Lux Nordica

Privacy policy

This is an English translation provided for convenience. In case of any discrepancy, the Danish version at luxnordica.com is the legally binding version.

Privacy Policy for Lux Nordica

Last updated: 15 July 2026 Version: 1.0

1. Data controller

This privacy policy describes how we process your personal data when you use the Lux Nordica marketplace.

Data controller: NKG ApS (Lux Nordica) CVR-nr.: 40815155 c/o Legaldesk.dk ApS, Njalsgade 21 F, 2., 2300 København S, Danmark E-mail: hej@luxnordica.com Data protection enquiries: hej@luxnordica.com

We have not appointed a data protection officer (DPO), as we are not required to. You are welcome to contact us at the above email with any questions about the processing of your personal data.

2. What personal data we process

Depending on your use of the Platform, we process:

Account information: name, email, password (encrypted), user type (buyer, artist, gallery, business), profile information and artist description.

Contact and delivery information: postal address, telephone number and delivery address.

Order and transaction information: works purchased/rented, order history, prices, fees, subscription status and correspondence about orders.

Payment information: information necessary to complete payment and payout. The card and account details themselves are processed by Stripe; we do not store your full card details but receive, for example, transaction status, the last four digits and the payment reference. For sellers, identification and verification information (KYC) is additionally processed via Stripe Connect.

Content you upload: images of works, descriptions, prices and other material.

Communication: messages to our support, the contact form and newsletter sign-up.

Messages and offers between users: correspondence, attachments and offers/negotiation exchanged between buyers, artists, galleries and businesses via the Platform's messaging system.

Information about third parties: information you yourself provide about other people — for example the name, email and personal greeting for a gift card recipient, or the contact details of a contact person in a business enquiry (lead). These persons are informed in accordance with GDPR Article 14.

Reviews and ratings: the ratings, title and text in reviews you write, as well as the artist's possible reply.

Preference and activity data: favourites, follow relationships, collections and — for businesses — stated art preferences.

Internal notes: administrative notes and case-handling information that our staff attach to an account, order or enquiry (legal basis: legitimate interest in operation, support and abuse prevention).

Technical information: IP address, device and browser type, log and usage data, as well as cookies and similar technologies (see section 8).

3. Purposes and legal basis

We process your personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

Creation and administration of your account and provision of the Platform's services. Legal basis: performance of a contract, Article 6(1)(b).

Processing of purchase, rental, leasing, payment and payout (including via Stripe). Legal basis: performance of a contract, Article 6(1)(b).

Customer service and handling of enquiries, complaints and disputes. Legal basis: performance of a contract and legitimate interest in being able to provide support, Article 6(1)(b) and (f).

Compliance with legal obligations (including bookkeeping and VAT rules as well as anti-money-laundering/KYC requirements in connection with payouts). Legal basis: legal obligation, Article 6(1)(c).

Newsletter and marketing. Legal basis: consent, Article 6(1)(a) (may be withdrawn at any time).

Improvement, security and operation of the Platform and statistics/analytics. Legal basis: legitimate interest, Article 6(1)(f); for non-essential cookies, however, consent (see section 8).

Establishing, exercising or defending legal claims. Legal basis: legitimate interest, Article 6(1)(f).

4. Recipients and disclosure

We disclose or entrust personal data to:

  • Stripe (Stripe Payments Europe, Ltd. and others) — payment processing and payout via Stripe Connect.
  • Hosting and infrastructure provider — Hetzner Online GmbH, Germany (EU).
  • Email (transactional emails) — sent via our own email server at the hosting provider (Hetzner, EU).
  • Analytics/statistics tool — Google Analytics (Google Ireland Ltd.); set only with your consent, cf. section 8.
  • Sellers and buyers to the extent necessary to complete a transaction (e.g. delivery and contact details for use in delivery/return).
  • Advisers and authorities, where we are legally obliged to do so.

We do not sell your personal data. Data processors process information only on our instructions and on the basis of data processing agreements, cf. GDPR Article 28.

5. Transfer to third countries

Some of our suppliers may process information outside the EU/EEA. Where such a transfer takes place, we ensure a valid transfer basis, typically the European Commission's Standard Contractual Clauses (SCC) and any supplementary measures. You can contact us to be informed of the specific basis.

6. Retention periods

We retain personal data for as long as necessary for the purposes for which it was collected:

  • Account information: for as long as your account is active, and generally deleted/anonymised within 24 months after closure, unless longer retention is required.
  • Bookkeeping and transaction information: for 5 years from the end of the relevant financial year, cf. the Danish Bookkeeping Act (bogføringsloven).
  • Newsletter: until you withdraw your consent.
  • Support enquiries: generally up to 2 years.
  • Information necessary for legal claims: until the claim is time-barred.

7. Your rights

Under the GDPR, you have the right to:

  • obtain access to the information we process about you;
  • have inaccurate information rectified;
  • have information erased ("the right to be forgotten") within the limits of the law;
  • have processing restricted;
  • object to processing based on legitimate interest, as well as to direct marketing;
  • data portability (receive your information in a structured, machine-readable format);
  • withdraw consent at any time, without this affecting the lawfulness of the processing prior to the withdrawal.

You can exercise your rights by contacting us at hej@luxnordica.com. We generally respond within one month.

You also have the right to complain to: Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby — www.datatilsynet.dk.

8. Cookies and similar technologies

8.1 We use cookies and similar technologies to make the Platform work (essential cookies), to remember your choices, and for statistics/analytics.

8.2 Non-essential cookies (including statistics, analytics and any marketing cookies) are set only with your consent via our cookie banner. You can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of any page.

8.3 A detailed overview of the cookies used appears in our cookie policy.

9. Security

We take appropriate technical and organisational security measures to protect your information against unauthorised access, loss or misuse, including encryption of passwords, access restriction and the use of recognised sub-processors. In the event of a personal data breach that entails a risk to your rights, we notify Datatilsynet (the Danish Data Protection Agency) and — where required — you, in accordance with the GDPR.

10. Changes to this policy

We may update this privacy policy. The version in force from time to time is published on the Platform, stating the date of the latest update. In the event of material changes, we inform you by email or by notice on the Platform.

11. Contact

NKG ApS (Lux Nordica) CVR-nr.: 40815155 c/o Legaldesk.dk ApS, Njalsgade 21 F, 2., 2300 København S E-mail: hej@luxnordica.com