Last updated: 5 November 2026.
Who processes your data?
For services in Estonia, the controller is Nordecos Eesti OÜ (registration number 16324420), email info@nordecos.ee. For services in Norway, the controller is Nordecos AS (organisation number 923790799), email info@nordecos.no. This notice applies to nordecos.ee, nordecos.no and nordecos.com.
What data do we use, and why?
To answer an enquiry, we use your name, email address, message and any phone number or file you choose to provide. To fulfil an order, we also process the job address, agreements, measurement and installation information, drawings and photos needed to document the work. Please only send information relevant to your enquiry or order.
We handle enquiries and orders to take steps at your request before entering into a contract or to perform a contract. We process accounting information to meet legal obligations. Website security, troubleshooting and handling potential claims are based on our legitimate interests, taking your rights into account. Analytics and advertising measurement that require consent depend on your choice.
Where is data stored, and who can access it?
A copy of an enquiry submitted through our website is stored in the WordPress form archive and email. This helps us receive and handle enquiries even if email delivery fails. We manage accepted orders and their documentation in Scoro.
Access is limited to authorised staff, such as the measurer and installer assigned to your job, and technical service providers as necessary to deliver their services. We use Zone.ee and one.com for domain and web services and Scoro for order management. We use Google services to measure website use and advertising results according to cookie choices.
When arranging lifting assistance, a crane or a plumber, we provide the job address needed for the service. We do not normally share other customer data for these arrangements. We do not sell personal data. We may also disclose data where required by law.
Service providers may process data outside the European Economic Area. Applicable safeguards must then be in place, such as a European Commission adequacy decision or standard contractual clauses. Providers’ privacy terms and subprocessors may change.
How long do we keep data?
If an enquiry does not become an order, we delete its data once it has been closed, unless another justified reason requires retention. This also covers the WordPress and email copies under our control.
We retain order documentation until the warranty period for the relevant work ends. Accounting documents are subject to statutory retention periods. Where a dispute or claim arises, we may retain relevant information for as long as necessary to resolve it and protect legal rights. Data in backups is removed through the normal backup replacement cycle and is not used for routine customer management.
Cookies and measurement
The website may use cookies necessary for its operation and security. Analytics helps us understand website use, while advertising measurement helps assess whether visitors arriving from ads submit enquiries. Google Analytics and Google Ads may process device, browser and website-use information for these purposes. Form messages and attachments are not intended to be sent to analytics or advertising measurement services.
You can accept or refuse cookies that require consent through the cookie choices and change your choice later. You can also delete or restrict cookies in your browser settings; this may affect website functionality.
Your rights and contact
You can request access to your data, correction, deletion or restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests. You may withdraw consent without affecting the lawfulness of earlier processing. Legal obligations or other people’s rights may limit some requests.
Contact the Nordecos company providing your service using the email address above. We may need to verify your identity. You may also complain to a supervisory authority: the Estonian Data Protection Inspectorate (aki.ee) or the Norwegian Data Protection Authority (datatilsynet.no).