Privacy Policy

Last updated: 20 July 2026

This Privacy Policy explains how Ursa Leather collects, uses, shares and protects your personal data when you visit ursaleather.com or place an order with us. We are committed to handling your data in line with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

1. Who we are (data controller)

The data controller responsible for your personal data is:

2. Personal data we collect

• Identity & contact data — name, email address, shipping and billing address, and phone number (if provided).
• Order data — the products you buy, order value, order history and correspondence about your orders.
• Payment data — payments are processed by Stripe. We receive confirmation of payment and limited details (such as the payment method type and last digits); we do not store your full card number.
• Account data — if you create an account: your login credentials (stored securely) and saved addresses. If you sign in with Google, we receive your name and email from Google.
• Technical & usage data — IP address, browser and device information, and cookie identifiers.
• Communications — messages you send us by email or through the site.

3. How we use your data

• To process and deliver your orders, take payment and issue refunds.
• To manage your account and provide customer support.
• To send transactional emails (order confirmations, shipping updates, password resets).
• To meet legal and accounting obligations (e.g. bookkeeping and tax records).
• To prevent fraud and keep the site secure.
• With your consent, to measure site usage through analytics.

4. Legal bases for processing

We rely on the following legal bases under the GDPR:

• Performance of a contract — to process and fulfil your orders and manage your account.
• Legal obligation — to keep accounting and tax records.
• Legitimate interests — to secure our site, prevent fraud and improve our service, where these interests are not overridden by your rights.
• Consent — for optional analytics cookies. You can withdraw consent at any time.

5. Sharing your data and our processors

We do not sell your personal data. We share it only with service providers ("processors") who help us run the store, under agreements that require them to protect your data:

• Stripe — payment processing.
• Google — account sign-in (Google OAuth), address autocomplete (Google Maps), and, subject to your consent, website analytics (Google Analytics).
• Resend — sending transactional emails.
• Cloudflare — website hosting and content delivery.
• Hetzner — backend server hosting (Germany, EU).
• Backblaze B2 — file/image storage.

Some of these providers may process data outside the European Economic Area (EEA). Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We may also disclose data where required by law.

6. Cookies

We use cookies and similar technologies to make the site work and to understand how it is used:

• Essential cookies — required for core functions such as your shopping cart, login session and security. These are always active.
• Analytics cookies — Google Analytics, used only with your consent, to help us understand and improve the site.

You can control or delete cookies through your browser settings. Blocking essential cookies may affect how the site works.

7. How long we keep your data

We keep your personal data only as long as necessary:

• Order and transaction records — retained for at least 5 years to comply with the Norwegian Bookkeeping Act (Bokføringsloven).
• Account data — kept while your account is active; deleted on request or after a prolonged period of inactivity.
• Marketing/analytics data — kept until you withdraw consent or object.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten"), where applicable.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at hello@ursaleather.com. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no).

9. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS) and processing payments through PCI-compliant providers. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of any breach where required by law.

10. Contact us

For any privacy question or request, contact us at hello@ursaleather.com or by post at the address above.