Privacy Policy

We are The Nordic Altar, an independent UK skincare maker selling under the Aurora and Woad lines at thenordicaltar.co.uk. We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise your rights, contact us at [email protected].

Depending on how you use the site, we may collect:

• Order & delivery details — your name, email address, delivery address, phone number, and the items you order. Card details are entered directly with our payment provider and are never seen or stored by us.
• Enquiries & feedback — anything you send through our contact, feedback or wholesale forms (your name, email and message), which we store in our database.
• Waitlist & newsletter — your email address if you join a product waitlist or subscribe to updates.
• Abandoned baskets — if you enter your email at checkout but don't complete, we keep your email and basket to send one reminder.
• Reviews — any review or field report you choose to submit.
• Usage & device data — if you consent to analytics/advertising cookies, information about how you use the site (pages viewed, device, approximate location). See “Cookies & tracking” below.
• Security logs — limited technical data such as your IP address, the page requested and the time, used to protect the site against abuse and fraud.

• To take and fulfil your order, deliver it and send order-related emails (dispatch, delivery) — performance of our contract with you.
• To keep transaction records for tax and accounting — legal obligation.
• To secure the site, prevent fraud and abuse, respond to your enquiries, and receive our own order alerts — our legitimate interests in running the shop safely.
• To send marketing emails and to set analytics/advertising cookies — your consent, which you can withdraw at any time.
• To send an abandoned-basket reminder — our legitimate interests; you can opt out.

Online card payments are processed by Stripe. We never store or see your full card details — they go directly to Stripe.

For trade/wholesale orders we may take payment by bank transfer (Monzo) or PayPal; in those cases your name and the payment reference are shared with that provider.

We do not sell your data. We share it only with the service providers that help us run the shop, and only as needed:

• Cloudflare — website hosting, our database, and inbound email routing.
• Stripe — payment processing.
• Resend — sending our order and marketing emails (receives your email and name, and in order emails your address).
• Sendcloud — creating shipping labels (receives your name, address and phone).
• 17track — parcel tracking (receives your tracking number).
• Telegram — we receive an internal order alert that includes your order details.
• Google Analytics — website analytics (only if you consent).
• Meta Pixel and TikTok Pixel — advertising measurement and targeting (only if you consent).
• PayPal / Monzo — trade payment processing where used.

We may also disclose data where the law requires it.

Essential cookies and storage make the site work (your basket, your cookie choice, security) and don't require consent.

Analytics cookies (Google Analytics) help us understand how the site is used. Advertising cookies (Meta Pixel, TikTok Pixel) measure and target our ads.

Analytics and advertising only load if you accept them in our cookie banner — we use Google Consent Mode, so nothing non-essential runs until you agree. You can change or withdraw your choice at any time by updating your cookie settings (clear the site's stored data) or by contacting us.

Some of our providers (for example Stripe, Google, Meta, TikTok, Telegram and Cloudflare) process data outside the UK, including in the United States. Where your data leaves the UK, it is protected by appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses.

• Order & transaction records — for as long as needed to fulfil your order and to meet our legal and accounting obligations (generally up to 6 years).
• Marketing contacts — until you unsubscribe or ask us to stop.
• Enquiries, feedback & waitlist entries — while they're relevant; we'll delete them on request.
• Security logs — for a short period, for security and abuse-prevention only.

We only send marketing emails to people who have opted in (for example by subscribing or asking to be kept updated).

Every marketing email has an unsubscribe link, and you can opt out at any time — one click, no login needed. Order-related emails (dispatch and delivery) are not marketing and are sent as part of fulfilling your order.

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it;
• receive your data in a portable format; and
• withdraw consent at any time (for marketing or cookies).

To exercise any of these, email [email protected] and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Card payments are handled entirely by Stripe — we never hold your card details. The site is served over encrypted (HTTPS) connections, and our admin systems are access-restricted.

Your orders, enquiries and feedback are held in our access-restricted database. No system is ever completely secure, but we take reasonable technical and organisational steps to protect your information.

We may update this policy from time to time; the “last updated” date at the top shows when it last changed.

Questions, requests or concerns: [email protected].