Privacy policy

AT Varahaldus OÜ takes your privacy and compliance with all personal data protection laws seriously. This privacy policy explains what data we collect, why and on what legal basis we use it, who we pass it to, how long we keep it and what your rights are.

This privacy policy applies to data collected through the website and online shop nordhauser.ee, the website chat assistant, e-mail and our phone numbers (+372 5816 2265 and the AI assistant’s number +372 5912 2345).

The controller of your data is AT Varahaldus OÜ

Registry code: 16216481

E-mail: nordhauser@nordhauser.ee

Phone: +372 5816 2265

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

Data collection and use

What data do we collect?

We collect data that you give us yourself (for example when you place an order, request a quote or contact us) and data that your device sends automatically when you use the website.

Your personal data may reach us in the following ways:

When you place an order in the nordhauser.ee online shop
When you register as a user of the nordhauser.ee online shop
When you request a quote on the website, in a calculator, by e-mail or by phone
When you contact us by phone, e-mail or the website chat
When you talk to the website chat assistant or call our AI phone assistant
When you buy a product on instalments or enter into a leasing agreement
When you pay by bank link, card or another electronic payment method
When you provide personal data about another person who will receive the goods
When you browse the nordhauser.ee website
When you comment on, like or share a post on our social media account
When you comment on posts on our website

Types of data collected

Personal data

We only ask for personal data when it is needed to provide you with a service. This may include:

First and last name, company name
E-mail address
Postal address, country, county, city
Phone number
Your purchase history, quotes and activity in our online shop
Correspondence and chat history between you and us, including with the chat and phone assistant
Information about your web browser and IP address

We do not see or store payment details (such as card numbers) – these are processed by the payment service provider.

Log files

Our server records log files of website visits. They contain the IP address, the date and time of the visit, the page opened, the referring page and the browser and device type. An IP address is personal data. We use log files to keep the website secure, fend off attacks and find errors, and keep them for 14 days.

Cookies

A cookie is a small text file stored on your device when you visit a website. Session cookies are deleted when you close the browser; persistent cookies stay on the device until they expire.

By purpose, cookies are divided as follows:

Necessary cookies make the cart, checkout and user account work and protect accounts from misuse. The shop cannot work without them, so we do not ask for consent for them.
Consent cookie nh_consent remembers your cookie choice (365 days).
Functional cookies remember your choices, such as language.
Analytics cookies – Google Analytics (Google) and Microsoft Clarity (Microsoft) – help us understand how the website is used and improve it.
Marketing cookies – Google Ads (Google) and Meta Pixel (Meta) – let us measure the effectiveness of our ads and show you more relevant ads.

Analytics and marketing cookies are only loaded after you click “Accept” in the cookie notice. You can change your choice at any time via the “Cookie settings” link in the website footer. You can also delete and block cookies in your browser settings.

If you have given consent, we also send the data needed to measure orders and shopping carts (order value and products, IP address, browser details, and your e-mail address and phone number in irreversibly hashed form, SHA-256) directly from our server to Google and Meta. This lets us measure our ads even when a browser blocks advertising scripts. Without your consent this data is not sent.

Legal bases

We process your personal data on the following legal bases:

Performance of a contract (GDPR Art. 6(1)(b)): preparing orders and quotes, receiving payments, delivering goods, managing your user account and handling returns.
Legal obligation (Art. 6(1)(c)): accounting, keeping invoices and providing data to authorities where the law requires it.
Legitimate interest (Art. 6(1)(f)): customer service and answering enquiries, finding and correcting errors of the chat and phone assistant, website security and fraud prevention, server logs, reminders about an abandoned cart and quotes we have sent.
Consent (Art. 6(1)(a)): analytics and marketing cookies. You can withdraw your consent at any time.

How we use data

We use the data we collect to:

process orders, issue invoices and quotes, deliver goods and make refunds;
answer your questions and enquiries and call you back when needed;
inform you about the status and delivery of your order;
remind you of an abandoned cart or a quote we have sent;
maintain, develop and protect the website and prevent fraud;
analyse use of the website and the effectiveness of our ads (only with your consent);
communicate with you via social media if you have contacted us there.

AI assistants

The website chat and calls to +372 5912 2345 are answered by our AI assistant Herr Hauser, which uses OpenAI language and speech models. The assistant looks up answers in our product catalogue and information and passes questions it cannot answer to our staff. The assistant does not make decisions about you that have legal or similarly significant effects (GDPR Art. 22).

Phone AI assistant

Calls to +372 5912 2345 are answered by our AI assistant, Herr Hauser. At the start of the call we tell you that the text of the call is saved.

