Privacy policy
movanze.co.uk
Version: 20 October 2026
This privacy policy explains how Nordics Co AS processes personal data on movanze.co.uk and when you order, when we perform the contract and in customer service.
1. Controller
The controller is:
Nordics Co AS
c/o BA5 Invest AS
Cort Adelers gate 17
0254 Oslo, Norway
Organisation number 932 343 487
E-mail: contact@nordics.co
Nordics Co AS is established in Norway, in the European Economic Area (EEA). Because we offer our products to customers in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to our processing of your personal data, alongside the GDPR as it applies in Norway.
We do not currently have a data protection officer. You can send questions about privacy to contact@nordics.co.
2. Website and technical infrastructure
2.1 Website hosting through Vercel
The public website and the order form are delivered through Vercel. Technically necessary connection data may be processed, such as IP address, time of the visit, URL requested, referring page, browser and device information and technical error and security information.
Order and customer data are not stored at Vercel. Data from the order process goes directly to our backend at api.nordics.co.
The legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest is a secure, stable and efficient website.
2.2 Backend, database and document storage through AWS
Our backend and the API at api.nordics.co run on Amazon Web Services (AWS). We use AWS for hosting, the database, technical log files and document and object storage, in particular S3. The primary region is Stockholm (Sweden); for failover we use Frankfurt (Germany).
In the backend we process the data needed to perform the contract and for customer service, in particular name, address, e-mail address, order, contract, payment and invoice data, and communication and system log files. We do not ask for your date of birth or phone number in the UK order process.
Insofar as the processing is necessary for the order and the performance of the contract, the legal basis is Article 6(1)(b) UK GDPR. We process security, stability and technical log data on the basis of Article 6(1)(f) UK GDPR. Data that we are legally required to keep is processed on the basis of Article 6(1)(c) UK GDPR.
2.3 Cloudflare in front of the API
In front of api.nordics.co we use Cloudflare as a security, proxy and CDN service. Connection and content data may be processed in transit. For api.nordics.co, Cloudflare Regional Services / Data Localization for the EU are enabled, so that the regionalised processing takes place in the EU.
The legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest is above all protection against misuse and attacks and a secure, fast connection to the API.
2.4 Retention of technical data
We only keep technical log and security data for as long as necessary for operation, error analysis, preventing misuse and investigating specific security incidents. If data is needed to establish, exercise or defend legal claims, we may keep it longer until the matter has been concluded.
2.5 Visitor statistics with Plausible Analytics
For visitor statistics we use our own installation of Plausible Analytics on our own servers in the EU. Plausible sets no cookies and stores no information on your device. Your IP address is only used briefly, together with the browser type, to create an anonymous code that changes daily, and is then discarded; it is not stored. The statistics are aggregated and cannot be traced back to you.
The legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest is measuring and improving the use of our website. You can object to this processing at any time (Article 21 UK GDPR).
3. Orders, performance of the contract and the delivery service
To process your order and perform the contract, we process in particular your name, delivery and billing address, e-mail address and order, contract, payment and invoice data. We do not ask for a phone number or a date of birth in the UK order process.
The legal basis is Article 6(1)(b) UK GDPR. Where statutory retention, tax, accounting or evidence obligations apply, the legal basis is also Article 6(1)(c) UK GDPR.
3.1 Payments
We currently offer Stripe and PayPal as payment methods. If you choose one of these payment methods, we send the data needed for the payment to the payment provider concerned. Card or account details are, as a rule, processed directly by the payment provider; we only receive the information needed for the order, the payment status, accounting and refunds.
The legal basis for the transfer is Article 6(1)(b) UK GDPR. Payment providers may be controllers in their own right for certain processing.
3.2 Warehouse, delivery and returns
For storage, order picking, packing, delivery and returns we work with Lundeby Webblager AB in Sweden. For this we pass on the necessary customer and order data, in particular name, address, e-mail address and order information.
