GDPR Policy


1. Purpose and Scope

This GDPR Policy explains how we may collect, use, disclose, retain, and protect personal data in connection with our website and online furniture shopping services.

This Policy is intended to provide information about the data protection principles and rights that may apply when the processing of personal data falls within the scope of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

The GDPR does not automatically apply to every customer or visitor in the United States. Where the GDPR does not apply, personal information may nevertheless be subject to applicable U.S. federal, state, or other privacy and data protection laws.

This Policy should be read together with our Privacy Policy and Cookies Policy, which provide additional information about how we handle personal information and cookies.

2. When GDPR Applies

The GDPR may apply where the processing of personal data falls within the territorial scope of the GDPR or where otherwise required under applicable data protection laws.

Accordingly, not every individual who visits or purchases from our website will necessarily have rights under the GDPR. Where applicable, we will process personal data in accordance with the GDPR and other applicable data protection requirements.

For individuals whose personal data is not subject to the GDPR, applicable U.S. privacy laws may provide different rights and protections. Nothing in this Policy is intended to create rights that do not apply under the laws governing a particular individual or processing activity.

3. Personal Data We May Process

Depending on how you interact with our website and services, we may process categories of personal data such as:

  • Name and contact information;
  • Shipping and delivery information;
  • Order and transaction information;
  • Payment-related information necessary to process transactions;
  • Account information, where an account is created or used;
  • Website usage information;
  • IP address and certain device or technical information; and
  • Information collected through cookies and similar technologies.

We only seek to process personal data that is reasonably necessary for legitimate business, contractual, legal, or other permitted purposes.

4. Purposes of Data Processing

We may process personal data for purposes including:

  • Processing and fulfilling orders;
  • Arranging delivery and providing after-sales support;
  • Processing payments and related transactions;
  • Responding to customer questions, requests, and communications;
  • Operating, maintaining, and securing our website;
  • Improving our website, services, and customer experience;
  • Detecting and preventing fraud, misuse, unauthorized activity, or security risks;
  • Complying with applicable legal and regulatory obligations; and
  • Carrying out marketing or other activities where permitted by applicable law and, where required, based on your consent or other appropriate legal basis.

We will not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by applicable law.

5. Legal Bases for Processing

Where the GDPR applies, we may rely on one or more of the following legal bases for processing personal data:

Consent. We may process personal data when you have provided consent where consent is required. Where applicable, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Performance of a Contract. We may process personal data when it is necessary to enter into or perform a contract with you, such as processing an order or providing related services.

Steps at Your Request Before Entering Into a Contract. We may process information when necessary to take steps at your request before entering into a contract.

Compliance With a Legal Obligation. We may process personal data when necessary to comply with a legal or regulatory obligation applicable to us.

Legitimate Interests. We may process personal data where necessary for our legitimate interests or those of a relevant third party, provided that such interests are not overridden by applicable legal requirements or your fundamental rights and freedoms. Where required, we will conduct an appropriate balancing assessment before relying on this basis.

The applicable legal basis may vary depending on the nature and purpose of the processing.

6. Your Data Protection Rights

Where the GDPR applies, you may have certain rights regarding your personal data, subject to applicable legal conditions and limitations. These may include:

  • Right of Access: You may have the right to request access to personal data we hold about you and certain information about how it is processed.
  • Right to Rectification: You may have the right to request correction of inaccurate or incomplete personal data.
  • Right to Erasure: You may have the right to request deletion of your personal data in circumstances permitted by applicable law.
  • Right to Restriction of Processing: You may have the right to request that we restrict the processing of your personal data in certain circumstances.
  • Right to Object: You may have the right to object to certain processing activities, including processing based on legitimate interests where applicable.
  • Right to Data Portability: Where applicable, you may have the right to receive certain personal data in a structured, commonly used, and machine-readable format and to request its transmission to another organization where legally available.
  • Right to Withdraw Consent: Where processing is based on consent, you may have the right to withdraw that consent at any time.
  • Right to Lodge a Complaint: Where applicable, you may have the right to lodge a complaint with a competent data protection supervisory authority.

These rights are not necessarily available to every individual or in every circumstance. Their availability depends on whether the GDPR or another applicable privacy law applies to the relevant processing.

7. Sharing of Personal Data

We may disclose or make personal data available to parties where reasonably necessary to operate our business, provide requested services, or comply with applicable law.

Depending on the circumstances, these parties may include:

  • Payment-related service providers;
  • Shipping and logistics providers;
  • Website technology or hosting service providers;
  • Customer service providers; and
  • Legal, regulatory, or law enforcement authorities where disclosure is required or permitted by law.

We do not intend to arbitrarily sell or disclose personal data. Any sharing of personal data will be carried out in accordance with applicable legal requirements and for appropriate business, contractual, legal, or other permitted purposes.

Where appropriate, service providers may process personal data on our behalf and only to the extent reasonably necessary to provide the relevant services.

8. Data Retention and Security

We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, provide our services, maintain appropriate business records, comply with legal obligations, resolve disputes, enforce agreements, or satisfy other legitimate and lawful requirements.

Retention periods may vary depending on the type of information, the nature of the processing, our business needs, and applicable legal obligations.

We take reasonable technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss, misuse, or destruction. However, no method of transmitting or storing information can be guaranteed to be completely secure.

9. International Data Transfers

Depending on the circumstances of our operations and service relationships, personal data may be transferred, stored, or processed in different jurisdictions.

Where the GDPR or other applicable data protection laws impose requirements on international transfers of personal data, we will take appropriate measures required by those laws.

The applicable safeguards may depend on the nature of the transfer, the jurisdictions involved, and the legal requirements applicable at the time of processing.

10. Cookies and Similar Technologies

We may use cookies and similar technologies to support website functionality, understand website usage, maintain appropriate website operations, and improve the user experience.

Depending on the information collected and how it is used, cookies and similar technologies may involve the processing of personal data. Where applicable, such processing will be carried out in accordance with applicable privacy and data protection requirements.

For more information about our use of cookies and similar technologies, including applicable choices and controls, please refer to our Cookies Policy.

11. How to Exercise Your Rights

Where applicable, you may contact us to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal data, or to withdraw consent where processing is based on consent.

You may submit a privacy-related request using the contact information below:

Email: team@noralrio.com
Phone: +1 (419) 683-4271
Address: 8171 US Route 33, Celina, Ohio 45822, United States

When submitting a request, please provide sufficient information to help us understand the nature of your request and, where reasonably necessary, verify the request and locate the relevant information.

We will handle privacy requests in accordance with applicable law. We may be unable to fulfill a request, or may provide only a limited response, where applicable law permits or requires us to retain or process certain information.

12. Changes to This GDPR Policy

We may update this GDPR Policy from time to time to reflect changes in our business practices, data processing activities, applicable legal requirements, or privacy standards.

When changes are made, we will update this Policy on our website. We encourage you to review this page periodically to remain informed about how applicable data protection requirements may affect the processing of your personal data.

13. Contact Us

If you have questions about this GDPR Policy, our privacy practices, or the processing of your personal data, you may contact us using the following information:

Phone: +1 (419) 683-4271
Email: team@noralrio.com
Address: 8171 US Route 33, Celina, Ohio 45822, United States
Opening hours: Monday to Friday, 9:00 AM – 6:00 PM (EST)