Privacy policy

This policy describes how the NordRoot store processes the personal data of customers and website visitors.

Data controller

NordRoot.EU, company code 305997233, VAT number LT100016855210
V. Nagevičiaus g. 3, Vilnius, Lithuania
Email: info@nordroot.eu · Phone: +370 623 40 995

What data we process and why

Data Purpose Legal basis Retention
Name, email, phone, delivery address or pickup point Fulfilling and delivering orders Performance of a contract (Art. 6(1)(b) GDPR) 10 years (accounting rules)
Order and payment details (card data is handled by the payment provider and never reaches us) Payment and accounting Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) 10 years
Correspondence with customer service Handling enquiries and complaints Legitimate interest (Art. 6(1)(f)) 1 year after the enquiry is resolved
Review, name, country Publishing reviews Consent (Art. 6(1)(a)) Until consent is withdrawn
Email for the newsletter Sending offers Consent Until unsubscribed
Cookies and browsing data Running the site, statistics, marketing Essential: legitimate interest; others: consent See the cookie policy

Who receives the data

  • Shopify: the e-commerce platform;
  • our supplier in Poland, which packs and ships orders (name, phone, email, delivery address);
  • the shipping broker GlobKurier and the courier DPD (delivery details);
  • the payment provider Montonio;
  • our accounting service provider and public authorities where the law requires it.

Some providers (for example Shopify) may process data outside the European Economic Area. In that case the standard contractual clauses approved by the European Commission apply.

Individual rights

Every person has the right to access their data, have it corrected or erased, restrict or object to its processing, receive it in a portable form and withdraw consent at any time. Requests can be sent to info@nordroot.eu; we reply within 30 days. Complaints can be filed with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or the data protection authority in the person's own country.

Data security

Access to order data is limited to the people and partners who need it to fulfil the order.

Last updated: 2026-11-08.