Privacy Policy

Hjortborg Solutions ApS Vestergade 65D, 2. 4. 8000 Aarhus C, Denmark CVR 45227561 Email: info@nordicstealth.com Phone: +45 23 33 77 26

We are behind NordicStealth and are the data controller for the information you give us in the shop and on nordicstealth.com. If you have questions about this policy, or want to use your rights, write to info@nordicstealth.com.

Purchases are made in Shopify's checkout. We process the information needed to complete and deliver your order:

• Name and delivery address • Billing address, if it is different • Email address • Phone number, if you give it • What you bought and the price • The van you choose in the order form, so we send the right adapters • Order number, order status and what we write to each other about the order • Your bank account details, if we refund you by bank transfer

We do not see your full card number. The payment is processed by Shopify Payments or by the provider of the payment method you choose at checkout. We are told how you paid and whether the payment went through. For card payments we also see the card type, the last four digits, the expiry date and the result of Shopify's fraud check.

We use the information to complete the purchase, deliver the goods, send the order confirmation and delivery updates, and to handle cancellations, refunds, claims for defects and withdrawals. Legal basis: the contract with you, Article 6(1)(b) of the General Data Protection Regulation (GDPR). Without your name, address and email we cannot deliver. We keep invoices and accounting records because the Danish Bookkeeping Act requires it, Article 6(1)(c) GDPR.

When you buy, technical information such as your IP address, approximate location and browser is also recorded. It is used to secure the payment and prevent fraud. Legal basis: our legitimate interest in protecting you and us against misuse, Article 6(1)(f) GDPR. Shopify automatically assesses the risk of fraud for every purchase. We do not cancel an order on the basis of that assessment alone; we look at the order ourselves first.

You can sign up in the box that pops up in the shop, or on the "Sign up" page. We process:

• Your email address • The van you enter on the "Sign up" page, if you fill in the field. If you come from the fit checker, the van is already filled in • Where and when you signed up

Your sign-up is stored as a customer in Shopify and on our list in Notion, and the emails are sent through Resend. We use it to write to you about NordicStealth: when there is news about the first series and when the system ships. Legal basis: your consent, Article 6(1)(a) GDPR, and section 10 of the Danish Marketing Practices Act. If you answer the two questions about the product right after signing up, we store your answers together with your email in Notion, based on our legitimate interest in understanding demand, Article 6(1)(f) GDPR.

You can always unsubscribe. Every email tells you how, and you can also write to info@nordicstealth.com. Unsubscribing does not affect the emails we sent before you unsubscribed.

If you reserved a spot or signed up on nordicstealth.com, we keep what you gave us there: name, email and, where given, phone number, country and Instagram handle. If you answered the two questions about the product right after reserving, we keep your answers together with your email. The information is stored in Notion, and the emails are sent through Resend. We use it to give you the founder price and to write to you about the launch, which you agreed to.

The legal basis for the reservation and the founder price is the reservation terms, Article 6(1)(b) GDPR. We send the emails about the launch with your consent, Article 6(1)(a) GDPR, and section 10 of the Danish Marketing Practices Act. We keep the answers to the questions on the basis of our legitimate interest in understanding demand, Article 6(1)(f) GDPR. You unsubscribe as described in the emails, or by writing to info@nordicstealth.com. We delete the information no later than 12 months after the launch, unless you buy.

If you entered the prize draw on nordicstealth.com, we use your name and email to hold the draw and contact the winner. Legal basis: the terms of entry, Article 6(1)(b) GDPR.

You can write to us on the contact page, ask a question in the fit checker if your van is not on the list, or send an email. We process:

• Contact page: name, email address, company (optional), what you are contacting us as, for example a dealer or a van owner, and your message • Fit checker: van model and year, length (optional), email address and your question (optional) • An email: your email address and what you write

The message is sent from Shopify to our inbox. We use the information to answer you and to find the right mounting for your van. Legal basis: our legitimate interest in answering enquiries, Article 6(1)(f) GDPR. If your enquiry is about a purchase you are considering or have made, the legal basis is Article 6(1)(b) GDPR.

If you ask in the fit checker, we only use your email address to answer the question.

If you use the "Withdraw from contract" function, we process:

• Your name and email address • Order number • The date you received the goods (optional) • Your reason (optional) • Your statement that you withdraw from the contract

We use the information to register your withdrawal, confirm it by email and refund you. Legal basis: section 20 a of the Danish Consumer Contracts Act, Article 6(1)(c) GDPR, and the contract with you, Article 6(1)(b) GDPR.

The "Your opinion" page asks two questions about the product. We do not ask for your name or email, and your answer is sent without your email address. We keep your answers and anything you write in the free text field in Notion. If you write something yourself that can identify you, we process it together with your answer. We use the answers to understand what people need. Legal basis: our legitimate interest in improving the product, Article 6(1)(f) GDPR.

Shopify sets the cookies needed for the cart, the language, the currency and the payment to work. They do not require consent, because the shop cannot work without them.

