Privacy policy

Who is responsible

Bendix Konsulting AS, Overlege Helsingens veg 18, 7805 Namsos, Norway, organisation number 932 333 546, runs this shop under the trade name Nosesafari and is the controller within the meaning of the General Data Protection Regulation. You can reach us at hello@nosesafari.com.

Norway is part of the European Economic Area, where the GDPR applies directly. We are not required to appoint a data protection officer under Article 37 GDPR.

What we process, and why

Orders

Name, delivery and billing address, email address, phone number if you give one, and the details of your order and payment. Purpose: performing the contract, including dispatch, refunds and customer service. Legal basis: Article 6(1)(b) GDPR.

Import and tax

Recipient name, address, value of the goods and customs classification are passed to our logistics partner and to the competent authorities for the customs declaration and for import VAT under the IOSS scheme. Legal basis: Article 6(1)(c) GDPR.

Bookkeeping

Invoice and payment records are kept for the statutory retention periods. Legal basis: Article 6(1)(c) GDPR.

Messages you send us

The content of your message and your contact details, so we can answer. Legal basis: Article 6(1)(b) GDPR where the message concerns an order, otherwise Article 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Running and securing the shop

Server and log data, and the strictly necessary cookies the shop platform sets so that the basket, your language choice and the checkout work and abuse can be detected. Legal basis: Article 6(1)(f) GDPR, and for storage on your device the exemption for strictly necessary storage.

We do not currently use analytics or marketing cookies. If that changes, we will ask for your consent first and update this policy.

If you sign up for our newsletter we process your email address on the basis of your consent, Article 6(1)(a) GDPR. You can withdraw that consent at any time with effect for the future, using the unsubscribe link in any email or by writing to us.

Who receives the data

Shopify International Limited, Ireland, provides the shop platform, the hosting and the checkout, and processes the data above on our behalf as our processor.

Payments are handled by the payment provider behind the method you choose at checkout. That provider is a controller in its own right for that processing.

CJ Dropshipping receives your name, delivery address and the contents of your order in order to pick and ship it. Dispatch is from the People’s Republic of China, and the transfer there is necessary for the performance of your contract with us, Article 49(1)(b) GDPR.

The carrier engaged for the shipment receives the data it needs to deliver the parcel.

How long we keep it

Order data is kept while the contract is being performed and afterwards for the statutory retention periods. Under Norwegian bookkeeping law that is five years after the end of the financial year, and longer in some cases. Enquiries unrelated to an order are deleted once they are dealt with. Newsletter data is deleted when you withdraw your consent.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on Article 6(1)(f) (Article 21). You can withdraw consent at any time with effect for the future. Write to hello@nosesafari.com.

You can also complain to a supervisory authority, in particular the one where you live or work. The authority responsible for us as a Norwegian company is Datatilsynet, the Norwegian Data Protection Authority, in Oslo.

What you have to give us

Without a name, a delivery address and an email address we cannot fulfil an order. Everything else is optional. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Version

The version of this policy published on this page is the one that applies.