28.10.2026 · NordRoll Europe
Privacy in the NordRoll shop
Controller and contact
SIA NordRoll Europe is responsible for processing your personal data. For access, deletion or any privacy enquiry, contact info@nordroll.eu. The company’s full details appear below.
Data, purposes and legal bases
We process company and contact details, billing and delivery addresses, email, an optional telephone number, orders, invoices, payment status and references, and correspondence to handle enquiries, contracts, payment, delivery and complaints. Article 6(1)(b) GDPR applies when you are personally a party to the contract. For representatives of business customers, Article 6(1)(f) applies: our legitimate interest is managing and performing the business relationship. Tax and accounting records are processed to meet legal obligations under Article 6(1)(c).
Guest purchases require neither an account nor an EU VAT number. B2B registration requires company details, email and an EU VAT number. We check registration numbers and VAT numbers voluntarily entered at checkout through the European Commission’s VIES service, transmitting the country prefix and number. We retain the result, date, returned business details and review decision to check eligibility, prevent misuse and document tax treatment. Passwords and baskets are not sent to VIES. B2B account and discount approval are manual; VAT eligibility is assessed separately. For registration problems, request a review at info@nordroll.eu.
Recipients and external services
The website uses IONOS hosting and WordPress/WooCommerce. Authorised staff and necessary technical providers access data for their duties. Carriers receive the delivery and contact details necessary to dispatch goods from Latvia. The bank and, where applicable, accounting professionals receive necessary payment and accounting data. Authorities receive data when legally required. WhatsApp and other external services open only when you select their links and process data under their own policies. Do not send passwords or full card details through them.
Cookies, security and retention
Necessary cookies and storage support sessions, baskets, login and language and delivery-country choices. The language and country selection is stored in this browser for up to twelve months. Strictly necessary functions do not require consent; any analytics or advertising that requires consent must remain inactive until consent is obtained. Technical logs, including IP addresses and request data, support security and diagnosis under Article 6(1)(f). Do not put unnecessary personal data in order notes.
Account data is retained for the business relationship and can be deleted on request subject to outstanding obligations. Enquiries are retained as necessary to answer them and handle claims. Invoices are normally kept for five years from issue under Section 133 of Latvia’s VAT Law; other accounting records may have different or longer periods. Legal obligations and unresolved claims can prevent immediate deletion. Security data is retained only as long as required for its purpose.
Transfers and your rights
If a provider involves a transfer outside the EEA, an adequacy decision or Article 46 GDPR safeguards and, where necessary, additional measures are required. You can request information about the applicable safeguards. Subject to legal conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Any consent for an additional purpose can be withdrawn for the future. You can complain to a competent authority, including Latvia’s Datu valsts inspekcija. Mandatory details are necessary for the order or account; without them we cannot provide that function. We do not sell your data or make legally significant decisions solely through automated profiling.
Klix · Apple Pay · Google Pay
Klix payment processing (after activation): When you choose card, Apple Pay or Google Pay, AS Citadele banka (Klix by Citadele) processes the order, amount, currency, contact, payment reference and technical data necessary for payment. The selected payment services additionally process the data required for their method under their privacy notices. Our transmission relies on GDPR Article 6(1)(b), or Article 6(1)(f) for business representatives; statutory retention relies on Article 6(1)(c). NordRoll receives payment status and references for reconciliation and refunds; card secrets such as CVC are not collected in order notes. Payment currently uses bank transfer. Provider privacy information: https://www.citadele.lv.
SIA NordRoll Europe
Reg. 40203757176 · EU VAT LV40203757176 · D-U-N-S 366852038
Viestura laukums 9–13, Valmiermuiža, Valmieras pag., Valmieras nov., LV-4219, Latvia
Zane Kristiana Spandega · info@nordroll.eu · +49 151 111 90712