Shopify only uses cookies for analytics, marketing and preferences if you say yes to them in the cookie banner. If you say yes to analytics, Shopify measures, among other things, which pages are visited, where the visit came from and what is added to the cart. If you also say yes to marketing, Shopify may use information about your visit to show ads for Shopify and Shopify shops, including on other services. Without your consent, Shopify sets no analytics or marketing cookies and only uses the information about your visit that the shop needs to work and stay secure. Legal basis: your consent, Article 6(1)(a) GDPR.

If you say yes to marketing, we use Meta's pixel and Meta's Conversions API. We share which pages you have seen and whether you have signed up or bought, together with your email address and phone number in hashed form, your IP address and information about your browser. The purpose is to measure our ads and to show you ads again. The recipient is Meta Platforms Ireland Limited, with whom we are joint controllers for that measurement. Legal basis: your consent, Article 6(1)(a) GDPR. If you withdraw your consent, both the pixel and what we send from the server stop. We have no Google Analytics and no TikTok pixel in the shop.

We never sell your information. We only share it with those who need it for the task:

• Shopify International Limited, Ireland, runs the shop, checkout and the forms and stores orders and customers for us as a data processor • Payment providers: Shopify Payments processes card payments. If you choose another method at checkout, its provider receives the information needed for the payment • Our bank, when we refund you by bank transfer • The carrier receives your name, address and the contact details needed to deliver the parcel • hCaptcha (Intuition Machines, Inc., USA), which Shopify uses to protect the forms against spam. hCaptcha receives, among other things, your IP address and information about your browser • Our email services Google Workspace, ImprovMX and Resend, when we receive and send emails • Notion and Resend, for sign-ups, reservations and answers to the questions about the product

Shopify is itself a data controller when it uses information about your visit and your purchase for security and fraud prevention, to provide and develop its own services such as Shop and Shop Pay, and for marketing if you have said yes to it. This is set out in Shopify's Consumer Privacy Policy at shopify.com/legal/privacy/consumers. If you pay with a provider other than Shopify, that provider's own privacy policy also applies.

We may also be required to disclose information to public authorities, for example the Danish Tax Agency (Skattestyrelsen), if the law requires it.

Shopify receives your information in Ireland and passes it on to other Shopify companies and subcontractors, including in Canada and the USA.

Transfers between Shopify companies are made under Shopify's Binding Corporate Rules, which are approved under Article 47 GDPR. When Shopify sends information to its subcontractors, this is done on the basis of the European Commission's standard contractual clauses where relevant.

Notion, Resend, ImprovMX, Google and Intuition Machines (hCaptcha) are American or may send information to the USA. The transfer takes place under the EU-U.S. Data Privacy Framework where the company is certified under it, and otherwise on the basis of the European Commission's standard contractual clauses.

We do not keep information longer than we need it:

• Orders, invoices and refunds: 5 years from the end of the financial year the purchase belongs to. The Danish Bookkeeping Act requires this • Withdrawals: together with the order, so 5 years from the end of the financial year • Sign-ups: for as long as you are signed up. If you unsubscribe, we stop the emails as soon as the unsubscription is registered, and we only keep the record of your consent and your unsubscription for 2 years • Reservations, the prize draw and sign-ups from nordicstealth.com: no later than 12 months after the launch, unless you become a customer • Enquiries from the contact page, the fit checker and by email: 2 years after our last correspondence • Answers to the questions about the product, on the "Your opinion" page and after signing up: 2 years • Cookies and local storage: see the lifetime of each one in the cookie policy

You have the following rights:

• Access: to find out what information we hold about you and get a copy • Rectification: to have incorrect information corrected • Erasure: to have your information deleted when we no longer have to keep it • Restriction: to have us only store your information, and not use it, for a period • Data portability: to receive the information you have given us in a commonly used, machine-readable format, when the processing is based on consent or a contract • Objection: to object to processing based on our legitimate interest. You can always object to direct marketing • Withdrawing consent: you can withdraw your consent at any time. This does not affect processing that took place before you withdrew it

Write to info@nordicstealth.com if you want to use your rights. We will reply no later than one month after we have received your request. We may ask you to confirm who you are before we disclose or delete anything.

You change your consent to cookies with the button on the cookie policy page or with Cookie settings at the bottom of the page. You withdraw your sign-up as described in our emails, or by writing to us.

If you are unhappy with the way we process your information, you can complain to the Danish Data Protection Agency (Datatilsynet). If you live in another EU country, you can also complain to the data protection authority in your own country. You are welcome to write to us first, but you do not have to.

Danish Data Protection Agency (Datatilsynet) Carl Jacobsens Vej 35 2500 Valby, Denmark dt@datatilsynet.dk www.datatilsynet.dk/english

We update this policy when we change how we process information, for example if we start using a new tool. The date at the top shows when it was last changed.

If a change is significant, we will make this clear in the shop before it takes effect. If a change requires your consent, we will ask for it first.