Regulation 2016/679) and, for users in the United Kingdom, the UK GDPR and the Data Protection Act 2018, as applicable.

COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies, such as local storage in your browser and tracking pixels, on our website. A cookie is a small text file that your browser stores on your device.

Necessary cookies are required for the website and checkout to work and are always active. We use them on the basis of our legitimate interest in providing the service you have asked for, and they are exempt from the consent requirement for strictly necessary storage. All other cookies, for analytics and statistics and for marketing, are only used if you consent to them (GDPR Article 6(1)(a)).

On your first visit, our cookie banner lets you accept all cookies or choose which categories to allow under Settings. You can change or withdraw your consent at any time using the "Cookie settings" link at the bottom of every page. Your choice is saved for 6 months, after which we ask again. Withdrawing consent does not affect processing carried out before you withdrew it.

You can also block or delete cookies in your browser settings, but parts of the website, such as the shopping bag and checkout, may then stop working.

Cookies and browser storage we use

ANALYTICS, ADVERTISING AND MEASUREMENT

If you allow analytics and statistics cookies, we use the following services to understand how our website is used and to improve it:

• Google Analytics (Google Ireland Ltd). Records which pages you view, how you arrived at our website, your approximate location (country or city), the device and browser you use, and purchases (order number, value and products). The data is linked to a random identifier stored in a cookie, not to your name, and Google Analytics does not store IP addresses.
• Hotjar (Hotjar Ltd). Heatmaps and session recordings that show how visitors navigate our pages. Text you type into forms is hidden.
• Ahrefs Web Analytics (Ahrefs Pte. Ltd.). Cookieless statistics on page views and where visitors come from.

If you allow marketing cookies, we use:

• Google Ads and Google Merchant Center (Google Ireland Ltd). Measures which ads and product listings lead to purchases. To measure more accurately ("enhanced conversions"), the email address, phone number, name and address from your order are hashed (turned into an irreversible code) in your browser before they are sent to Google, which matches them against its own signed-in users. Google does not receive this data unless you have allowed marketing cookies.
• Meta Pixel (Meta Platforms Ireland Ltd). Measures the results of our ads on Facebook and Instagram and helps us show relevant ads.
• Klaviyo (Klaviyo, Inc.). Newsletter sign-up forms and recognising subscribers when they visit our website.

Google Consent Mode. We use Google Consent Mode to respect your choice. If you decline analytics or marketing cookies, Google's tags neither set nor read cookies for that purpose. They may still send signals without cookies or identifiers (for example that a page was viewed or a purchase was made), which Google uses to estimate aggregate statistics without identifying you.

Google Customer Reviews. After a purchase we may ask whether you would like to take part in a Google Customer Reviews survey. To offer this, your email address, order number, delivery country and estimated delivery date are shared with Google. If you opt in, Google emails you a short survey after delivery. Taking part is voluntary, and Google handles the survey under its own privacy policy.

Google and Meta also act as independent controllers for some of their own processing, for example to improve their advertising services; their privacy policies explain how. Some of these services process data outside the EEA; see "International data transfers" below.

MANUALLY PROVIDES PERSONAL DATA

When you create an account, make a purchase, request information, or otherwise interact with us, we may ask for information to be able to fulfill your request. NordicPosterStore processes personal data to perform our contractual obligations and to comply with legal obligations. Furthermore, we process personal data to pursue our legitimate interest to maintain and develop our businesses.

Example of what we may ask for:

• Your Name.
• Your email address.
• Your address and phone number.
• In specific cases usernames and passwords, feedback, age, gender, and language.
• Photos you upload to create a photo poster. They are stored with our hosting provider and shared with our print partner so we can produce your order.

DATA PROCESSING FOR PAYMENT

We use Stripe as our payment processor to enable you to use the Credit Cards and Swish and any other applicable method authorized by you and provided by our payment service provider.

A essential part of the services provided by us is being able to purchase our goods and services. We do this using partners that we have rigorously evaluated in terms of security and compliance. NordicPosterStore does never store or process information such as, but not limited to, credit card numbers or bank accounts. Any such information entered on our website or as a part of our services is only processed by the payment gateway.

LAWFUL BASIS FOR PROCESSING

Under GDPR Article 6, every processing activity must rely on a lawful basis.
We rely on the following:

• Performance of a contract - to fulfil orders, deliver products, send order
confirmations, handle returns and customer support requests, and operate
your account.

• Compliance with a legal obligation - to meet bookkeeping, tax, consumer-
protection and product-safety obligations applicable in our markets.

• Legitimate interests - to maintain the security of our website, prevent
fraud, analyse aggregate usage of our services to improve them, and conduct
customer surveys. We carry out a balancing test before relying on
legitimate interests and never override your fundamental rights.

• Consent - for non-essential cookies, marketing emails and any optional
data sharing. You can withdraw consent at any time without affecting the
lawfulness of processing carried out before withdrawal.

PROVIDING PRODUCTS AND SERVICES - We use your personal data to provide our
services, ship and deliver products you order, process your requests, ensure
the functionality and security of our services and correct delivery, identify
you, and prevent and investigate fraud and other misuse.

COMMUNICATION - We use your personal data to communicate with you, for
example to inform you of changes to our services, to send critical alerts
relating to our services and products, and to contact you for sales-related
purposes.

MARKETING - With your consent (or where otherwise permitted by law), we may
contact you about new products, services or promotions and conduct market
research. We may also use your personal data to personalise our offering and
to display tailored content and advertising, including third-party content.
You can object to marketing or withdraw consent at any time using the
unsubscribe link in any email or by contacting us.

