Legal

Privacy Policy

Last updated 7 October 2026

This policy explains what personal data we collect when you contact us or order from us, why we hold it, and what rights you have over it. We have written it in plain language rather than legal shorthand.

1. Who is responsible for your data

The data controller is:

Company: SIA "Black line", trading as White Nordic
Registration No.: 44103147647
VAT No.: LV44103147647
Address: Klijānu iela 14, Riga, LV-1013, Latvia
Contact: hello@whitenordic.com

For any question about your data, or to exercise the rights in section 6, write to hello@whitenordic.com.

2. What we collect and why

Data	Where from	Why we hold it	Legal basis
Name, email address, telephone number (if you give it)	The enquiry and order forms on this site, or your email to us	To answer your enquiry, quote for your order, and keep in touch about it	Steps before a contract, and our legitimate interest in replying to you
Your message, and any drawings, photographs, dimensions or design details you send	You	To understand, quote for and manufacture what you want	Steps before a contract; performance of the contract
Order details and correspondence history	Generated as we work with you	To deliver the order and keep a record of what was agreed	Performance of the contract
Design files we prepare for you (3D models, drawings, images) shown on your private review page	Generated by us for your project	So you can review each design version and tell us what to change	Steps before a contract; performance of the contract
The name you type and the comments you leave on your private review page, with the date and the design version they refer to	You, on the review page	To understand the changes you want and keep a record of what was agreed	Steps before a contract; performance of the contract
Invoicing and accounting records	Generated when we invoice you	Because Latvian tax and accounting law requires it	Legal obligation
IP address of the device used to submit a form	Automatically, at the moment of submission	To detect and block automated spam submissions	Our legitimate interest in protecting the site
Standard server log data (request, time, browser type)	Automatically, by our web server	Security, troubleshooting and keeping the site running	Our legitimate interest in operating a secure service
Which link in one of our emails you opened, and when, with the browser type, country and a shortened IP address	Automatically, when you open a link in an email from us: our email links pass through link.whitenordic.com, which notes the click and takes you straight to the page	To see which of our emails were useful, so we can follow up on them	Our legitimate interest in following up our own business emails

We do not ask for, and do not want, special category data (such as health or political views), and we do not collect payment card details through this website — invoices are settled by bank transfer.

3. What we do not do

We do not sell, rent or trade your personal data. Ever.
We do not send marketing emails to people who have simply made an enquiry.
We do not build advertising profiles about you.
We do not use your design work for anything other than your order, as set out in our Terms & Conditions.

4. Cookies and analytics

This website does not set advertising or tracking cookies, and does not currently run analytics or third-party tracking scripts.

If you have a private design review page, signing in sets one cookie:

__Host-wnportal — keeps you signed in on your review page. Strictly necessary (the page cannot work without it), so no consent banner is required; valid for 30 days, and removed as soon as you sign out.

The review page also remembers the name you type before leaving a comment, using your browser's local storage under the key wn_name (this is not a cookie), so you don't have to retype it next time. That name stays on your device and is only sent to us when you submit a comment.

Our emails contain no tracking pixels, so we cannot see whether you have opened one. Links in them pass through link.whitenordic.com, so we can see which link was opened (see section 2).

If we introduce analytics in future we will update this page first and ask for your consent where the law requires it.

5. Who else sees your data

Your data stays with us, except where a service provider is needed to run the business. These act on our instructions and are bound to protect it:

Hosting — our website and order records run on a dedicated server we control, hosted by OVH in the European Union.
Email and website delivery — Cloudflare, Inc. handles our email sending and receiving and sits in front of our website. Cloudflare may process data outside the EU under the European Commission's standard contractual clauses.
Project management — if your private review page is linked to an order, the name you type and any comment you leave on that page are copied into ClickUp, our project-management tool, against your order, so our team can see and act on them.
Team notifications — the same name and comment are also sent as a Telegram message to White Nordic's owner, so a new comment is noticed quickly.
AI language tools — if a staff member asks our AI assistant to translate or summarise a comment, the comment text is sent to an external AI language-model provider — currently Zhipu AI (GLM models), with DeepSeek as a fallback. These providers may process the text outside the European Union.
Subcontractors — occasionally a specialist workshop assists with part of an order, and receives only what is needed to do that work.
Accountants and authorities — where we are legally required to share records.

6. Your rights

Under the GDPR you may ask us to:

tell you what data we hold about you, and give you a copy;
correct anything that is wrong or incomplete;
delete your data, where we have no legal reason to keep it;
restrict or object to how we use it, including anything based on our legitimate interests;
receive your data in a portable, machine-readable form.

Write to hello@whitenordic.com and we will respond within one month. There is no charge.

Note that we must keep invoices and accounting records for the period Latvian law requires, even if you ask for deletion. We will delete everything not covered by that obligation.

7. How long we keep it

Enquiries that do not become orders — up to 2 years, then deleted.
Order records and correspondence — for the duration of the contract and the statutory guarantee period that follows.
Private review pages (designs, versions and your comments) — for the duration of the project and the statutory guarantee period, or until you ask us to remove them; access is by a password we send only to you. Our nightly database backups are kept for 14 days; backup copies of your design files are deleted together with your data when you ask us to remove it.
Invoices and accounting records — as required by Latvian accounting law (currently 5 years).
Email link clicks — 90 days, then deleted automatically.
Server logs — a short rolling period for security purposes.

8. How we protect it

Order records are stored on a server we control, protected by a firewall, key-only administrative access and automatic security updates. The site is served over encrypted HTTPS, and email is protected by SPF, DKIM and DMARC authentication. Access to customer data is limited to the people who need it to do the work.

9. Complaints

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), or to the authority in your own EU country.

10. Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. Significant changes will be highlighted here.

11. Contact

SIA "Black line" (trading as White Nordic)
Klijānu iela 14, Riga, LV-1013, Latvia
Reg. No. 44103147647 · VAT No. LV44103147647
hello@whitenordic.com