1. Introduction
Nordopoly ("we," "our," "us") is a service operated by Corti Studios AB. We help producers of wine, beer, and spirits sell into the Nordic alcohol monopolies in Sweden, Norway, and Finland.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what your rights are. We process personal data in compliance with the EU General Data Protection Regulation (GDPR).
2. Data we collect
When you sign up and use our service, we may collect:
- Account information: name, company name, country, email address, password.
- Billing information: payment details, handled by our payment provider. We do not store full card numbers.
- Producer information: your product catalogue, product details, certifications, and any documents you send us so we can apply for tenders on your behalf.
- Communications: messages, emails, and support requests between you and us.
- Usage data: IP address, browser type, language, and how you interact with our website.
We do not collect sensitive personal data unless it is strictly required, and only with your consent.
3. How we use your data
We use your data to:
- Deliver the service you signed up for (monitoring tenders and notifying you of matches).
- Prepare and submit tender applications on your behalf.
- Coordinate with importer partners after a successful tender.
- Process payments and commissions.
- Communicate with you about your account, tenders, or support.
- Improve the service.
- Comply with legal, tax, and accounting obligations.
We do not sell or rent your personal data.
4. Legal basis for processing
We process your data under the following GDPR legal bases:
- Contractual necessity (Art. 6(1)(b)) — to deliver the service.
- Legal obligations (Art. 6(1)(c)) — to comply with tax, accounting, and regulatory requirements.
- Legitimate interests (Art. 6(1)(f)) — to improve our service and prevent fraud.
- Consent (Art. 6(1)(a)) — for optional uses such as newsletters or marketing.
5. Sharing your data
We may share your data with:
- Licensed importer partners in Sweden, Norway, and Finland, when needed to submit a tender on your behalf or import your product after a successful tender.
- Service providers such as our hosting, authentication, email, and payment providers. These providers are bound by data protection agreements.
- Authorities or regulators when legally required.
We do not share your data outside these cases.
6. International transfers
Your data may be stored on servers outside your home country. If we transfer data outside the EU/EEA, we apply safeguards required by GDPR, including EU Standard Contractual Clauses.
7. Data retention
- Account and billing data: kept while you are a customer and up to 7 years after, to meet accounting and legal requirements.
- Producer information and tender records: kept for as long as required by regulators, importers, or contracts.
- Marketing data: kept until you opt out.
8. Your rights
Under GDPR, you have the right to:
- Access your personal data.
- Correct inaccurate or incomplete data.
- Request deletion of your data ("right to be forgotten"), subject to legal retention requirements.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent at any time for optional uses such as marketing.
To exercise your rights, write to info@nordopoly.com.
9. Security
We use technical and organisational measures to protect your data, including encryption, access controls, and secure hosting. No system is 100% secure, and we cannot guarantee absolute security.
10. Cookies
We use cookies to remember your preferences, support your login session, and analyse how the website is used. You can manage cookies in your browser settings.
11. Children
Our service is not intended for anyone under 18. We do not knowingly collect data from minors.
12. Changes
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email.
13. Contact
For privacy questions or requests:
info@nordopoly.com
Upplandsgatan 79, 11344 Stockholm, Sweden