Personal data and cookie policy
Nordic-Drop ApS · Last updated: 26 October 2026
1. In short
When you shop with us, we use your information to send your order, take payment, help you through customer service and comply with the law. We only send newsletters and text messages if you have said yes, and we only use cookies for statistics and advertising if you have given your consent in our cookie banner. We never sell your information.
Below you can read exactly what information we process, why, who we share it with, how long we keep it and what rights you have.
This policy applies to our webshop at nordicdrop.com.
2. Who is responsible for your information?
We are the data controller:
Nordic-Drop ApS
Company reg. no. (CVR): 38750496
Lyongade 17A, 3-1
2300 Copenhagen S
Denmark
Email: support@nordicdrop.com
If you have questions about how we process your information, or if you want to exercise your rights, please write to us at support@nordicdrop.com.
3. When you shop with us
What information: Name, delivery and billing address, email, phone number, order number, what you have bought, chosen payment method and payment status, shipping information and information about any returns, exchanges and complaints.
Why: To pack, ship and deliver your order, take payment, send order confirmations, invoices and delivery updates, and handle withdrawals, returns and complaints.
Legal basis: It is necessary to perform our contract with you (Article 6(1)(b) GDPR). Information that forms part of our accounts is kept because the Danish Bookkeeping Act requires it (Article 6(1)(c) GDPR).
You will always receive the necessary messages about your order, even if you have not signed up for our newsletter.
4. Payment
You can pay with Visa, Mastercard, PayPal and Klarna. Our payment solution is provided by Pensopay, and we never see your full card number.
When you choose a payment method, we send the information needed for the payment (e.g. amount, order number, name and email) to the provider in question. Providers such as PayPal and Klarna also process the information as independent data controllers under their own privacy policies, for example to prevent fraud.
If you choose Klarna, Klarna may carry out a credit assessment of you. Klarna makes that decision and is responsible for it. Nordic-Drop does not itself make decisions about you based solely on automated processing.
5. Delivery and returns
Our warehouse and packing are handled by SM Logistik ApS, and we ship with UPS. UPS receives your name, delivery address, phone number and email so they can deliver the package and keep you updated along the way.
If you want to withdraw from your purchase, return or exchange an item, this is done via Revershero, either via Cancel purchase or our Return portal. Here, your order number, your email and information about the items you return are processed.
Legal basis: Performance of our contract with you (Article 6(1)(b) GDPR).
6. When you contact customer service
When you write to us, we process your name, your contact details, the content of your enquiry, your order number and anything you send us yourself, e.g. photos of a defective item. We use the customer service tool Herodesk to handle enquiries.
Legal basis: When the enquiry concerns a purchase, processing is necessary to perform the contract (Article 6(1)(b) GDPR). Otherwise, we process the information because we have a legitimate interest in replying to you and being able to document what we have agreed (Article 6(1)(f) GDPR).
7. Newsletter and text messages
If you sign up for our newsletter or text messages, we process your email and/or phone number, your name if you have provided it, the time of your sign-up and how you signed up. We also record whether you open and click in our emails and what you have bought before, so we can send you offers and news that suit you better. This is a form of profiling.
We only send marketing if you have given your consent. Consent to email does not automatically cover text messages, and vice versa.
We use Klaviyo to send both emails and text messages.
Legal basis: Your consent (Article 6(1)(a) GDPR and section 10 of the Danish Marketing Practices Act).
You can always unsubscribe free of charge via the link at the bottom of our emails, by replying STOP to our text messages or by writing to support@nordicdrop.com. Unsubscribing does not affect marketing we have lawfully sent until then.
Back-in-stock notifications
If you ask to be notified when a sold-out item is back in stock, we store your email and the item in question so we can send you one notification. This is not a newsletter sign-up.
Legal basis: Your request (Article 6(1)(b) GDPR). We delete the information once the notification has been sent or if the item is discontinued.
8. Cookies
What are cookies?
Cookies are small files stored in your browser when you visit a website. We also use similar technologies such as pixels and tags. In this policy, we call all of these cookies.
Your choice
The first time you visit nordicdrop.com, we show a cookie banner. Here you can say yes or no to each category of cookies. We do not set cookies for statistics or marketing until you have given your consent, and you can still shop with us if you say no.
You can change or withdraw your consent at any time via the cookie settings link at the bottom of the page. We use Pandectes to show the cookie banner and store your choice.
Which cookies do we use?
- Necessary cookies make the webshop work, e.g. the shopping cart, checkout, security and remembering your cookie choice. They do not require consent.
- Preference cookies remember your choices, e.g. country and currency.
- Statistics cookies show us how the site is used so we can improve it. We use Google Analytics.
- Marketing cookies measure whether our ads work and make it possible to show you relevant ads. We use Meta Pixel (Facebook and Instagram), TikTok Pixel, Google Ads and ProfitMetrics, which measures the effect of our ads.
You can see the full list with the name, provider, purpose and expiry of each cookie at nordicdrop.com/pages/cookies.
Trustpilot: On our product pages, we show our Trustpilot rating via a widget from Trustpilot A/S. When the widget loads, Trustpilot receives technical information such as your IP address and browser type. If you click through to Trustpilot or write a review, Trustpilot's own terms and privacy policy apply.
