Privacy policy

Privacy policy (GDPR) – S Invest B.V. (Nordal)

Last updated: 06-12-2025

S Invest B.V. (trading as Nordal) (“we” or “us”) processes personal data via www.nordal-care.com. In this privacy policy we explain which data we process, why we do so and what rights you have.

Key principle: we use personal data solely to process orders and manage customer relationships in our CRM system, plus what is required by law (such as bookkeeping).

1. Who is responsible?

S Invest B.V. (Nordal)
Address: Dorpsstraat 102, 6097 AR Heel, The Netherlands
KVK (Dutch Chamber of Commerce): 87903032
Website: www.nordal-care.com
Email: info@nordal-care.com

2. What personal data do we process?

Depending on your order or contact with us, we may process the following data:

  • Identification and contact details: name, (company) name, email address, phone number

  • Address details: delivery address and/or billing address

  • Order details: products/services, quantities, order history, delivery status, returns

  • Communication: messages you send us (email/form), customer notes in the CRM

  • Payment & invoicing: invoice details, payment status, payment references (we generally do not process full card details ourselves; this is handled by the payment provider where applicable)

We do not process special categories of personal data (such as medical data), unless you actively provide them to us yourself. If that happens, we ask you to limit that information to what is necessary.

3. What do we use your data for?

We process personal data for:

  1. Processing and delivering orders

  2. Customer contact and service (questions, complaints, warranty, returns)

  3. CRM/relationship management (e.g. order history and points of contact)

  4. Administration and legal obligations (invoicing/bookkeeping)

We do not sell your data and do not use it for unwanted profiling.

4. On what legal bases (GDPR)?

We only process personal data when this is permitted on the basis of:

  • Performance of the contract (your order and delivery)

  • Legal obligation (e.g. statutory tax retention requirements)

  • Legitimate interest (normal business customer management and service, provided your privacy interests do not outweigh it)

5. Do we share data with third parties?

We only share personal data with parties that are necessary for our services, such as:

  • CRM provider (for customer management)

  • Hosting/IT service providers (for running and securing the website)

  • Payment provider(s) (where applicable)

  • Delivery/logistics partner(s) (where applicable)

  • Accounting/bookkeeping software or accountant (where applicable)

Where required, we enter into a data processing agreement with processors.

6. Transfers outside the EEA

If a supplier (e.g. CRM or email/hosting) processes data outside the European Economic Area, we ensure appropriate safeguards, such as Standard Contractual Clauses (SCC’s) and any additional measures.

7. Retention periods (legal standards)

We do not keep personal data for longer than necessary and apply statutory periods where they apply:

  • Invoices and financial records: 7 years (statutory tax retention requirement)

  • Order and customer data in the CRM: as long as necessary for performance of the contract and customer service, and where applicable as long as necessary in connection with legal obligations or (potential) disputes

  • Correspondence about orders/customer service: as long as necessary for handling and thereafter as long as reasonable/necessary in connection with possible claims/disputes (in line with relevant limitation periods)

8. Security

We take appropriate measures to secure personal data, such as:

  • TLS/SSL (https)

  • Restricting access to personal data to authorised persons

  • Updates, monitoring and back-ups where appropriate

9. Your rights

You have the right to:

  • Access to your personal data

  • Rectification (correction)

  • Erasure (unless a statutory retention obligation applies)

  • Restriction of processing

  • Objection (in particular to processing based on legitimate interest)

  • Data portability (where applicable)

To exercise these rights, contact us at info@nordal-care.com. We will respond within 1 month at the latest.