Privacy Policy

1. Controller

The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is: nora-designs — Inh. Nora Behrens, Simrockstraße 25, 30171 Hannover, Germany. Email: support@nora-designs.com · Phone: +49 173 923 6784.

2. Overview of processing

We process personal data only where this website's technical operation requires it, where you have given consent, or where we need it to prepare or perform a contract with you (for example, an order or a project enquiry). We do not sell personal data, and we do not share it with third parties beyond the service providers named below.

3. Hosting and server log data

This website is served as static files from web hosting infrastructure located within the European Union. Each time the site is accessed, the hosting infrastructure automatically records standard server log data (IP address, date and time of access, browser type and version, operating system, the page requested, and the referring page). This data is technically necessary to deliver the website and to protect it against misuse, and is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in the secure and functional operation of the site. It is not merged with other data sources and is deleted automatically after a short retention period.

4. Contact form and project enquiries

When you submit the enquiry form, we process the data you enter — name, email, optionally phone and company, your message, and (for new-project enquiries) the service you selected — solely to respond to your enquiry and, where relevant, to prepare a contract (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR where no contract yet exists). This site has no backend server: your enquiry is prepared for sending via your own email application (a "mailto" link) and, as a fallback, is stored temporarily in your browser's local storage so it is not lost if your email application does not open correctly. It is not transmitted to any third-party service. Submitting the form requires your explicit consent via the checkbox provided.

5. Orders and checkout

If you place an order, we process the billing and contact details you provide (name, company, VAT ID if given, address, email, phone) to prepare and fulfil the order and to meet our statutory record-keeping obligations (Art. 6(1)(b) and Art. 6(1)(c) GDPR). Card details entered at checkout are not transmitted to us or stored anywhere — the current checkout is a demonstration flow, clearly marked as such, and does not process real payments. Order data is stored in your browser's local storage so your order confirmation remains available after a page reload; it is not sent to any third-party payment processor at this time.

6. Analytics (Google Analytics 4) — only with your consent

We use Google Analytics 4, provided by Google Ireland Limited, to understand which pages are useful, but only after you actively opt in via the cookie consent banner (Art. 6(1)(a) GDPR). If you do not consent, Google Analytics does not load and no analytics cookies are set. If you consent, Google Analytics may set cookies that persist for up to 26 months to recognise repeat visits; you can withdraw consent at any time via "Cookie preferences" in the footer, with effect for the future. See our Cookie Policy for the full list of cookies.

7. Your rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have it deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing before the withdrawal. To exercise any of these rights, write to support@nora-designs.com. You also have the right to lodge a complaint with a data protection supervisory authority — the competent authority for this business is the Landesbeauftragte für den Datenschutz Niedersachsen.

8. Retention

We retain enquiry and order data only for as long as necessary for the purpose it was collected for, or as required by statutory retention obligations (commercial and tax records are generally retained for six to ten years under German law).

9. No automated decision-making

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

10. Changes to this policy

We may update this policy if our processing activities change. The version published on this page is always the current one.