Privacy Policy

Last updated: 24 October 2026

1. Introduction

Norman (“we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, contact us, enquire about our vehicles or services, or otherwise interact with us.

We process personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable laws of the Republic of Latvia.

2. Who We Are

The Norman brand and the activities presented on this website are operated through the following legal entity:

Sabiedrība ar ierobežotu atbildību “Latvijas atradnes”

Registration number: 40103165203

Registered address: Cēsu iela 31 k-3, Rīga, LV-1012, Latvia.

VAT number: LV40103165203.

For the purposes of applicable data protection legislation, Sabiedrība ar ierobežotu atbildību “Latvijas atradnes” acts as the data controller where it determines the purposes and means of processing personal data.

Contact email: info@norman-auto.com
Website: www.norman-auto.com..

3. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with our website:

Contact information: Your name, email address, telephone number and company name, if provided.

Enquiry information: Information included in your messages, project descriptions, vehicle enquiries, requests for bespoke components or other services, and any additional information you voluntarily provide.

Technical information: Information such as your IP address, browser type, device information and website usage data, where collected through our website or its service providers.

Cookie and analytics information: Information collected through cookies and similar technologies, subject to applicable consent requirements.

Communication preferences: Your preferences regarding marketing communications and any consent provided or withdrawn.

Please do not submit sensitive personal data through our website unless it is necessary and specifically requested.

4. How We Collect Personal Data

We may collect personal data:

• Directly from you when you contact us by email, telephone or through a website form.
• When you request information about Norman vehicles, coachbuilding projects, bespoke components or related services.
• Automatically through website technologies, such as server logs and cookies, where applicable.
• From other sources where permitted by law and where necessary for a legitimate business purpose.

5. Purposes and Legal Bases for Processing

We process personal data only where a valid legal basis exists.

Depending on the circumstances, we may process personal data for the following purposes:

Responding to enquiries and providing information

To respond to your questions, discuss potential projects and provide requested information.

Legal basis: Taking steps at your request before entering into a contract, or our legitimate interests in managing business enquiries, as applicable.

Managing projects and business relationships

To communicate with prospective and existing clients, prepare proposals, manage projects and fulfil contractual obligations.

Legal basis: Taking steps before entering into a contract or performing a contract.

Operating and improving our website

To maintain website functionality, analyse performance where permitted, improve user experience and troubleshoot technical issues.

Legal basis: Our legitimate interests, or your consent where required by law.

Website security and misuse prevention

To protect our website, systems and business against unauthorised access, fraud and malicious activity.

Legal basis: Our legitimate interests and, where applicable, legal obligations.

Marketing communications

To send relevant news, updates or promotional communications where permitted by applicable law.

Legal basis: Consent or another lawful basis where expressly permitted by applicable legislation.

Legal and regulatory compliance

To comply with applicable legal obligations and establish, exercise or defend legal claims.

Legal basis: Compliance with a legal obligation or our legitimate interests, as applicable.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Whether You Must Provide Personal Data

Providing personal data is generally voluntary. However, if you wish us to respond to an enquiry or take steps towards a potential project, we may need certain contact details and information about your request.

If you do not provide the necessary information, we may be unable to respond to your enquiry or provide the requested service.

7. Sharing of Personal Data

We do not sell personal data.

Where necessary for the purposes described in this Policy, we may share personal data with trusted service providers, including:

• Website hosting and technical support providers.
• Email and business communication service providers.
• Website analytics providers, where applicable.
• Professional advisers, including legal and accounting advisers.
• Public authorities or other recipients where disclosure is required by law.

Where service providers process personal data on our behalf, we take appropriate steps to ensure that applicable data protection requirements are met.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (“EEA”), we will ensure that the transfer complies with applicable data protection legislation.

Depending on the circumstances, this may involve an adequacy decision adopted by the European Commission or appropriate safeguards, such as Standard Contractual Clauses.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account the nature of the information, the relationship with the individual, applicable legal requirements and the need to establish, exercise or defend legal claims.

Enquiry and correspondence data will be retained for the period necessary to manage the enquiry and any resulting business relationship, and for a reasonable period afterwards where justified.

Contractual, accounting and other business records will be retained for the periods required by applicable law.

Where processing is based on consent, we will cease the relevant processing when consent is withdrawn, unless another lawful basis applies.

Specific retention periods may vary depending on the category of personal data and the circumstances of its processing.

When personal data is no longer required, it will be securely deleted or anonymised, where appropriate.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential website functionality, remember preferences, analyse website traffic or provide other features.

Strictly necessary cookies may be used where required to operate the website.

Where consent is required, non-essential cookies and similar technologies will only be activated after you have given your consent. You can manage your preferences through our cookie settings, where available.

You may also be able to manage cookies through your browser settings. Disabling certain cookies may affect website functionality.

Further information about the cookies used on this website, their purposes and retention periods should be provided in our Cookie Policy or cookie settings.

11. Your Data Protection Rights

Subject to applicable law, you may have the right to:

• Request access to your personal data.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Request data portability where the legal requirements are met.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, please contact us using the contact details provided in this Policy.

We may need to verify your identity before responding to a request. We will respond within the time limits established by applicable law.

In Latvia, the competent data protection supervisory authority is the Data State Inspectorate (Datu valsts inspekcija).

Website: https://www.dvi.gov.lv/

12. Direct Marketing

Where permitted by law, we may use your contact details to send information about Norman projects, vehicles, services or news.

Where consent is required, we will obtain it before sending such communications.

You may opt out of marketing communications at any time by using the unsubscribe mechanism provided or by contacting us directly.

We will not use your personal data for unrelated marketing purposes without an appropriate legal basis.

13. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental loss, destruction, alteration, unauthorised disclosure or access.

However, no method of electronic transmission or data storage can be guaranteed to be completely secure.

14. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices, content or security of third-party websites. We encourage you to review their privacy policies before providing personal data to them.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business, website functionality or applicable legislation.

The latest version will be published on this page, together with the date of the most recent update.

16. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Sabiedrība ar ierobežotu atbildību “Latvijas atradnes”

Registered address: Cēsu iela 31 k-3, Rīga, LV-1012, Latvia.

Registration number: 40103165203.

Email: info@norman-auto.com
Website: www.norman-auto.com..