Legal basis: We set necessary cookies because they are needed to provide the service you request. Statistics and marketing cookies, and the related processing of information, are only used with your consent (Article 6(1)(a) GDPR and the ePrivacy rules).
9. Advertising with Meta, TikTok and Google
If you have accepted marketing cookies, our webshop sends information about your visit to the advertising platforms, e.g. which pages you view, what you add to your cart and whether you complete a purchase, together with online identifiers such as cookie ID and IP address.
Meta and TikTok: We are joint controllers with Meta Platforms Ireland Ltd. and TikTok Technology Limited (Ireland) for the collection and transfer of the information from our webshop. This means we are responsible for obtaining your consent and informing you, while Meta and TikTok are responsible for what they subsequently do with the information. We have agreements with both on the allocation of responsibilities. If you want to exercise your rights, you can contact us and we will forward your request. You can read more in Meta's privacy policy and TikTok's privacy policy.
Google: Google Ireland Limited processes the information from Google Analytics on our behalf as a data processor. Google processes the information from Google Ads as an independent data controller. Read more in Google's privacy policy.
10. Who do we share your information with?
We never sell your information. We only share it with the suppliers that help us run the webshop, and only the information they need.
Data processors (process the information on our behalf and on our instructions, under a data processing agreement):
- Shopify – operation of the webshop
- Pensopay – payment solution
- SM Logistik ApS – warehouse and packing
- Revershero – return portal
- Herodesk – customer service
- Klaviyo – email and text messages
- Pandectes – cookie banner and consent
- Invoice Hero – invoices
- Storebuddy – bookkeeping
- ProfitMetrics – measuring ad performance
- Google (Google Analytics) – statistics
Independent data controllers (process the information under their own terms):
- UPS – delivery
- Payment providers: PayPal, Klarna and card acquirer
- Google (Google Ads) – advertising
- Trustpilot – displaying our rating
Joint controllers: Meta and TikTok, see section 9.
We may also disclose information to our auditor, lawyer or public authorities if required by law or if necessary to handle a legal claim.
11. Transfers to countries outside the EU/EEA
Most of our suppliers process your information within the EU/EEA. A few transfer information to countries outside the EU/EEA:
- Shopify may process information in Canada and the USA. Canada is recognised by the European Commission as providing an adequate level of protection, and transfers to the USA are based on the European Commission's standard contractual clauses.
- Klaviyo, Google and Meta process information in the USA. The transfer is based on the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.
- TikTok may give access to information from countries outside the EU/EEA, including China. The transfer is based on the European Commission's standard contractual clauses.
If you would like a copy of the safeguards we use, please write to support@nordicdrop.com.
12. How long do we keep your information?
| Information | How long |
|---|---|
| Orders, invoices and other accounting records | 5 years from the end of the financial year the purchase belongs to (Danish Bookkeeping Act) |
| Customer service, returns and complaints | 3 years after the case is closed, so we can handle any claims |
| Newsletter and text messages | Until you unsubscribe. We keep documentation of your consent for 2 years after you unsubscribe |
| Cookies | As stated for each cookie on our cookie page, but no more than 13 months |
| Statistics in Google Analytics | 14 months |
| Back-in-stock notifications | Until the notification has been sent or the item is discontinued |
13. How we protect your information
We only use suppliers that comply with the GDPR, and we have data processing agreements with all our data processors. Only employees who need access for their work can access your information, and all our systems are protected with personal logins. The entire webshop uses an encrypted connection (HTTPS).
14. Your rights
You have the following rights under the GDPR:
- Access: You can find out what information we hold about you and get a copy.
- Rectification: You can have incorrect information corrected.
- Erasure: You can have your information deleted, unless we are required by law to keep it, e.g. under bookkeeping rules.
- Restriction: In certain cases, you can ask us to temporarily only store your information.
- Data portability: You can receive the information you have provided to us in a commonly used, machine-readable format.
- Objection: You can object to processing we carry out on the basis of our legitimate interest. You can always say no to us using your information for marketing, including profiling.
- Withdrawal of consent: You can always withdraw your consent. This does not affect processing carried out before you withdrew it.
Write to support@nordicdrop.com if you want to exercise your rights. We will reply as soon as possible and no later than within one month. If the matter is complex, the deadline may be extended by up to two months, and we will let you know. We may ask you to confirm your identity before we disclose any information.
15. Complaints
If you are unhappy with how we process your information, we would very much like to hear from you first. You also always have the right to complain to a data protection authority, for example in the country where you live. As we are established in Denmark, our lead supervisory authority is:
Datatilsynet (Danish Data Protection Agency)
Carl Jacobsens Vej 35, 2500 Valby, Denmark
www.datatilsynet.dk
16. Children
Our webshop is aimed at adults. Children under 15 cannot sign up for our newsletter or text messages themselves. If we find that we hold information about a child without a lawful basis, we will delete it.
17. Changes
We update this policy when we change how we process information or when the law changes. The date at the top shows when it was last updated. If there are significant changes, we will let you know.