Privacy notice

Who we are

NordSourced is operated by SIA AI Nordic, registration number 40203787895, Zvaigznāja gatve 5-79, Rīga, LV-1082, Latvia (the same details as the imprint). It is the data controller for the personal data described in this notice (“we” below). Write to sourcing@nordsourced.com with any privacy question or request.

What we publish about companies

Company profiles carry business information: legal name, registration number, address, website, contact email/phone, what the company makes, services offered, minimum order and lead time where published, certificates, export markets, and an evidence score with its reasons. We publish only a company’s generic contact address (e.g. info@ or sales@), never a named individual’s personal email or phone number, sourced into a profile.

Where a source document (such as a national business register extract) names an individual — typically a sole trader whose business name legally includes their own name, or a listed director or board member — that name may appear as part of the company’s legal-name or registration facts. That fragment is personal data under GDPR, and the rest of this notice applies to it.

Where the data comes from

• The company’s own website (what it makes, services, terms, certificates).
• National company registers: Uzņēmumu reģistrs (Latvia), Registrų centras (Lithuania), e-äriregister (Estonia), PRH (Finland), Bolagsverket (Sweden).
• Export directories run by chambers of commerce and export agencies, used to find companies — facts are still checked at the source before publication.
• Where we have sent a test request to the company: the date of its first answer, not the message itself.

We never copy company data from other directories or comparison sites.

Why we process this data (legal basis)

We rely on Art. 6(1)(f) GDPR — legitimate interest: informing business buyers and maintaining a transparent, checkable supplier directory. We have weighed this interest against the rights of anyone named against a company record: the data is business-role information already made public by the company itself or an official register, it is limited to what a buyer needs to evaluate a supplier, and we offer the objection and correction routes described below. A written assessment of that balancing test is kept on file and can be requested at the contact above.

If your data was not collected from you (Art. 14 GDPR)

Because company profiles are built from public sources rather than collected directly from the individuals they may reference, Art. 14 GDPR requires us to give those individuals this information rather than notify each one individually, which for a directory of this size would involve disproportionate effort (Art. 14(5)(b)). This notice, together with the correction and objection routes below, is that disclosure. If you are a named individual on a profile, it tells you: who we are, what we hold about you, why (Art. 6(1)(f), above), where it came from (above), and your rights (below).

If you send us a sourcing request

The request form asks for your email and the product brief; company name, markets, quantities and a message are optional. We use this only to run your request: to match the brief against checked manufacturers, to write to the manufacturers you approve, and to send you the shortlist. The legal basis is Art. 6(1)(b) GDPR, steps taken at your request before a possible contract.

Manufacturers receive the product brief without your name, your company or your contact details, unless you ask us to introduce you. We do not add you to a mailing list.

How long we keep it

Published company data is kept for as long as the profile is published, and reviewed when a correction is submitted or when we re-check a list. Unpublished or removed companies’ data is deleted or anonymised on a periodic review, unless a specific objection or legal request requires earlier deletion. Sourcing-request and correction-form submissions are kept only as long as needed to act on them.

Who else sees this data

These providers process data on our behalf, each under its own data-processing terms:

• Hostinger: hosting of the site and of our mailbox.
• Supabase: the database behind the site, in its Stockholm (EU) region.
• Google (Gemini API) and TypeSafe: AI tools that help us read and classify public company web pages (see our AI disclosure). Gemini also reads the text of a sourcing request to turn it into a product brief (product, quantity, markets) before we match it to manufacturers.
• Google (Google Analytics 4): visit counts, only after you accept cookies (see Cookies and tracking).

We do not sell or trade any data.

Cookies and tracking

With your consent, and only then, we count visits with Google Analytics 4: which pages are viewed, how visitors arrive (a search engine, a link, an AI assistant), scrolling, clicks on links to other sites, file downloads, whether a form was started or sent, and the country and kind of device. It sets two cookies on nordsourced.com, _ga and _ga_<ID>, which hold a random identifier so that a return visit is not counted as a new visitor; they expire 13 months after your last visit. Google Analytics 4 does not store IP addresses, and its advertising features and Google signals are switched off, so the data is not used for advertising. Google Ireland Limited provides the service under its data processing terms; some processing may take place in the USA under the EU–US Data Privacy Framework. Data about single visits is deleted after at most 14 months; totals in reports, which identify no one, are kept.

The address of each viewed page is part of that count. So the words you type into the site search reach Google Analytics too, as part of the address of the results page (/search?q=…), and so does the product text when you send a search on to the request form (/request?product=…). We use them to see what buyers look for. The search itself keeps no history on our side; type no names or contact details into it.

The legal basis is your consent (Art. 6(1)(a) GDPR). If you reject, nothing is set and nothing is sent. You can change your answer at any time with “Cookie settings” at the bottom of every page; rejecting after accepting stops the counting at once and removes the cookies. Your answer itself is kept in your browser’s local storage.

Its fonts are served from nordsourced.com. One exception comes from our host: to keep automated abuse away, Hostinger’s network sometimes shows a visitor a short browser check before the page. That check sets one technical cookie (hcdn), which the protection needs and which lasts until the browser is closed, and it loads a font from Google Fonts, so Google receives the visitor’s IP address for that request. Like any web server, our host keeps standard access logs (IP address, time, page requested) for security and troubleshooting. If we ever add a tool that sets cookies for anything else, we will ask for your consent first and update this notice.

Your rights

• Object (Art. 21 GDPR) to our processing of your personal data at any time. For a named individual on a company profile, we will remove or anonymise that fragment unless we have compelling grounds to keep it that override your interests.
• Access what we hold about you (Art. 15).
• Rectify an inaccurate fact (Art. 16) — see Correct a fact.
• Erasure (Art. 17), where it applies.
• Lodge a complaint with your national data protection authority. In Latvia that is the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).

Send any of these requests to sourcing@nordsourced.com. We respond within one month.