Privacy notice

Who we are

NordSourced is operated by Garri Geļfers, a self-employed person registered with the State Revenue Service of Latvia, Zvaigznāja gatve 5-79, Rīga, LV-1082, Latvia (the same details as the imprint). He is the data controller for the personal data described in this notice (“we” below). Contact him for any privacy question or request at sourcing@nordsourced.com. A limited liability company (SIA) is being registered in Latvia and will take over as operator. These details will change on that date.

What we publish about companies

Company profiles carry business information: legal name, registration number, address, website, contact email/phone, what the company makes, services offered, minimum order and lead time where published, certificates, export markets, and an evidence score with its reasons. We publish only a company’s generic contact address (e.g. info@ or sales@), never a named individual’s personal email or phone number, sourced into a profile.

Where a source document (such as a national business register extract) names an individual — typically a sole trader whose business name legally includes their own name, or a listed director or board member — that name may appear as part of the company’s legal-name or registration facts. That fragment is personal data under GDPR, and the rest of this notice applies to it.

Where the data comes from

• The company’s own website (what it makes, services, terms, certificates).
• National company registers: Uzņēmumu reģistrs (Latvia), Registrų centras (Lithuania), e-äriregister (Estonia), PRH (Finland), Bolagsverket (Sweden).
• Export directories run by chambers of commerce and export agencies, used to find companies — facts are still checked at the source before publication.
• A reply to our own anonymous test request to the company, where we have sent one.

We never copy company data from other directories or comparison sites.

Why we process this data (legal basis)

We rely on Art. 6(1)(f) GDPR — legitimate interest: informing business buyers and maintaining a transparent, checkable supplier directory. We have weighed this interest against the rights of anyone named against a company record: the data is business-role information already made public by the company itself or an official register, it is limited to what a buyer needs to evaluate a supplier, and we offer the objection and correction routes described below. A written assessment of that balancing test is kept on file and can be requested at the contact above.

If your data was not collected from you (Art. 14 GDPR)

Because company profiles are built from public sources rather than collected directly from the individuals they may reference, Art. 14 GDPR requires us to give those individuals this information rather than notify each one individually, which for a directory of this size would involve disproportionate effort (Art. 14(5)(b)). This notice, together with the correction and objection routes below, is that disclosure. If you are a named individual on a profile, it tells you: who we are, what we hold about you, why (Art. 6(1)(f), above), where it came from (above), and your rights (below).

If you send us a sourcing request

The request form asks for your email and the product brief; company name, markets, quantities and a message are optional. We use this only to run your request: to match the brief against checked manufacturers, to write to the manufacturers you approve, and to send you the shortlist. The legal basis is Art. 6(1)(b) GDPR, steps taken at your request before a possible contract.

Manufacturers receive the product brief without your name, your company or your contact details, unless you ask us to introduce you. We do not add you to a mailing list.

How long we keep it

Published company data is kept for as long as the profile is published, and reviewed when a correction is submitted or when we re-check a list. Unpublished or removed companies’ data is deleted or anonymised on a periodic review, unless a specific objection or legal request requires earlier deletion. Sourcing-request and correction-form submissions are kept only as long as needed to act on them.

Who else sees this data

These providers process data on our behalf, each under its own data-processing terms:

• Hostinger: hosting of the site and of our mailbox.
• Supabase: the database behind the site, in its Stockholm (EU) region.
• Google (Gemini API) and TypeSafe: AI tools that help us read and classify public company web pages (see our AI disclosure).

We do not sell or trade any data.

Cookies and tracking

This site sets no cookies and runs no analytics, advertising or tracking scripts, so there is nothing to consent to and no cookie banner. Fonts are served from nordsourced.com itself. Like any web server, our host keeps standard access logs (IP address, time, page requested) for security and troubleshooting. If we ever add a tool that sets cookies, we will ask for your consent first and update this notice.

Your rights

• Object (Art. 21 GDPR) to our processing of your personal data at any time. For a named individual on a company profile, we will remove or anonymise that fragment unless we have compelling grounds to keep it that override your interests.
• Access what we hold about you (Art. 15).
• Rectify an inaccurate fact (Art. 16) — see Correct a fact.
• Erasure (Art. 17), where it applies.
• Lodge a complaint with your national data protection authority. In Latvia that is the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).

Send any of these requests to sourcing@nordsourced.com. We respond within one month.