For delivery we pass on the necessary delivery data to the carriers we use, currently mainly PostNord and DHL and their partners in the United Kingdom. As we don't ask for a phone number in the UK checkout, we pass no phone number from this process to the carriers.
The legal basis is Article 6(1)(b) UK GDPR.
3.3 Transactional e-mails
We send e-mails about the contract, such as order confirmations, delivery information, information about refunds and any reminders before later deliveries, through Mailgun. Mailgun is set to its EU region for this. In particular your e-mail address, technical delivery information and the necessary content about the contract or order are processed.
The legal basis is Article 6(1)(b) UK GDPR. Insofar as we keep delivery logs for security or evidence, the processing may also be based on Article 6(1)(f) UK GDPR.
3.4 Evidence of the order
When you order, we store the IP address and the browser identification of the device used, together with the time of the order. This lets us prove the order in a dispute and prevent misuse. The legal basis is Article 6(1)(f) UK GDPR; our legitimate interest is evidence and fraud prevention. We delete this data no later than 36 months after the order, unless we need it for an ongoing dispute. In a dispute we may pass it on to our payment provider.
3.5 Customer account “My account”
In “My account” (account.nordics.co) you can view, change and cancel your orders and your delivery service. You log in with a code or link that we send to your e-mail address. We process your e-mail address, your contract and order data and technical login data. The legal basis is Article 6(1)(b) UK GDPR, and for the security of the login Article 6(1)(f) UK GDPR.
3.6 Retention of contract data
We keep contract, payment, invoice and accounting data for as long as statutory retention obligations for commerce, tax and accounting require. We keep other contract data and evidence until the end of the statutory limitation periods, unless keeping it longer is necessary to establish, exercise or defend legal claims.
4. Customer service and e-mail contact
If you contact us at contact@nordics.co, we process the data you send us and the content of your message to deal with your request. This may in particular include order and contract data, return information, supporting documents and other data you send us yourself. If you use the “Cancel your contract online” function, we process your name, your e-mail address, the content of your notice and the date and time of receipt, to record and acknowledge the cancellation.
For contact@nordics.co we use Google Workspace / Gmail. An EU data region is set for this service.
The legal basis is Article 6(1)(b) UK GDPR insofar as the contact concerns an existing or intended contract, and for the acknowledgement of a cancellation Article 6(1)(c) UK GDPR. Otherwise the legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest is efficient contact with customers and a verifiable handling of requests.
We delete correspondence as soon as it is no longer needed to deal with your request or for statutory evidence, retention or limitation periods.
5. Marketing by e-mail
If you give your consent (for example with the tick box after your order), we send you offers and news about our products by e-mail about once or twice a year. The legal basis is your consent (Article 6(1)(a) UK GDPR and regulation 22 of the Privacy and Electronic Communications Regulations 2003, PECR). You can withdraw your consent at any time, using the link in every e-mail or by e-mail to contact@nordics.co; this does not affect the lawfulness of earlier e-mails. We keep the content and time of your consent and its withdrawal, so that we can prove them.
6. Cookies and consent management
We use a consent and cookie management solution we developed ourselves. Analytics and marketing services that are not technically necessary are only enabled after you have given your consent.
Storing information on your device or accessing it requires your consent (regulation 6 PECR), unless it is strictly necessary to provide the service you request (for example to remember your cookie choice or to make the order form work). The processing of personal data that follows is based on Article 6(1)(a) UK GDPR.
Storing your consent choice is necessary to put your choice into effect technically and to be able to prove it. The legal basis for this is Article 6(1)(f) UK GDPR; the technical storage is strictly necessary within the meaning of regulation 6 PECR.
We keep consent choices and the related evidence until you change or withdraw them, and after that only for as long as necessary for statutory evidence obligations or to establish, exercise or defend legal claims.
You can change or withdraw your consent at any time with effect from that moment through the cookie settings on the website. Insofar as we use Google services, your consent status may be passed to Google through Google Consent Mode. Storage and advertising functions you have not consented to are not enabled.
