Controller and contact
The LaRo online shop at shop.laro.fi is operated by Laronorge Henrik Tjarks Schmidt, organisation number 915336795, Vesthagan 60, 1925 Blaker, Norway. This business is the controller for the personal data described here. Contact shop@laro.fi or +47 41460139 with questions or to exercise your rights. Updated 11 November 2026.
Data, purposes and legal bases
We process your name, contact details, delivery and billing addresses, account details, orders, payment status and correspondence to create and manage your account, fulfil purchases, deliver goods and handle purchase enquiries. The legal basis is performance of a contract or steps you request before entering a contract, GDPR Article 6(1)(b). Required fields are marked on the forms; without necessary information we cannot provide the relevant service. Optional information can be omitted. Accounting is based on a legal obligation, Article 6(1)(c). Necessary documentation of legal claims and compliance may be based on legitimate interests, Article 6(1)(f).
Optional services and consent
Product and offer newsletters are based on consent, Article 6(1)(a). This also applies to consent-based processing through the contact form and stock alerts when that feature is offered. We use your email address, information you provide and, where applicable, the selected product for that specific purpose. You can withdraw consent at any time by contacting shop@laro.fi. Newsletters can also be cancelled through the unsubscribe option in the message. Withdrawal does not affect the lawfulness of earlier processing. Purchases do not depend on consent to marketing. Necessary further handling of a purchase enquiry or a legal claim may have another legal basis.
Vehicle selection
When you request a vehicle lookup, the registration number or VIN is sent to the Norwegian Public Roads Administration (Statens vegvesen) to retrieve vehicle data and provide relevant parts suggestions. Vehicle selection is optional. The legal basis is providing the service you request, Article 6(1)(b). The VIN, make, model and a signed vehicle context are stored in your browser's session storage, valid for up to eight hours. You can clear the vehicle selection in the shop or end the session. A pseudonymised identifier based on IP address and guest identifier is used to limit abuse and lookup volume.
Operation, statistics and cookies
The shop processes technical information such as IP address, browser, pages visited, searches, timestamps and errors for operation, security, troubleshooting and internal shop statistics. Our legitimate interest in operating and protecting the shop is the basis under Article 6(1)(f) where applicable; consent is required wherever cookie and similar technology rules require it. Cookies and browser storage support login, the cart, language, currency, display preferences and vehicle selection. You can manage and delete storage in your browser, although necessary functions may then stop working. This notice provides information and does not replace required consent to analytics or marketing.
Recipients and processing outside the EEA
Necessary information is processed by service providers: Hostingpalvelu for hosting, Klarna and Vipps MobilePay for the payment method you select, Fiken for accounting, and Pakkepost and your selected carrier, including Posten or PostNord, for shipping. Hosting, email, backups and system integrations may also involve technical providers, including PrestaShop services. Payment and delivery providers may act as independent controllers for their own purposes. We do not sell your personal data. Information may be disclosed where required by law. The shop is hosted by Hostingpalvelu in Finland. Payment, accounting and other service providers may use subprocessors outside the EEA. Such transfers require a basis under GDPR Chapter V, for example an adequacy decision or EU standard contractual clauses with necessary supplementary safeguards. Contact us for information about specific recipients and transfer safeguards. See also the providers' privacy information linked below.
Retention and security
Data is retained for as long as necessary for its purpose. Accounting records subject to the five-year retention requirement are kept for five years after the end of the financial year. Purchase and enquiry information may be retained as needed for delivery, complaints or establishing, exercising or defending legal claims. Account data is kept while the account is used and you may request erasure; legally required records cannot be erased before the obligation ends. Consent-based lists are retained until consent is withdrawn or the purpose ends. Evidence of consent may be retained where necessary to demonstrate compliance. The need for technical logs and backups is assessed against operation, security and recovery requirements. Access should be restricted to people and providers who need it.
Your rights
You may request access, correction, erasure, restriction and data portability where the applicable conditions are met. You may object to processing based on legitimate interests and always to direct marketing. You may also withdraw consent. Contact shop@laro.fi; we may need to verify your identity and normally respond within one month. You may complain to the Norwegian Data Protection Authority at datatilsynet.no or the supervisory authority where you live in the EEA. If you choose credit or invoice payment, the payment provider may perform credit checks and automated decision-making under its own privacy information. LaRo's parts suggestions are guidance and do not determine your legal rights.