Privacy policy

The controller of your personal data is IE Works, a business registered in Finland under Business ID (Y-tunnus) 3648124-8, with its registered address at Liepu aleja 7-13, LT-57159 Kedainiai, Lithuania. We trade as HaruNord at harunord.com.

For any question about this policy, or to exercise any of the rights in section 8, email hello@harunord.com or use our contact form.

We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring or process special categories of data.

When you place an order. Your name, email address, delivery address, the items and sizes you bought, the amount paid and the currency, and identifiers from our payment processor. We need all of it to take the order, make the prints, post them to you, and keep the accounting records the law requires.

Card details are never collected by us. Payment happens on Stripe’s own hosted checkout page. Your card number never reaches this website and we never see it, store it, or have any way to retrieve it.

When you write to us. The name, email address and message you put in the contact form, or in an email to us. We use it to answer you and for nothing else. You are not added to any mailing list — we do not have one.

When you simply browse. Our hosting provider records ordinary server request logs, which include IP addresses, for security and reliability. We derive your country from your IP address on each request in order to show the correct shipping price. We do not store that country and we do not build any profile from it.

If you agree to analytics. The pages you look at, roughly where in the world you are, and technical details of your browser and screen — and, through Microsoft Clarity, a recording of how you used the page: what you clicked, where you scrolled, how the mouse moved. We use it to work out which prints people look for and where the shop is hard to use. It is never joined up with your order or your email address, and none of it is collected unless you press Accept. Section 4 sets out what runs, where it does not run, and how to change your mind.

The room matcher. If you upload a photograph of a room, the photograph is analysed inside your own browser and is never uploaded to us. Only a short list of colour values and numbers derived from it is sent to our server so that prints can be ranked. We never receive, see or store the picture, and there is nothing for us to delete afterwards.

Your basket and your saved prints. These are stored in your own browser (in localStorage) and are never sent to us as a list. They stay on that device and are lost if you clear your browser data.

• Taking and fulfilling your order — performance of a contract with you (GDPR Art. 6(1)(b)).
• Keeping invoice and accounting records — compliance with a legal obligation (Art. 6(1)(c)), specifically Finnish accounting and tax law.
• Answering your message — our legitimate interest in responding to people who contact us, and taking steps at your request before entering into a contract (Art. 6(1)(f) and 6(1)(b)).
• Keeping the site secure and available — our legitimate interest in preventing fraud and abuse (Art. 6(1)(f)).
• Measuring how the shop is used — your consent, and nothing else (Art. 6(1)(a)). This is the only purpose on this list that is optional, the only one you are asked about, and the only one you can withdraw at any time without affecting anything else. See section 4.

Apart from analytics, we do not rely on consent, because none of the rest is optional to the service you asked for. We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects, and we do not use your data to target advertising anywhere.

There are two kinds of storage on this site: the little that is needed to run it, and analytics, which are optional and off until you say otherwise.

Needed to run the shop. These are set whatever you choose, because without them the site cannot do what you asked it to:

• harunord_admin— the shop owner’s sign-in session. It is never set for visitors.
• Your cart, your saved prints and your answer to the cookie notice are kept in your browser’s local storage rather than in cookies. They are never sent to us as a list, and clearing your browser data removes them.

All of the above is strictly necessary or functional, so none of it needs your permission and none of it is what the notice at the bottom of the page is about.

Analytics, only if you agree. We use two tools to understand how the shop is used — which pages people look at, what they cannot find, and where the site is confusing:

• Google Analytics 4 (Google Ireland Limited) — counts visits and page views. Sets cookies named _ga and _ga_…, which last up to two years.
• Microsoft Clarity (Microsoft Ireland Operations Limited) — records how pages are used: clicks, scrolling, mouse movement and a replay of the page as you saw it. Sets cookies named _clck, _clsk, CLID and MUID, which last from one day to about a year.

Whether we ask first depends on where you are. We apply the stricter rule to everyone outside the United States, and the United States is treated according to its own law:

• In Europe, and everywhere except the United States — nothing loads until you agree. This is not a matter of the cookies being switched off while the scripts still run: no request is made to Google or Microsoft, and nothing about your visit reaches either company, unless and until you press Accept. If you press Reject, or simply ignore the notice, that stays true for the whole visit and every visit afterwards.
• In the United States— analytics are on when you arrive, and no notice interrupts you. You can switch them off at any moment with the Cookie choices link at the bottom of every page, and that choice is then remembered and respected exactly as an opt-out in Europe would be. We do this because United States law asks for an opt-out rather than prior consent for measurement of this kind, and because it is the only way we get a usable picture of one of our three main markets.

We honour Global Privacy Control. If your browser sends the GPC signal, analytics do not run, and you do not have to tell us twice. That applies wherever you are, and it applies without you clicking anything.

Two pages are never recorded by Clarity, even with your consent. The room matcher is one, because your photograph is on that page and it must not leave your device — see section 2. Your order confirmation is the other, because it shows your name and delivery address. Neither page is measured by Google Analytics either, and neither is the admin area.

