Privacy & GDPR policy
This policy explains how Northern Pixel ApS (“Survivor”, we) processes personal data when you browse the shop, place an order or contact support. We act as data controller under Regulation (EU) 2016/679 (GDPR).
Controller
Northern Pixel ApS, C/O LegalDesk.dk ApS, Njalsgade 21F, 2., 2300 København S, Denmark. CVR 46164563, DK46164563. Email support@survivor-gear.eu, phone +45 00 00 00 00.
What we process, why, and on which legal basis
| Data | Purpose | Legal basis / retention |
|---|---|---|
| Name, email, delivery address, order lines | Fulfilling your purchase and delivery | Art. 6(1)(b) contract · kept 5 years (accounting law) |
| Payment reference (no card data) | Taking payment, refunds, fraud prevention | Art. 6(1)(b) and (f) · kept 5 years |
| Order number, email, return details | Handling returns and withdrawal requests | Art. 6(1)(b) and (c) · kept 3 years |
| Account login data (email, hashed password) | Giving you access to your order history | Art. 6(1)(b) · until you delete the account |
| Technical logs, strictly necessary cookies | Security, cart and session functionality | Art. 6(1)(f) legitimate interest · up to 12 months |
Who we share data with
We only share what is needed to deliver your order: our payment provider (Stripe), our hosting and database provider, our email provider, and the warehouse/logistics partners and carriers that pick, pack and deliver your parcel. All act as processors under data-processing agreements. Where data is transferred outside the EU/EEA, it is covered by the European Commission’s Standard Contractual Clauses. We never sell personal data.
Your rights
- Access, rectification and erasure of your personal data.
- Restriction of, or objection to, processing based on legitimate interest.
- Data portability for data you provided to us.
- Withdrawal of any consent you have given, at any time.
- Complaint to your national data protection authority if you believe we process your data unlawfully.
To exercise a right, email support@survivor-gear.eu. We reply within one month.
Security
Traffic is encrypted with TLS, database access is restricted by row-level security, and card details are handled solely by our PCI-DSS compliant payment provider — we never see or store card numbers.