SHARING YOUR PERSONAL DATA

We will never sell, lease or rent your personal data and may only disclose your personal data to third parties in the circumstances stated below.

• Companies in NordicPosterStore's corporate structureWe may share your personal data with other NordicPosterStore associated companies (affiliates or parent companies) or authorized third parties who process personal data on behalf of us, but only for the purposes described in this Policy and while the party are performing services for NordicPosterStore.
• Mandatory disclosures.We may access, disclose and preserve your personal data, when we have a good faith belief that doing so is necessary to: (1) comply with applicable law or respond to valid legal process from competent authorities, including from law enforcement or other government agencies; (2) protect our customers, (e.g. from spam or fraud and/or preventing serious injury or loss of life); (3) operate and maintain the security of our Services, including to prevent or stop an attack on our computer systems or networks; or (4) protect the rights or property of NordicPosterStore, including enforcing the terms governing the use of the Services, possibly in cooperation with law enforcement agencies.
• Mergers and Acquisitions.If NordicPosterStore is involved in a merger, acquisition or asset sale, we may transfer personal data to the third party involved. However, we will continue to ensure the confidentiality of all personal data.
• Companies listed under “Data shared with Third parties”

DATA SHARED WITH THIRD PARTIES

We share personal data only with the service providers and partners below, and only as far as they need it for the purpose stated. Service providers process personal data on our behalf, under a data processing agreement and our instructions. We never sell your personal data.

YOUR RIGHTS UNDER GDPR / UK GDPR

You have the following rights regarding the personal data we hold about you:

• Right of access (Art. 15) – to obtain a copy of your personal data and information about how we process it.
• Right to rectification (Art. 16) – to have inaccurate or incomplete data corrected.
• Right to erasure, the "right to be forgotten" (Art. 17) – to have your data deleted, except where we must keep it by law (for example bookkeeping obligations) or to defend legal claims.
• Right to restriction of processing (Art. 18) – to limit how we use your data while a dispute or correction is being resolved.
• Right to data portability (Art. 20) – to receive your data in a commonly used, machine-readable format and have it sent to another controller where technically feasible.
• Right to object (Art. 21) – to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent (Art. 7) – at any time, without affecting processing carried out before withdrawal. For cookies, use the "Cookie settings" link at the bottom of every page.
• Right not to be subject to automated decision-making (Art. 22) – including profiling with legal or similarly significant effects. We do not carry out such processing.

If you live in Switzerland, you have corresponding rights under the Swiss Federal Act on Data Protection (FADP).

To exercise any of these rights, contact us at hey@nordicposterstore.com. We respond within one month of receiving your request, in accordance with GDPR Article 12.

Right to lodge a complaint

If you believe our processing of your personal data breaks data protection law, you can lodge a complaint with the data protection authority in the country where you live, for example:

• Sweden – Integritetsskyddsmyndigheten (IMY) – imy.se
• Denmark – Datatilsynet – datatilsynet.dk
• Norway – Datatilsynet – datatilsynet.no
• Germany – Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) – bfdi.bund.de, or the data protection authority of your federal state
• Netherlands – Autoriteit Persoonsgegevens (AP) – autoriteitpersoonsgegevens.nl
• France – Commission nationale de l'informatique et des libertés (CNIL) – cnil.fr
• Switzerland – Federal Data Protection and Information Commissioner (FDPIC) – edoeb.admin.ch
• United Kingdom – Information Commissioner's Office (ICO) – ico.org.uk
• Ireland – Data Protection Commission (DPC) – dataprotection.ie

Users in other EU/EEA countries can contact their national data protection authority. We would appreciate the chance to address your concerns first, so please contact us at hey@nordicposterstore.com.

DATA RETENTION

We keep your personal data only for as long as it is needed for the purposes described in this policy, or as long as the law requires:

• Order data, invoices and payment records – 7 years after the end of the calendar year of the purchase (Swedish Bookkeeping Act; similar obligations apply in our other markets).
• Customer service correspondence – up to 3 years after our last contact.
• Newsletter and marketing data – until you unsubscribe or withdraw your consent.
• Photos uploaded for photo posters – for as long as needed to produce and deliver your order and handle any complaint, or until you ask us to delete them.
• Cookies and browser storage – as listed in the table under "Cookies and similar technologies". Your cookie choice is kept for 6 months.
• Analytics data in Google Analytics – up to 14 months, after which it is deleted automatically.
• Account information – until you ask for deletion or after 3 years of inactivity, whichever comes first.

When the retention period ends, we delete or anonymise the data so it can no longer be linked to you.

Children's data

Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe we have collected such data, please contact us and we will delete it promptly.

SAFEGUARDING PERSONAL DATA

We protect your personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access limited to the people who need it, and data processing agreements with all of our service providers.

We do not store personal data longer than is legally permitted and necessary for the purposes of providing our services. The storage period depends on the nature of the information and the purposes of processing, so the maximum period varies by use.

INTERNATIONAL DATA TRANSFERS

Some of the recipients listed above store or process personal data outside the European Economic Area (EEA), the United Kingdom or Switzerland. When that happens, we make sure your data stays adequately protected through one or more of these safeguards:

• Adequacy decisions by the European Commission, the UK Government or the Swiss Federal Council.
• The EU–US Data Privacy Framework and its UK and Swiss extensions, for US companies certified under it (for example Google and Meta).
• Standard Contractual Clauses approved by the European Commission (with the UK Addendum and Swiss amendments where relevant), supplemented by additional technical and organisational measures where needed.

You can request a copy of the safeguards in place by contacting us.