Privacy policy

Last updated: 18 September 2026

1. About this policy

This policy explains how Vacorax collects, uses and shares personal information when you browse our store, place an order, contact us or interact with our advertising. Personal information means information that identifies you or can reasonably be linked to you.

Vacorax is responsible for the personal information used to operate this store and manage our customer relationships. The legal identity and contact details of the data controller are provided in section 13 below. Shopify hosts our store and also processes information for certain services of its own.

2. Information we collect

• Contact and order details: your name, email, phone number if provided, billing and delivery addresses, products ordered, payment status, delivery updates, returns and refunds.
• Account and support information: customer-account details, saved preferences and information you include in messages, forms or support requests.
• Payment information: billing details, payment method and transaction references. Payment providers process the payment credentials needed to complete your transaction.
• Device and browsing information: IP address, approximate location, browser and device details, referring pages, products viewed, cart and checkout activity, timestamps and cookie identifiers.
• Marketing information: consent choices, communication preferences, advertising interactions, conversion events and interests inferred from your activity, where the relevant processing is enabled and permitted.

We receive information directly from you, automatically through our store and its technologies, and from Shopify, payment providers, fulfilment partners, carriers and advertising partners in connection with the purposes described below.

3. Why we use your information

• To fulfil your purchase: process payments, arrange delivery, manage returns and provide order support. Our legal basis is performing our contract with you or taking steps you request before a purchase.
• To meet legal obligations: maintain required accounting and tax records and respond to binding legal requests.
• To operate and protect the business: prevent fraud, secure the store, resolve technical problems, answer general enquiries and handle legal claims. We rely on our legitimate interests in these activities, balanced against your rights. You may ask us about that assessment.
• For optional analytics and marketing: understand browsing activity, measure advertising, personalise ads and send promotional messages. We rely on consent for optional tracking and personalised advertising, and for promotional messages where consent is required.

We need certain contact, payment and delivery information to process an order. Without it, we may be unable to complete your purchase. Optional marketing consent is not a condition of buying from us.

You may withdraw consent at any time. This does not affect processing that was lawful before withdrawal.

4. Cookies and privacy preferences

Cookies and similar technologies support essential features such as the shopping cart, checkout, account access, security and remembering your privacy choices. Optional technologies can measure website use and advertising performance or help personalise advertising.

Where consent is required, optional analytics and advertising technologies require your permission before use. Use the cookie banner or privacy-preference controls displayed in the store to make or change your choices. If you cannot find these controls, contact support@vacorax.com.

Your browser may also let you block or delete cookies. Blocking essential cookies can affect checkout and other store functions. Preferences may need to be set again on another browser or device, or after clearing cookies.

5. Meta advertising

We advertise on Facebook and Instagram. Depending on the settings enabled and your privacy choices, Shopify's Meta integration can use Meta Pixel, Conversions API and customer matching to measure results, attribute purchases to ads, improve campaigns and show relevant advertising.

These tools may share page views, cart activity, checkout and purchase events, product details, order value, currency, IP address, browser details and cookie or click identifiers. Matching may also use your email, phone number, name, city, region, postal code and country. The information transmitted depends on the event, available information and enabled settings.

Some identifiers may be hashed before matching. Hashing does not make them anonymous. Server-side transmission through Conversions API remains subject to applicable consent and privacy requirements.

Meta may connect these events with your Meta account and activity on other services for measurement and personalised advertising. Read the Meta Privacy Policy for information about Meta's processing and choices.

6. Who we share information with

We share relevant information with the following recipients for the purposes described in this policy:

• Shopify and payment providers: to host the store, operate checkout, process payments and refunds, and support transaction security.
• DSers, product suppliers, fulfilment partners and carriers: to arrange and deliver orders. This can include your name, delivery address, contact details and the products ordered.
• Technology and support providers: to operate communications, store services, security and privacy controls.
• Meta and enabled analytics or advertising providers: for measurement and marketing, subject to applicable privacy choices.
• Professional advisers and authorities: where necessary for legal obligations, accounting, disputes or protecting legal rights.

Information may also be disclosed at your request or in connection with a lawful business sale or restructuring, subject to applicable safeguards.

