​

Last updated: 16 September 2026

At Norvak, protecting your personal information is a priority. We use industry-standard security measures and secure third-party payment gateways to process your payments safely.

Your personal information — such as your name, address, and email address — is used only when necessary to process your orders, provide customer support, and improve your shopping experience. We will never sell or trade your personal information, and we will not share your information with unauthorised third parties.

This policy explains in more detail how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the UK Electronic Commerce Regulations.

1. Who We Are

Norvak ("we", "us", "our") is the data controller responsible for your personal information.

• Trading name: Norvak

• Address: Ariel Way, London W12 7GF, United Kingdom

• Contact email: support@norvak.online

If you have any questions about this policy or how we handle your personal data, please contact us using the email address above.

2. What Information We Collect

We may collect the following categories of personal data when you place an order or use our website:

• Contact information: name, email address, delivery and billing address, and telephone number

• Order information: products purchased, order value, and purchase history

• Payment information: securely processed by our third-party payment provider — we do not store complete card details

• Technical information: IP address, browser type, device information, and cookies

• Communications you send us: customer support requests and reviews

3. How We Use Your Information and Our Lawful Bases

We use your personal data only where permitted by law. The table below explains the purposes for which we use your data and the corresponding lawful basis:

PurposeLawful basis

Processing and fulfilling your order (shipping and billing)Performance of a contract

Providing customer supportPerformance of a contract

Sending order updates and service-related communicationsPerformance of a contract / Legitimate interests

Sending marketing emails (only if you opt in)Consent

Improving our website and shopping experienceLegitimate interests

Preventing fraud and maintaining website securityLegitimate interests / Legal obligation

Complying with tax, accounting, and legal obligationsLegal obligation

You may withdraw your consent to receive marketing communications at any time by clicking "unsubscribe" or by contacting us directly.

4. Cookies

Our website uses cookies and similar technologies to help the website function properly and to understand how visitors use our website. Some cookies are essential for the operation of the website; others, such as analytics or advertising cookies, are used only with your consent, in accordance with the Privacy and Electronic Communications Regulations (PECR).

You can manage or withdraw your cookie preferences at any time through our cookie consent banner.

5. Sharing Your Information

We never sell or trade your personal information. We share your data only with trusted third parties where necessary to operate our business, including:

• Payment processing: Stripe

• Website hosting and related website services: Wix

• Domain and email-related services: HostGator

• Order processing and shipping: our dropshipping suppliers, where applicable, who will receive the information necessary to prepare and ship your order (name, address, and order details)

Each of these providers is contractually required to protect your data and use it only for the services they provide to us.

6. International Data Transfers

As we use service providers, including Wix and Stripe, that may process data internationally, your data may be transferred to and processed in countries outside the United Kingdom.

Where this occurs, we will take reasonable steps to ensure that your data remains protected to a standard compatible with the UK GDPR, including using appropriate safeguards and recognised data transfer mechanisms where required.

Stripe states that it uses mechanisms including Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, where applicable.

Wix may also process personal data through entities and service providers located in different countries as part of its global infrastructure.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including any legal, accounting, or reporting requirements.

8. Your Rights

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you

• Correct inaccurate or incomplete data

• Request deletion of your data ("right to erasure"), where applicable

• Restrict or object to certain types of processing

• Data portability — receive your data in a portable format

• Withdraw your consent at any time where processing is based on consent

To exercise any of these rights, please contact us at support@norvak.online. We will respond within one month, as required by law.

You also have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO), if you believe your data has been handled improperly.

9. Data Security

We use industry-standard security measures — including encryption and secure payment gateways — to protect your personal information from unauthorised access, loss, or misuse.

10. Changes to This Policy

We may update this policy from time to time. Any changes will be published on this page together with a new "Last updated" date.

If you have any questions about this Privacy Policy, please contact us at support@norvak.online.