7. Analytics, statistics and marketing after consent
The analytics and marketing services below are only enabled after your consent. The legal basis for processing personal data is Article 6(1)(a) UK GDPR. Insofar as a service reads or stores information on your device, regulation 6 PECR also applies.
- Google Analytics 4: analysis of the reach and use of the website.
- Google Ads conversion tracking: measuring how effective our Google ads and the related conversions are.
- Microsoft Advertising UET: measuring advertising and conversion events for Microsoft Advertising.
- Meta Pixel: measuring and optimising advertising campaigns on Meta's platforms.
- TikTok Pixel: measuring and optimising advertising campaigns on TikTok.
- Snap Pixel: measuring and optimising advertising campaigns on Snapchat.
- Server-side tagging: on our own server in the EU (AWS, Stockholm). The server technically processes released tracking events and forwards them, according to our settings, to the analytics and advertising services that are enabled.
7.1 Matching orders to ads (Customer Match, Enhanced Conversions)
After your consent, we send data from the order process to our own server-side tagging environment (our own server in the EU). From there, we give the enabled advertising services – in particular Google, Meta, TikTok, Snap and Microsoft – characteristics to match an order to an earlier interaction with an ad (Customer Match, Enhanced Conversions or similar functions).
For this, your e-mail address is cryptographically hashed before it is forwarded to the advertising services; we do not send it to these services in readable form. The legal basis is Article 6(1)(a) UK GDPR. Without your consent no such matching takes place, and you can withdraw your consent at any time through the cookie settings.
7.2 Retention
We only process analytics and marketing data for as long as necessary for the purpose concerned, until you withdraw your consent or the processing stops. Insofar as providers process data under their own responsibility, their own retention periods also apply. You can view and change your current choice and the categories on the website at any time through the cookie settings.
8. International transfers
Your data is processed outside the United Kingdom, in the EEA: our company is in Norway and our core infrastructure is in the EU, in particular AWS in Stockholm with failover to Frankfurt, Cloudflare Regional Services for the EU, Google Workspace with an EU data region and Mailgun EU. The United Kingdom recognises the EEA countries as providing adequate protection for personal data.
With international providers, it cannot be ruled out that certain support, security, group or sub-processor operations take place outside the UK and the EEA. If personal data goes to such a country, this only happens under the conditions of Chapter V UK GDPR, in particular on the basis of UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses (Article 46 UK GDPR).
You can ask for information about the basis of a particular transfer and about the safeguards at contact@nordics.co.
9. No sale of personal data
We do not sell your personal data. We only pass it on insofar as this is necessary for the purposes in this policy, on the basis of your consent, to perform the contract, because of a legal obligation or on another legal basis.
10. Your data protection rights
Under the conditions of the law you have in particular these rights: access (Article 15 UK GDPR), rectification (Article 16 UK GDPR), erasure (Article 17 UK GDPR), restriction of processing (Article 18 UK GDPR), data portability (Article 20 UK GDPR), objection to processing based on Article 6(1)(e) or (f) UK GDPR on grounds relating to your particular situation (Article 21 UK GDPR), and withdrawal of any consent you have given, with effect from that moment.
To exercise your rights, an e-mail to contact@nordics.co is enough.
You also have the right to complain to a supervisory authority, in the United Kingdom the Information Commissioner's Office (ICO) (ico.org.uk). You can also contact the Norwegian supervisory authority responsible for us, Datatilsynet.
11. Obligation to provide data
The data marked as required in the order process, in particular name, address and e-mail address, is necessary for the order and the performance of the contract. Without this data we cannot carry out the order. Depending on the payment method, payment details are processed directly by the payment provider concerned.
12. Automated decisions
No solely automated decisions with legal effects or similarly significant effects within the meaning of Article 22 UK GDPR take place. We do not currently use website and customer data for our own automated profiling decisions about customers. The consent-based analytics, conversion and remarketing functions of the platforms named above are separate from this.
13. Changes to this privacy policy
We update this privacy policy when our processing, the services we use or the law change. The version on the website is always the current one. We only use new functions or additional marketing channels after we have updated this privacy policy.