Privacy policy.

Last updated: 1 May 2026

1. Who we are

NordicDigital Ltd (trading as "NordicDigital") is a performance marketing agency registered in England and Wales, operating from London, United Kingdom. For the purposes of this policy, we are the data controller for personal data collected through this website and through our services.

You can contact our privacy team at privacy@nordicdigital.com.

Companies House number: [YOUR UK COMPANIES HOUSE NUMBER]
Operating address: Suite 3, 86-90 Paul Street, London, EC2A 4NE, United Kingdom

2. What data we collect

Information you provide directly

• Your name and email address
• Company name and website URL
• Phone number (if provided)
• Payment and billing information — processed securely through Stripe. We do not store full card details.
• Any content you send us in messages, emails, or briefs

Information collected automatically

• IP address (anonymised), browser type, device type, operating system
• Pages visited, time on page, referring URL
• Cookies and similar technologies (see our cookie policy)

3. How we use your data

Purpose	Legal basis (UK GDPR Art. 6)
Respond to enquiries and provide requested services	Performance of a contract
Deliver contracted marketing services and reports	Performance of a contract
Send marketing communications (only with consent)	Consent (Art. 6(1)(a))
Improve our website and service offerings	Legitimate interests
Comply with legal and tax obligations	Legal obligation
Detect, prevent, and address fraud or abuse	Legitimate interests

4. How long we keep your data

• Contact form submissions: 24 months from last contact, then deleted
• Client records: 7 years after end of engagement (HMRC requirement)
• Marketing list: Until you unsubscribe
• Website analytics: 14 months (GA4 default)

5. Who we share your data with

We never sell your data. We share it only with third-party service providers strictly necessary to operate our business:

• Google Analytics / Google Workspace — analytics and email infrastructure
• Stripe — payment processing
• Slack, Notion, Figma — project management and collaboration
• Looker Studio, GA4, Meta Business Suite, Google Ads, Klaviyo, Triple Whale — marketing analytics and reporting
• Email and CRM provider — client communication and account management

All third parties are bound by data-processing agreements compliant with UK GDPR Article 28.

6. International transfers

Some service providers are based outside the UK and EU/EEA (notably in the United States). When this happens, we rely on UK International Data Transfer Agreement or EU Standard Contractual Clauses with the UK Addendum, or other lawful transfer mechanisms, to ensure your data is protected.

7. Your rights under UK GDPR

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — limit how we use your data
• Portability — receive your data in a portable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, without affecting prior lawful processing

To exercise any of these rights, email privacy@nordicdigital.com. We will respond within 30 days.

8. Complaints

If you believe we have mishandled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) — ico.org.uk.

9. Data security

We use industry-standard security practices including TLS encryption in transit, encryption at rest for sensitive records, access controls, MFA on all internal accounts, and regular security reviews.

10. Children

Our services are not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change.

12. Contact

Privacy questions: privacy@nordicdigital.com
General enquiries: hello@nordicdigital.com
Postal: Suite 3, 86-90 Paul Street, London, EC2A 4NE, United Kingdom