Procurement question pack

For UK B2B buyers whose procurement team needs answers on a standard supplier review form. The pack covers the questions we get asked most, with our written response. Designed to be lifted into a procurement portal directly.

For anything not covered here, hello@normamade.com gets a written response within 48 hours.

Sender of record: [LEGAL_ENTITY_NAME], a company registered in England and Wales (company number [COMPANIES_HOUSE_NUMBER]), registered office at [REGISTERED_ADDRESS]. Trading as Norma.

1. Company information

Legal entity: [LEGAL_ENTITY_NAME] Trading name: Norma Registered address: [REGISTERED_ADDRESS] Company number: [COMPANIES_HOUSE_NUMBER] VAT number: [VAT_NUMBER] ICO registration: [ICO_REGISTRATION_NUMBER] Year founded: 2026 Employees: [HEADCOUNT] Insurance: Public and product liability cover at £[INSURANCE_LIMIT] through [INSURER]; certificate available on request.

2. Materials and supply chain

What materials do you use across the catalogue?

Apparel: GOTS certified organic cotton (180gsm tees and above; 350gsm hoodies and above), GRS certified recycled polyester blends where used, EU and UK woven and milled.

Drinkware: ceramic (lead and cadmium tested), stainless steel (food grade 18/8), enamel over carbon steel.

Stationery: FSC certified paper for notebooks and cards; recycled cover board where applicable.

Bags: 8oz organic cotton canvas (GOTS), felt blends (recycled wool where stated).

Where are products manufactured?

Apparel base garments: cut and sewn in Portugal, Turkey, and the UK (varies by product). Print application: UK for UK and Ireland orders, EU for EU bound parcels. Drinkware: UK and Portugal. Stationery: UK and Italy.

The specific origin per SKU is printed on the product page.

Do you provide chain of custody documentation?

Yes. For GOTS and GRS certified products, the certification number per supplier is available on request, and verifiable on the relevant public register (Global Standard for GOTS, Textile Exchange for GRS and RCS).

What is your Modern Slavery Act statement?

Norma operates under the Modern Slavery Act 2015 framework. Our statement is published at normamade.com/legal/modern-slavery and refreshed annually. Direct suppliers are required to comply with our supplier code of conduct, which prohibits forced labour, child labour, and other forms of exploitation. Tier 2 supplier mapping is reviewed annually.

3. Sustainability and ESG

What is your environmental policy?

Published at normamade.com/legal/sustainability. Headline commitments: print on demand fulfilment (no warehousing wastage), kraft and paper packaging only (no plastic polybags), GOTS or GRS certified inputs for apparel, FSC certified paper for stationery.

Do you measure Scope 1, 2, and 3 emissions?

Scope 1 and 2 are measured annually under the SECR framework where applicable. Scope 3 is measured by category for the most material lines (raw materials, inbound shipping, outbound shipping, packaging). Methodology follows GHG Protocol Corporate Standard guidance. Audited figures are available on request once we hit our first full reporting year.

What is the carbon footprint per product?

Per product LCA is in development. Indicative figures for our highest volume categories:

• Heavyweight cotton tee (UK printed, GOTS cotton): roughly 5.2 to 6.8 kg CO2e per unit
• Heavyweight hoodie (UK printed, GOTS cotton): roughly 14 to 18 kg CO2e per unit
• Hardback A5 notebook (FSC paper, UK printed): roughly 1.1 to 1.6 kg CO2e per unit
• Insulated stainless steel bottle: roughly 4.5 to 6 kg CO2e per unit

These figures will firm up as the LCA programme completes; the methodology is documented in our sustainability report.

What recycled content is in your packaging?

100 percent of outer packaging is FSC certified kraft or recycled card. Paper tape is FSC certified. We do not use plastic polybags, plastic void fill, or plastic mailers anywhere in the chain. Recycled content varies by line; the relevant percentage is on the product page.

Do you have an end of life programme?

A take back programme is in development. Today, our recommendation to customers is to use the standard UK household textile or paper recycling streams for items at end of life. We will publish a return path for repair and material recovery within the first 12 months of operation.

Are you certified by EcoVadis, B Corp, or comparable bodies?

EcoVadis assessment is scheduled for [TBD]. B Corp application is planned for the second year of operation. We do not currently hold either rating.

