Privacy policy

1. Controller

The controller for data processing on this website under the General Data Protection Regulation (GDPR) is:

Nord Solis OÜ, Rakvere tn 20-7, 20306 Narva linn, Estonia

Represented by Daniels Kursietis, Member of the Management Board

Email: info@nordsolis.com, phone: +371 27190888

We have not appointed a data protection officer, as this is not required for us under Art. 37 GDPR. For any privacy question, use the contact details above.

2. Overview: what we process and whom it concerns

This policy concerns visitors of this website and everyone who contacts us via the website, email or phone. We keep processing deliberately small:

• When you merely visit: technical connection data in server log files (section 4).
• When you send a request: what you enter in the form or write in your email (sections 5 and 6).
• In your browser: one cookie for the language choice and one local-storage entry for the industry choice (section 7).
• Not used: analytics and tracking services, advertising cookies, social media plugins, third-party embedded videos or maps, newsletters.
• This website has no user accounts, no online payments and no comment function.

3. Legal bases

We process personal data only where a legal basis exists:

• Art. 6(1)(a) GDPR – consent, where we explicitly ask for it. You may withdraw it at any time with effect for the future (section 12).
• Art. 6(1)(b) GDPR – pre-contractual measures at your request and performance of a contract with you.
• Art. 6(1)(c) GDPR – compliance with legal obligations, e.g. commercial and tax retention duties.
• Art. 6(1)(f) GDPR – legitimate interests, here the secure and stable operation of the website and answering general enquiries.
• For storing or reading information on your device, § 25 TDDDG (German law) additionally applies (see section 7).

4. Hosting and server log files

This website runs on our own server, rented from netcup GmbH (Germany). The server is located in a data centre in Nuremberg, Germany. netcup provides the server infrastructure and processes technical data arising on access on our behalf, on the basis of a data processing agreement under Art. 28 GDPR.

Our web server is set up so that it does not keep a separate access log of page requests. As with every connection to a server, your IP address is technically processed during the connection itself and may appear in the server’s technical operating and error messages. Such messages can contain:

• the IP address of the requesting device
• date and time
• the requested address (page or file)
• a description of the technical error

4a. Purpose and duration of the logs

The purpose is to deliver the website, ensure stability and security, and to detect and investigate faults and attacks. The legal basis is our legitimate interest in this (Art. 6(1)(f) GDPR).

Technical messages are stored only briefly in a size-limited system log: when the limit is reached, the oldest entries are overwritten automatically. They are not merged with other data.

5. Contact by form, email or phone

This website has enquiry forms. You can also reach us by email or phone. We then process the data you give us:

• email address (required in the form)
• your website address, if given
• name and message, if given
• website language and subject of the enquiry (sent automatically)
• for email or phone: your contact details and the content of the communication

5a. Purpose, legal basis, retention

The purpose is to answer your enquiry, prepare a quote and communicate with you. The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract, otherwise our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). Where we ask for consent, Art. 6(1)(a) GDPR applies.

Providing the data is voluntary; without an email address, however, we cannot reply. Your enquiry arrives at hello@nordsolis.com.

We keep your data until your enquiry is finally dealt with and then delete it, at the latest 12 months after the last contact. If a contract is concluded, we keep the data until statutory retention periods have expired (under Estonian law usually 7 years for accounting records, Art. 6(1)(c) GDPR).

6. How the form is transmitted

Our enquiry forms work without an external form service. When you submit a form, your email program opens with a prefilled message that you send yourself. The message is then transmitted by your email provider (subject to its privacy terms) and arrives at hello@nordsolis.com. Until you send that message, nothing is transmitted to us.

The forms contain a field that is invisible to humans as spam protection (honeypot). It collects no personal data, and no third-party CAPTCHA services are used.

Our mailboxes (hello@ and info@nordsolis.com) are operated with Google Workspace; Google acts as our processor. Where Google processes data in the USA, the safeguards described in section 10a apply.