We do not use advertising cookies, conversion pixels or any social network’s tracking tag — no Meta Pixel, no Pinterest tag, no TikTok tag — and we do not combine what these tools tell us with your order, your email address or anything else that would identify you personally.

Changing your mind. Every page of this site carries a Cookie choiceslink in the footer, from the very first page you see. It brings the notice back so you can answer again — and in the United States it is the off switch itself, which is why it is there before you have been asked anything. Withdrawing is exactly one click, the same as agreeing was. Your choice is remembered on the device you made it on, so you may be asked again on a different browser or after clearing your browser data.

Withdrawing stops any further collection immediately. It does not reach back and delete what was already gathered, and it does not erase cookies Google or Microsoft have already placed — those expire on their own, and you can remove them yourself in your browser’s settings at any time. To ask Google or Microsoft directly about data they hold, see their own privacy notices; both act as our processors for this purpose and are listed in section 5.

We do not sell your data, share it for advertising, or disclose it to anyone except the service providers we need in order to run the shop. Each of them acts as our processor under a contract:

• Stripe (payments) — receives your name, email, delivery address and payment details in order to take the payment. Stripe is also an independent controller for fraud-prevention and regulatory purposes.
• Supabase (database) — stores the order record, including your name, email and delivery address.
• Vercel (website hosting) — serves the site and keeps request logs.
• Resend (email) — sends your order confirmation and dispatch notice, and delivers contact-form messages to us. Our sending domain is hosted in the European Union.
• Our print and postal partners — receive your name and delivery address in order to produce and deliver your parcel.
• Google (analytics) — only if you agreed. Receives your IP address, the pages you visit and technical details of your device. It never receives your name, email address, delivery address or anything about what you bought.
• Microsoft (analytics) — only if you agreed. Receives the same, plus a recording of how you used the pages it runs on. It never receives your room photograph or your order confirmation, because it does not run on those pages at all — see section 4.

We will also disclose data where we are legally required to, for example to a tax authority or in response to a valid court order.

Stripe and Vercel are United States companies and may process your data outside the European Economic Area. If you agreed to analytics, Google and Microsoft may do the same — we contract with their Irish entities, but both are ultimately United States groups. Where any of that happens, the transfer is protected by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You may ask us for details of the safeguards in place.

Our email provider and our database both store data in the European Union — Resend in eu-west-1 and Supabase in Ireland — so neither involves a transfer outside the EEA.

• Order and invoice records — for as long as Finnish accounting and tax law requires us to keep them, which is six years from the end of the financial year in which the order was placed. We cannot delete these earlier even if you ask, because keeping them is a legal obligation rather than a choice — see section 8.
• Contact-form messages — kept while we deal with your question and for up to two years afterwards, in case you follow up. Deleted on request.
• Server logs — retained by our hosting provider for a short period, typically no more than 30 days.
• Payment records held by Stripe — kept according to Stripe’s own retention policy and financial regulation.

Your order confirmation page shows your address and email for one hour after checkout and then hides them, because the link to that page is not password-protected.

Under the GDPR (and the UK GDPR, if you are in the UK) you may:

• ask for a copy of the personal data we hold about you;
• ask us to correct anything inaccurate;
• ask us to delete it — subject to the accounting records we are legally required to keep, which we will explain if it applies;
• ask us to restrict how we use it;
• ask for it in a portable, machine-readable format, or ask us to send it to someone else;
• object to processing we carry out on the basis of legitimate interests.

Email hello@harunord.com and we will respond within one month. There is no charge. We may ask you to confirm something only the account holder would know — such as the order reference — so that we do not disclose one person’s address to another.

If you are unhappy with how we have handled your data, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi), to the supervisory authority in your own EU country, or — if you are in the UK — to the Information Commissioner’s Office (ico.org.uk). We would rather you told us first, but you do not have to.

We are a Finnish business, and every part of this policy applies to you except one: analytics. Those run by default for visitors in the United States, rather than waiting for consent, because United States law asks for an opt-out rather than an opt-in for measurement of this kind. You can turn them off at any time with the Cookie choiceslink at the foot of any page, and if your browser sends a Global Privacy Control signal they never run at all. In every other respect — what we collect, who sees it, how long we keep it, and the rights in section 8 — we apply the same standard to everyone, wherever they live. We do not sell or share personal information as those terms are used in California law, and we do not process it for cross-context behavioural advertising. Our analytics are configured for measurement only: Google’s advertising features and audience signals are switched off, so nothing collected here is used to build advertising profiles or passed to an ad network. If you are a California resident and would like a copy of your data or its deletion, use the same address in section 8 and we will treat it as a request under the CCPA as well as the GDPR.

This shop is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

If we change this policy we will update the date at the top. If a change materially affects how we use data we already hold about you, we will contact you directly.

The previous version of this page promised that we would update it before introducing any analytics, and that a consent notice would appear at the same time. Both happened on 21 August 2026, when Google Analytics and Microsoft Clarity were added: sections 2 to 6 were rewritten and the notice at the foot of the page appeared with them. The same undertaking still stands for anything we add next — in particular, we will not introduce advertising or profiling tags without saying so here first.