7. Shopify and its services

Shopify processes personal information when you visit and buy from our store. For some services it acts on our behalf; for certain consumer and enhanced services it acts as an independent controller.

Where Shopify Network Intelligence is enabled, Shopify can combine information about interactions with our store, other merchants and Shopify to provide enhanced services, including improvements, fraud prevention and advertising. Information may be shared with Shopify and service providers in other countries, subject to applicable consent and opt-out requirements.

For details and choices concerning Shopify's own processing, visit the Shopify Consumer Privacy Policy and Shopify Privacy Portal. You can use the portal to exercise applicable rights, including withdrawing consent or objecting to Shopify's use of information for enhanced services.

External websites and social-media platforms have their own privacy practices. Review their policies when using those services.

8. International processing

Our service providers and fulfilment partners may process information outside your country, including outside Norway, the European Economic Area and the United Kingdom. Processing locations depend on the provider and the fulfilment route for your order.

Shopify's international processing can include Canada, the United States and Singapore. For relevant European transfers, Shopify describes safeguards including approved Binding Corporate Rules, adequacy decisions and Standard Contractual Clauses, depending on the transfer. Details are available in its Data Processing Addendum and Privacy Policy.

Other providers' processing locations and transfer arrangements depend on the service and order concerned. Contact us for details of the destinations and safeguards relevant to your information, including how to obtain a copy.

9. How long we keep information

• Order and payment records: through fulfilment, returns and any dispute, and for the statutory accounting and tax retention periods applying to those records.
• Support messages: until the enquiry is resolved, with relevant evidence retained for any related warranty, complaint or legal-claim period.
• Account details: while the account remains in use, with records required for completed purchases or legal obligations retained separately after closure.
• Marketing and consent records: while the relevant permission is relied upon and for the period needed to demonstrate compliance. A limited suppression record may be kept after an opt-out to prevent further unwanted marketing.

Cookie and technical-data retention depends on the particular technology and its purpose. Ongoing disputes or legal requirements can extend relevant retention periods. Information no longer required is deleted or anonymised; records retained only for legal reasons are restricted to those purposes.

10. Your rights and choices

Subject to applicable law, you may request access to your information, correction of inaccuracies, deletion, or restrictions on its use. Deletion may not cover records we must retain by law. You may request a portable copy where processing is automated and based on consent or a contract.

You may object to direct marketing at any time. You may also object to processing based on legitimate interests because of your particular circumstances, and withdraw consent where we rely on it.

Depending on applicable law, advertising disclosures may qualify as a “sale” or “sharing” of personal information or as targeted advertising. You may exercise applicable opt-out rights through available store privacy controls or by emailing a privacy opt-out request. For Shopify's own advertising processing, use its Privacy Portal.

Shopify's integrated privacy tools support Global Privacy Control signals for opting out of advertising-related data sharing. These signals are different from standard browser “Do Not Track” signals, to which Shopify does not provide a specific response. You can also submit your choice through the privacy controls or email link above.

To exercise your rights, email support@vacorax.com. We may request proportionate information to verify your identity or a representative's authority. We respond within applicable legal deadlines and do not unlawfully discriminate against you for exercising your rights. If a request is refused, you may ask for a review and exercise any applicable appeal right.

You can unsubscribe from promotional emails using their unsubscribe link. Necessary order, delivery, refund and security messages may still be sent.

11. Children and security

Our store is intended for adults. We do not knowingly collect children's information unlawfully or knowingly sell or share information about anyone under 16 for targeted advertising. A parent or guardian who believes a child has provided information can contact us for review and, where appropriate, deletion.

We use reasonable technical and organisational measures to protect personal information. No system or transmission method is completely secure. Please share only information needed for your purchase or support request.

12. Complaints and policy updates

You can raise privacy concerns with our support email. You also have the right to complain to the relevant data-protection authority, including Datatilsynet in Norway or another competent authority where you live, work or believe a breach occurred.

We may update this policy as our services, practices or legal requirements change. The date above identifies the latest revision. We provide additional notice of significant changes and request new consent where required.

13. Data controller and contact