Privacy Policy

Effective date: 23 June 2026

1. Who we are

The data controller for this storefront is Nordpoint Commerce, Inc., operating the customer-facing brand Skandique. For privacy requests, contact us at support@skandique.com.

Where we use processors (hosting, email delivery, analytics, payment services, customer support tools), they process personal data on our instructions and under appropriate agreements.

2. Scope

This policy describes how we process personal data when you visit our site, create an account, place an order, subscribe to updates, or contact support. It is intended to align with transparency expectations under the GDPR (EU/EEA and UK) and common expectations for consumers in the United States and Canada.

It does not apply to third-party websites, apps, or services that we link to; their privacy notices govern those services.

3. Data we collect

Depending on how you use our services, we may process:

• Identity and contact: name, email, phone, and similar identifiers you provide.
• Order and account: delivery and billing address; order history; cart contents; wishlist items (stored on your device until you sign in, when they may be saved to your account on our servers). If you create a store account, we store your email, name, phone, saved addresses, and account-linked order history on our servers. Sign-in uses a magic link (we do not store a password for storefront accounts in the default configuration). You can request account deletion from my-account, which anonymizes personal details while order records may remain for legal and tax obligations. We do not store your full payment card number.
• Payments: payment references and transaction status. Card data is collected and tokenized by our payment providers under their terms and PCI-DSS requirements. When you complete checkout, your payment provider may store your payment method so we can offer optional one-click add-ons (for example priority shipping) on the thank-you page.
• Device and usage: IP address, approximate location derived from IP, browser type, device identifiers where applicable, pages viewed, referring URL, and timestamps.
• Communications: messages you send to support and records needed to assist you.
• Marketing preferences: opt-in/out status, campaign interactions where tracked.

4. Cookies and similar technologies

We use cookies and similar technologies for essential site operation (e.g. session, security, load balancing), preferences (e.g. language), analytics (e.g. understanding traffic and errors), and, where you consent, marketing measurement. Checkout uses strictly necessary cookies and embedded frames from our payment providers (for example Stripe.js and Airwallex Drop-in) so you can pay securely; these do not require separate consent. When you use a store account or guest order lookup, we may set HttpOnly session cookies (for example to keep you signed in to my-account for a limited period, typically up to 30 days for store accounts). You can control non-essential cookies through our cookie banner or your browser settings; blocking essential cookies may affect functionality.

5. Purposes and legal bases (GDPR)

Where GDPR applies, we rely on appropriate legal bases such as:

• Contract: processing and delivering your orders, managing your account, and related customer service.
• Legitimate interests: fraud prevention, IT security, improving our store and content, limited analytics, and asserting or defending legal claims—balanced against your rights.
• Consent: where required (e.g. certain non-essential cookies or marketing emails).
• Legal obligation: tax, accounting, and regulatory requirements.

6. Marketing

We send promotional emails only where permitted (e.g. consent or soft opt-in where applicable). You can unsubscribe via the link in any marketing email or by contacting us. Transactional messages about your order may still be sent where necessary.

7. Automated decisions

We do not use fully automated decision-making that produces legal or similarly significant effects solely based on automated processing. If that changes, we will provide information required by applicable law.

8. United States & Canada

If you reside in the United States or Canada, we provide this notice to describe our practices at a high level. Depending on your state or province, you may have rights to access, correct, delete, or opt out of certain uses of personal information (including targeted advertising or “sale”/sharing where those terms apply). Submit requests using the contact email above. We do not discriminate against you for exercising privacy rights to the extent prohibited by law.

9. International transfers

If we transfer personal data outside your country, we use appropriate safeguards where required (for example, Standard Contractual Clauses for transfers from the EEA/UK, or other mechanisms recognized under applicable law). Payment processors such as Stripe and Airwallex may process data in countries outside your region under their data processing agreements and applicable transfer tools.

10. Retention

We keep personal data only as long as needed for the purposes above, including legal, tax, and accounting requirements, dispute resolution, and enforcing our agreements—then delete or anonymize it. Retention periods vary by data category and obligation.

11. Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, or alteration. No method of transmission over the Internet is completely secure; we encourage strong passwords and device security.

12. Your rights

Where applicable, you may have the right to access, rectify, erase, restrict processing, data portability, and object to processing. Signed-in buyers can use the Delete account option on my-account to request erasure of account data we control (saved addresses and similar profile data); some order records may be retained in anonymized form where required by law. You may lodge a complaint with your local supervisory authority. We will respond within applicable timelines and may need to verify your identity before fulfilling certain requests.

13. Third-party processors

We use trusted third-party service providers to operate our storefront. They process personal data only on our instructions and under contractual safeguards. Categories include:

• Payment processing: Stripe and Airwallex (and related payment infrastructure) to process transactions securely; card data is handled under PCI-DSS requirements.
• Shipping carriers: logistics partners to deliver orders (name, address, contact, and tracking information).
• Analytics: tools to understand site usage, traffic, and errors (e.g. pseudonymous identifiers, pages viewed).
• Email: providers to send transactional messages, support correspondence, and—where permitted—marketing communications.

We may update our processor list; material changes will be reflected in this policy where appropriate.

14. Children

Our storefront is not directed to children under 16 (or the age required in your jurisdiction). We do not knowingly collect children’s data. If you believe we have collected a child’s data, contact us and we will take appropriate steps.

15. Updates

We may update this policy. Material changes will be posted on this page with an updated effective date. Where required, we will provide additional notice.