GDPR Compliance & Data Collection Policy

This GDPR Compliance and Data Collection Policy applies to individuals located within the European Economic Area (EEA), United Kingdom, and Switzerland, in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679).

1. DATA CONTROLLER

The data controller responsible for the processing of your personal data on this website is Nordic Cardiovascular Wellness Ltd. Contact: [email protected].

2. LEGAL BASES FOR DATA PROCESSING

We process your personal information under the following legal bases pursuant to Article 6 of the GDPR:

- Consent: For non-essential tracking cookies, marketing communications, and the Facebook Pixel tracking pixel.

- Contractual Necessity: To process lead requests, confirm orders, and ship our cardiovascular wellness product.

- Legitimate Interests: To prevent fraud, ensure website security, and optimize campaign effectiveness, provided your fundamental rights do not override these interests.

- Legal Obligation: For tax, accounting, and consumer protection statutory compliance.

3. DATA CAPTURE VIA LEAD FORMS & META PIXEL

- Lead Capture Forms: Direct collection of name, email address, telephone number, and delivery data, provided explicitly by you.

- Meta/Facebook Pixel: With your prior consent via our cookie consent banner, the Meta Pixel captures pseudonymized event data (e.g., page views, 'Add to Cart', 'Lead' events, IP addresses, and browser details). This data is shared with Meta Platforms Ireland Ltd. for audience matching, conversion attribution, and targeted advertising.

4. INTERNATIONAL TRANSFERS

Data collected via the Meta Pixel and international cloud services may be transferred to and processed in countries outside the EEA, including the United States. Such transfers are conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent adequacy decisions.

5. YOUR RIGHTS UNDER GDPR

As a data subject, you have the following enforceable rights:

- Right of Access (Art. 15): Request confirmation and a copy of personal data held about you.

- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.

- Right to Erasure / 'Right to be Forgotten' (Art. 17): Request deletion of your data when it is no longer required.

- Right to Restriction of Processing (Art. 18): Limit how we process your personal data.

- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.

- Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing at any time.

- Right to Withdraw Consent (Art. 7(3)): Withdraw consent for cookies and marketing without affecting the lawfulness of prior processing.

6. EXERCISING YOUR RIGHTS & COMPLAINTS

To exercise any of your rights or request data erasure, contact [email protected]. If you believe our data processing violates the GDPR, you have the right to lodge a formal complaint with your local Data Protection Supervisory Authority.