No audio is recorded. The call is converted to text while it takes place.
A summary of the call is passed to our staff so they can answer your question or call you back. The call text (transcript), your phone number and the look-ups the assistant made (e.g. order status) are kept for 30 days to find and correct the assistant’s mistakes, and are then deleted automatically.
The legal basis is our legitimate interest in providing accurate customer service (GDPR Art. 6(1)(f)).
To process the call we use the service providers OpenAI (speech and language model), LiveKit (call routing) and Twilio (telephone connection). Transfers outside the European Economic Area are described in the section below.
If you do not want the call text to be saved, say so during the call – we then keep only a short summary. You can later ask for the call text to be deleted at nordhauser@nordhauser.ee or +372 5816 2265.

We do not sell your personal data. We only pass it on to the extent needed for the purposes above, to the following categories of recipients:

Payment and instalment providers – to process payments, instalments and leasing;
Courier and transport companies – to deliver goods (name, address, phone, e-mail);
IT service providers – hosting, e-mail, backups and accounting software;
AI service providers – the website chat assistant, the phone assistant and processing of enquiries received by e-mail;
A messaging service through which our staff are notified of new enquiries and calls;
Analytics and advertising providers – only with your consent (see “Cookies”);
Public authorities – where the law requires it or where it is necessary to protect our rights;
An acquirer of the business – in the event of a merger, sale or transfer of all or part of the business; we will inform you of this.

Service providers process data on our instructions and under a contract that obliges them to protect it. You can ask us for a list of the recipients by name at nordhauser@nordhauser.ee.

Transfers outside the European Union

Some of our service providers (for example OpenAI, Twilio, Google, Microsoft, Meta and Telegram) may process data outside the European Economic Area. In that case the transfer is based on the EU–US Data Privacy Framework where the provider has joined it, or on the Standard Contractual Clauses approved by the European Commission. You can ask for more information and a copy of the safeguards at nordhauser@nordhauser.ee.

Retention of your personal data

We keep personal data only as long as necessary for the purpose or to meet a legal obligation:

Orders, invoices and other accounting documents – 7 years (Estonian Accounting Act § 12). We cannot delete this data during that period, even at your request.
User account – until the account is deleted.
Quotes that did not lead to an order – up to 3 years, to settle possible claims (General Part of the Civil Code Act § 146).
Abandoned cart data – 90 days.
Website chat – conversation context 30 days; chat quality log (for finding the assistant’s mistakes) 12 months.
Chat questions forwarded to staff and chats taken over by staff – 90 days; callback requests – 30 days.
Text of phone assistant calls – 30 days.
Server log files – 14 days.

After the period ends, the data is deleted or anonymised.

Processing of children’s data

None of our products or services are aimed at children under 13, and we do not knowingly collect data from children under 13. If we suspect that we are processing the data of a person under 13, we will remove that person from all our databases.

Your rights to protect your data

You always have the right not to share your data with us, knowing that this may affect our ability to provide you with a service. If you share a third person’s data with us (e.g. the recipient of the goods), you confirm that you are entitled to do so.

If you have given consent (e.g. for analytics and marketing cookies), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

If you believe that the data we hold about you is inaccurate, out of date, incomplete or misleading, please contact us by e-mail at nordhauser@nordhauser.ee or by phone at +372 5816 2265. We reply to requests within one month at the latest. We may occasionally ask for information to verify your identity.

If you believe we have breached data protection rules, please contact us first – we will investigate the complaint without delay and reply in writing. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee) or with the data protection authority of your country of residence.

You have the following rights:

Right of access – you have the right to information about the processing of your personal data and a copy of it, including who we have passed your data to.
Right to rectification – you have the right to have inaccurate data corrected and incomplete data completed.
Right to erasure – under certain conditions you have the right to have your personal data deleted (except data we must keep by law).
Right to restriction of processing – under certain conditions you have the right to restrict the processing of your personal data.
Right to object – you have the right to object to processing based on legitimate interest.
Right to data portability – under certain conditions you have the right to receive your data in a machine-readable format or have it transferred to another controller.
Right to withdraw consent – at any time, where processing is based on consent.

Security of your data

AT Varahaldus OÜ applies reasonable technical and organisational measures to protect your data against unauthorised access, loss and alteration: data is transmitted encrypted (HTTPS), access is restricted and data is backed up. Please remember, however, that no method of transmission over the Internet or electronic storage is 100% secure. The sharing of data with service providers is described in the sections “Who we share data with” and “Transfers outside the European Union”.

Referring to other websites

Our website may contain links to other websites that we do not own. If you click on a third-party link, you will be taken to that third party’s site. We strongly recommend that you read the privacy policy of every site you visit.

We have no control over third-party sites and take no responsibility for their content, privacy policies, services or anything else.

Privacy policy updates

We may change this privacy policy when necessary. The latest version published on this page always applies. We will announce material changes on the website.

Last modified 15.10.2026

Did you find the information you needed?