7. Cookies and local storage

This website uses only storage that is technically necessary or expressly requested by you. No analytics, marketing or tracking cookies are set:

• Cookie “lang”: stores the language you chose (de, en, lv) for one year. It is only set when you actively switch the language.
• Local storage “ns-niche”: remembers your industry choice on the home page so that examples and calculators are preset accordingly. The entry stays in your browser until you delete it and is not transmitted to us.

7a. Legal basis and consent banner

Both are needed to provide the function you explicitly requested (language, industry choice). They are therefore permitted without consent under § 25(2) no. 2 TDDDG; any personal data involved is processed under Art. 6(1)(f) GDPR. A cookie consent banner is therefore not required.

You can delete or block cookies and local storage in your browser settings at any time. The website remains usable; your choice is simply not remembered.

8. Fonts and external resources

The fonts used (including Inter, Unbounded, Fraunces, Playfair Display, Caveat) are downloaded when the website is built and delivered from our own server. No connection to Google or other font providers is made when you open a page, and your IP address is not sent to them.

Images, scripts, animations and 3D views are also loaded from our own domain. No content is loaded from content delivery networks or other third-party servers. The load figures shown on the page are calculated by your browser; no data is sent to us for this.

If we link to external sites, the privacy terms of the respective operator apply there; by clicking you leave our website.

9. Sample websites and no tracking

The concept websites shown here are fictional examples. Your interactions in them (e.g. calculators, sliders, before/after views) run entirely in your browser; nothing you enter is sent to us or third parties or stored.

We do not build usage profiles, do not measure visitor behaviour, and use no retargeting, fingerprinting or advertising-network pixels.

10. Recipients and third-country transfers

Your data only reaches parties that need it for the purposes above:

• hosting provider netcup GmbH (section 4) and email provider Google Workspace (section 6) as processors,
• tax advisers, accounting and authorities where legally required,
• if you hire us: payment and domain providers as far as needed to perform the contract.

10a. Third countries

We transfer personal data only within the EU/EEA as a rule. If a provider we use processes data in a third country (e.g. the USA), we ensure an adequate level of protection, in particular through an EU Commission adequacy decision (Art. 45 GDPR), e.g. the EU-US Data Privacy Framework, or through standard contractual clauses (Art. 46 GDPR). You can obtain a copy of the safeguards on request. We do not pass your data on for advertising.

11. Storage periods

We keep personal data only as long as needed for the respective purpose:

• Server log (technical messages): short-term, size-limited with automatic overwriting (section 4a).
• Enquiries without a contract: until dealt with, at most 12 months after the last contact.
• Contract and accounting records: until statutory retention periods expire (in Estonia usually 7 years).
• Cookie “lang”: up to 1 year; local storage: until you delete it.

12. Your rights

Under the GDPR you have the following rights:

• access (Art. 15) to the data we hold about you,
• rectification (Art. 16) of inaccurate data,
• erasure (Art. 17) where no retention reason applies,
• restriction of processing (Art. 18),
• data portability (Art. 20) in a common, machine-readable format,
• objection (Art. 21) to processing based on legitimate interests, on grounds relating to your particular situation; to direct marketing at any time,
• withdrawal of consent (Art. 7(3)) at any time with effect for the future; the lawfulness of earlier processing is unaffected.

13. Exercising your rights and complaints

To exercise your rights, an informal message to info@nordsolis.com is enough. We usually reply within one month. We may ask questions to verify your identity.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Estonian Data Protection Inspectorate: Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee.

You may also contact the authority of your habitual residence, place of work or the place of the alleged infringement, e.g. in Germany the data protection authority of your federal state, or in Latvia the Datu valsts inspekcija (www.dvi.gov.lv).

14. Security

This website is delivered exclusively encrypted via HTTPS (TLS), so what you enter is protected from being read by third parties in transit. We also take appropriate technical and organisational measures (Art. 32 GDPR), such as access restrictions, up-to-date software and data minimisation.

Please note that ordinary email is not always end-to-end encrypted in transit. Do not send us particularly sensitive data by email.

15. No automated decisions, no profiling

No decision based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Changes to this policy

We update this privacy policy when the website, our providers or the law change. The version published here applies. The German version is authoritative; the English and Latvian versions are provided for convenience.