Privacy policy
Last updated: 31 August 2026
Who is responsible
This policy explains how Norvelva AS ("Norvelva®", "we", "us" or "our") processes personal data when you visit or use our website and online store, place an order, create a customer account, or contact us. Norvelva AS is the data controller for the processing described in this policy.
Company: Norvelva AS
Norwegian organisation number: 123 456 789 (TEMPORARY PLACEHOLDER - REPLACE BEFORE PUBLICATION)
Address: Granitten 7, 4956 Risør, Norway
Email: hello@norvelva.com
Telephone: +47 92 53 36 31
Personal data and sources
We process only the personal data needed to operate the store, fulfil orders and meet our legal obligations:
Identity and contact data. Name, billing and delivery address, email address and telephone number.
Order and transaction data. Products ordered, price, payment status, order history, delivery, returns and refunds.
Customer account data. Account identifier, preferences and settings if you choose to create an account.
Communications. Information you provide in emails, contact forms and customer-service enquiries.
Technical and usage data. IP address, browser and device information, pages viewed, cart activity, cookie identifiers and privacy choices.
Full payment-card details are submitted directly to Shopify or the relevant payment service provider. Norvelva AS receives payment status and a transaction reference but does not store the full card number.
We receive data directly from you, automatically from your device when you use the store, and from Shopify, payment providers and delivery providers when necessary to complete or manage a transaction.
How and why we use personal data
Orders and customer accounts. We use personal data to accept and fulfil orders, receive payment confirmation, deliver goods, manage customer accounts and handle returns and refunds. Legal basis: performance of a contract or steps requested before a contract, GDPR Article 6(1)(b).
Customer service. We use personal data to answer questions and provide support. For enquiries connected with an order, the legal basis is GDPR Article 6(1)(b). For general enquiries, the legal basis is our legitimate interest in providing customer service, GDPR Article 6(1)(f).
Legal obligations. We retain and disclose information where necessary to comply with Norwegian bookkeeping, tax, consumer and other legal obligations. Legal basis: GDPR Article 6(1)(c).
Security and legal claims. We use data to secure the store, prevent and detect fraud, and establish, exercise or defend legal claims. Legal basis: our legitimate interests in protecting customers, the business and our legal rights, GDPR Article 6(1)(f).
Marketing and non-essential analytics. We send marketing and use non-essential analytics or advertising technologies only when you have consented. Legal basis: GDPR Article 6(1)(a). You may withdraw consent at any time.
When we rely on legitimate interests, we assess whether our interests are overridden by your rights and interests and limit the processing accordingly.
Who we share personal data with
We disclose only the information necessary for the relevant purpose to the following recipients:
Shopify and technical service providers, which host, secure and operate the online store;
payment service providers, which process payments and refunds;
delivery and logistics providers, which deliver orders and manage returns;
accountants, auditors and professional advisers, where needed for accounting, compliance or legal claims;
analytics and marketing providers, only where the relevant processing is covered by your consent; and
public authorities and courts, where disclosure is required by law or a valid legal order.
Service providers that act as processors may use personal data only under our instructions and contractual safeguards. We do not sell personal data.
Shopify and international transfers
Our online store is hosted by Shopify. Shopify processes store and customer data on our behalf and, for certain services, as an independent data controller. Further information is available in the Shopify Consumer Privacy Policy. You can exercise rights relating to Shopify's own processing through the Shopify Privacy Portal.
Shopify and some other service providers process personal data outside the European Economic Area (EEA). Where a country is not covered by an adequacy decision, the transfer is protected by safeguards such as the European Commission's Standard Contractual Clauses and any required supplementary measures. Contact us if you would like information about, or a copy of, the relevant safeguards.
How long we retain personal data
Orders and accounting records. Five years after the end of the financial year to which the records relate, unless a longer period is required by law.
Customer accounts. While the account is active. Accounts with no activity for three years are deleted or anonymised, except for information that must be retained by law.
Customer-service communications. Two years after the matter is closed.
Marketing data. Until you withdraw consent or after two years without interaction, whichever occurs first. We retain minimal information about an opt-out where necessary to ensure that no further marketing is sent.
Our technical and security logs. Normally no longer than 12 months, unless needed to investigate a security incident.
Relevant information may be kept longer where necessary to comply with law or to establish, exercise or defend a legal claim. Shopify and other independent controllers apply their own retention periods to processing carried out for their own purposes.
Cookies and marketing
We use strictly necessary cookies to provide functions you request, such as the shopping cart, checkout, security and privacy settings. Non-essential analytics, personalisation and advertising cookies are activated only after you consent. The current cookie list, including provider, purpose and duration, is available through the Cookie settings link in the website footer. You can change or withdraw your choice there at any time.
We send marketing emails only with your consent. Every marketing email contains an unsubscribe link. Withdrawing from marketing does not stop necessary messages about your account, order, delivery, return or refund.
Your rights
Subject to the conditions in data-protection law, you have the right to request access to, correction or deletion of your personal data; restriction of processing; data portability; and to object to processing based on legitimate interests. You have an unconditional right to object to direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal.
To exercise your rights, contact hello@norvelva.com. We may request information needed to verify your identity.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Required information and automated decisions
Your name, contact and delivery details and payment confirmation are required to place and fulfil an order. If you do not provide them, we cannot process the order. Creating a customer account and consenting to marketing or non-essential cookies are optional.
Norvelva AS does not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
