Privacy

Privacy Policy

Last updated: 8 October 2026

1. Who is responsible

NordPeps runs nordpeps.com and is the controller of the personal data described on this page (“NordPeps”, “we”, “us”). Contact us at support@nordpeps.com or through the contact page.

2. What this policy covers

This policy covers the site, the basket, the emails we send, the Ada assistant, the partner program and our Telegram support chat. It applies to everyone who uses them. Because we deliver within the European Union, it is written around the GDPR. It also covers visitors from the UK.

3. Data we collect

We collect only what we need to answer you and to deliver what you order.

Orders. Your email address, phone number, the products and quantities, any discount code, and the order total. For parcel-locker delivery, your postcode and city, or the locker you name. For delivery to an address, the recipient's name, street, postcode, city and country.
Payment. Card payment happens on Stripe's payment page. We never receive your card number. Stripe tells us whether a payment succeeded and gives us a reference that matches it to your order.
Messages. When you use the contact form, email us or write on Telegram: your email address or Telegram account, any name you give, and what you write.
Ada. The questions you type into the Ada assistant, and the recent messages of that chat, so it can answer. We do not save these conversations on our servers. Your IP address is used briefly to limit how many questions can be sent per minute.
Partner program. If you apply: your name, email, where you plan to share your code and the code you choose. Later, the orders placed with your code and the payout details you give (a PayPal email or a wallet address).
Email sign-up. If you sign up for the WELCOME10 code, your email address.
Technical data. Our host records basic request data, such as IP address, browser type and the pages requested, to keep the site secure and running. We also use the host's cookie-free page statistics.
Stored in your browser. Your basket, your 21+ and research-use confirmation, and a partner code that arrived through a share link are kept in your own browser's storage. They reach us only when you request an order.

We use no advertising cookies and no cross-site tracking, and we build no advertising profiles.

4. Why we use it

to review, deliver and support your order, including the payment link, the order confirmation, a reminder if a payment link is still open, and the tracking code;
to answer your questions, by email, on Telegram or through Ada;
to run the partner program: matching orders to partner codes, working out commission and making payouts;
to send the welcome code and occasional offers, only if you signed up, with an unsubscribe link in every email;
to prevent fraud and misuse and to keep the site secure;
to keep the records that accounting and tax rules require.

We never sell personal data.

5. Legal bases (GDPR)

Contract: handling and delivering your order, and running the partner program for approved partners.
Legitimate interests: answering messages, keeping the site secure, preventing fraud, and reminding you about an unpaid payment link.
Consent: offer emails after you sign up. You can withdraw it at any time with the unsubscribe link.
Legal obligation: accounting and tax records.

We share data only with the providers that help us run the shop, and each one gets only what it needs:

Stripe takes card payments. It receives an order reference and the amount, plus what you enter on its payment page.
Resend sends our emails, such as payment links, confirmations, tracking codes and partner messages.
Upstash is the database that stores orders, partner records and email sign-ups.
Vercel hosts the site and its server functions, and provides the page statistics.
Telegram carries our support chat. New orders and contact-form messages are also posted to a private Telegram chat so that we can review them.
xAI provides the AI model behind Ada, when Ada is switched on. It receives the questions you type.
Delivery companies receive the details needed to deliver your parcel: your phone number and locker, or the name and address you entered.

Most of these providers process data on our behalf. Stripe and the delivery companies also act as independent controllers under their own privacy policies. We disclose data to authorities only where the law requires it.

7. Transfers outside the EEA

Some of these providers are based in, or use servers in, countries outside the EEA, such as the United States. Where data leaves the EEA or the UK, the transfer relies on safeguards recognised under the GDPR, for example standard contractual clauses.

8. How long we keep data

Order records are kept for as long as accounting and tax rules require. Messages and partner records are kept while they are needed, and are then deleted or anonymised. Email sign-ups stay until you unsubscribe. What is stored in your browser stays there until you clear it.

9. Your rights

You can ask for a copy of your data. You can ask us to correct it, delete it, restrict its use or send it to you in a portable format. You can object to uses based on legitimate interests, and withdraw consent at any time. Write to support@nordpeps.com and we will reply within one month. You can also complain to the data protection authority in the country where you live.

10. Security

All connections to the site are encrypted (TLS). Card details are typed only into Stripe's payment page, never into ours. The payment record at Stripe shows an order reference and an amount, not the products. No system is perfectly secure, so we cannot promise absolute security.

11. Under-21s

The shop is for adults aged 21 and over. We do not knowingly collect data from anyone younger. If you think we have, tell us and we will delete it.

12. Changes to this policy

When we change this policy, we update it on this page and change the date at the top.

13. Contact

Privacy questions and requests: support@nordpeps.com or the contact page. Controller: NordPeps.