Privacy policy

Last updated: 17th August 2026

Monde Group AS ("Monde Group", "we", "us", "our"), headquartered at 5550 Hinderlivegen, Sveio, Norway, operates the Opsando.com online shop (the "Services"). This Privacy Policy explains how we collect, use, store, share and protect your personal information.

Because Monde Group is established in Norway, an EEA member state, we handle personal information in line with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR) as applied in Norway. Additional rules apply to our local storefronts — see the dedicated section near the end of this policy. By using the Services you acknowledge you have read this Privacy Policy.

1. Who we are (data controller)

Monde Group AS is the data controller for personal information collected through the Services.

Contact for privacy matters: privacy@opsando.com

2. Personal information we collect

• Contact details: name, billing address, shipping/collection address, phone number, email.
• Financial and payment information: payment method, transaction details, and (for sellers/payouts) bank or mobile-money details.
• Account information: username, password, preferences, store credit balance and history.
• B2B account information: business registration and incorporation documents, tax identification number, authorised contact details, and information about your business's intended use of purchases (Terms of Service, clause 3.2).
• Transaction information: items viewed, added to cart or wishlist, purchased, returned or cancelled.
• Communications: information you provide when contacting support.
• Device and usage information: device, browser, network and IP address, and how you interact with the Services, including via cookies.

3. Where we get your personal information

Directly from you (account creation, purchases, B2B applications, support contact); automatically through your device and cookies; from our service providers; and, where permitted by law, from partners or other third parties (e.g., business registries, for B2B account verification).

4. Our lawful basis for processing

We process personal information only where applicable law permits, including: with your consent; because processing is necessary to perform our contract with you (e.g., to fulfil an order or verify a B2B account); to comply with a legal obligation (e.g., export/customs, tax, or sanctions screening); or for our legitimate interests (such as fraud prevention and account security), balanced against your rights. Where we rely on consent, you may withdraw it at any time.

5. How we use your personal information

• Providing the Services: creating and managing accounts, verifying B2B applications, processing payments, fulfilling and delivering orders (including international shipments), managing store credit, handling returns and refunds.
• Compliance: screening for export control/sanctions compliance, tax reporting, and responding to lawful regulatory requests.
• Security and fraud prevention: authenticating accounts and securing payments.
• Communications: support, order and account updates.
• Marketing: where you have opted in or as otherwise permitted (see clause 9), which you may opt out of at any time.

6. How we share your personal information

• With Shopify and other service providers (hosting, payment processing, analytics, customer support, cloud storage, freight forwarders and delivery carriers).
• With customs authorities, freight forwarders, and import/export compliance providers, to the extent necessary to ship your order internationally.
• With marketing partners, where you have not opted out and as permitted by law.
• With our group companies, as needed to operate the Services in a particular market and fulfil orders there.
• Where you direct or consent to it, in connection with a business transaction (e.g., merger or group reorganisation), or to comply with the law or enforce our terms.

We do not sell your personal information to third parties for their own marketing purposes.

7. Relationship with Shopify

The Services are hosted by Shopify, which processes personal information about your use of the Services in order to provide and improve them. In these circumstances Shopify acts as a processor for us, and in its own right for certain enhanced features. See https://privacy.shopify.com.

8. International data transfers

As an EEA-based company, Monde Group transfers personal information internationally (including to Shopify's infrastructure and other service providers) in accordance with GDPR transfer mechanisms, such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Additional localisation rules apply to our local storefronts — see the dedicated section near the end of this policy.

9. Marketing and electronic communications

Marketing communications are sent on an opt-in consent basis in line with GDPR, or, where applicable local law differs, that local standard. Every marketing message identifies us and includes an opt-out option; we stop marketing once you opt out, though we may still send non-marketing service messages about your account, orders, and transactions.

10. Cookies and similar technologies

We and our providers use cookies and similar technologies to operate the Services, remember preferences, measure usage, and support advertising, consistent with applicable cookie-consent requirements (including EU/EEA rules on non-essential cookies). You can manage cookies via your browser and, where offered, our cookie controls.

11. Security and data breaches

We use reasonable technical and organisational measures to protect personal information, but no system is completely secure. If a breach affecting your personal data occurs, we will notify the relevant supervisory authority within the applicable statutory timeframe — the Norwegian Data Protection Authority (Datatilsynet) under GDPR (72 hours) as our default standard — and will notify affected individuals where required. A shorter statutory timeframe applies to our local storefronts — see the dedicated section near the end of this policy.

12. How long we keep your information

We retain personal information only as long as needed for the purposes in this policy, including providing the Services, complying with legal, tax and export-compliance obligations, resolving disputes, and enforcing our agreements. When no longer needed, we securely delete or anonymise it.

13. Your rights

Subject to applicable law and any conditions or exceptions in it, you have the right to: be informed about how we process your data; access it; have inaccurate or incomplete data corrected; request deletion; object to or restrict certain processing; receive a copy of your data and, where applicable, have it transferred (data portability); and withdraw consent where we rely on it.

To exercise these rights, contact us using the details in clause 17. We may need to verify your identity. We will respond within the time required by applicable law and will not discriminate against you for exercising your rights.

14. Children

The Services are intended for adults. You must be at least 18 years old to hold an account or buy. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Complaints

Contact us first using the details below so we can try to resolve your concern. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). An additional complaints route applies to our local storefronts — see the dedicated section below.

16. Local storefronts

In certain markets, we operate a local storefront alongside the International storefront, and additional privacy rules may apply to personal information collected there, reflecting local data protection law. This section sets out those additional rules, organised by market below. We may add further local storefronts, each with its own subsection, as we expand into new markets.

16.1 Zambia

Additional rules apply to personal information collected through the Zambia storefront, reflecting Zambia's Data Protection Act No. 3 of 2021 ("DPA").

Local operations. Certain processing for the Zambia storefront is carried out by our Zambia group company, which acts as either a joint controller or processor supporting Monde Group's Zambia operations, depending on the activity (e.g., local fulfilment, in-country regulatory filings).

Data localisation. Under Part X of the DPA, personal data relating to individuals in Zambia is, as a rule, required to be processed and stored on servers located in Zambia. For Zambia storefront users, we structure our processing to take this requirement into account and rely on the transfer grounds the DPA permits (including consent together with an approved transfer mechanism, or Commissioner approval) where data must nonetheless leave Zambia, for example because Shopify's infrastructure is outside Zambia.

Breach notification. For Zambia storefront users, we will also notify Zambia's Office of the Data Protection Commissioner of a qualifying breach within the DPA's required timeframe (currently 24 hours).

Complaints. Zambia storefront users may also lodge a complaint with Zambia's Office of the Data Protection Commissioner.

Marketing. For Zambia storefront users, marketing communications also follow the Electronic Communications and Transactions Act, 2021 and the DPA.

17. Contact us

Monde Group AS 5550 Hinderlivegen, Sveio, Norway Email: privacy@opsando.com

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy here, update the "Last updated" date, and give notice where required by law.