4. Security and data protection

Are you registered with the ICO?

Yes. Registration number [ICO_REGISTRATION_NUMBER]. Our privacy policy is at normamade.com/legal/privacy.

Do you have a Data Processing Agreement?

Yes. Our standard DPA template is available on request and can be signed before contract execution.

Where is customer data stored?

Most customer data is stored in the UK and EU: Postgres on Neon (eu-west-2 London), object storage on Cloudflare R2 (UK and EU edges), product analytics on PostHog EU cloud. Some sub processors (Stripe, Resend, Sentry) may process data in the US under UK Standard Contractual Clauses and the UK to US Data Bridge. The full sub processor list is at normamade.com/legal/sub-processors.

Do you hold SOC 2, ISO 27001, or similar?

Not at launch. SOC 2 Type 1 is on the roadmap for the first 12 months. Our security controls and posture are documented in our security overview, available on request.

What encryption do you use?

TLS 1.2 or higher in transit (TLS 1.3 preferred). AES-256 at rest for the database. Hashed passwords using bcrypt with a per password salt. Card data is never stored on our systems; payment handling is delegated to Stripe (PCI DSS Level 1).

What is your incident response?

We follow a four step framework: detect, contain, eradicate, recover. Material incidents affecting customer data are notified to the ICO and affected customers within 72 hours of identification, as required by UK GDPR. The incident response policy is available on request.

Do you have a documented Information Security policy?

Yes. Available on request under NDA.

Penetration testing cadence?

Annual third party penetration test (planned within first 12 months of operation). Continuous internal vulnerability scanning via Snyk on dependencies and code.

Backup and recovery?

Database backups are taken hourly with 30 days of point in time recovery. RTO target: 4 hours. RPO target: 1 hour.

5. Legal and compliance

Anti bribery and corruption policy?

We operate under the Bribery Act 2010 framework. Our anti bribery policy is published internally and available on request. Suppliers and contractors must comply with the same standard.

Sanctions screening?

We screen suppliers and high value B2B customers against UK and EU consolidated sanctions lists at onboarding and on a quarterly review cycle.

Tax compliance?

UK VAT registered (VAT number [VAT_NUMBER]). EU OSS / IOSS registered for sales to EU consumers and businesses. All tax filings are current; HMRC compliance is on schedule.

Insurance?

Public and product liability cover at £[INSURANCE_LIMIT] per claim through [INSURER]. Professional indemnity at £[PI_LIMIT]. Certificates available on request.

Standard contract terms?

Our terms of service are at normamade.com/legal/terms. For B2B customers placing orders over £5,000 per year, a master services agreement can be negotiated.

6. Commercial

What are your payment terms?

Standard: payment at point of order via card, Klarna, Apple Pay, or Google Pay. For approved B2B customers, net 30 invoicing is available after a Creditsafe UK assessment. Net 60 is available case by case after 3 to 6 months of positive payment history on net 30.

What is your credit assessment process?

We assess net 30 applications via Creditsafe UK. The check looks at filed accounts, payment history, and other public signals. Decisions are typically returned within 2 working days. Approval is at our discretion based on credit score and limit.

What is your refund policy?

Defects, print errors, wrong items, and damage in transit: tell us within 14 days from delivery for a priority reprint, with a refund available within the statutory 30 day window. Custom designs that the customer approved are otherwise not returnable, since a printed or embroidered item cannot be resold or reused (Consumer Contracts Regulations 2013, made to order exception). Full policy at normamade.com/legal/returns.

SLAs?

Production: 2 to 4 working days. UK delivery: 2 to 3 working days. EU delivery: 3 to 7 working days. International: 5 to 14 working days.

We do not currently offer financial SLA credits but will discuss case by case for enterprise accounts.

Account management?

For B2B accounts placing more than £25,000 per year, we assign a named account contact. For smaller accounts, hello@normamade.com is the primary route, with 1 working day response SLA.

7. Diversity and inclusion

Do you track supplier diversity?

We are in the early stages of supplier diversity tracking. We can supply Tier 1 supplier breakdown on request. Tier 2 mapping is in development.

Equal opportunities policy?

Norma operates under an equal opportunities framework. Recruitment, promotion, and supplier selection processes are conducted without regard to age, disability, gender, race, religion, sexual orientation, or other protected characteristics under the UK Equality Act 2010.

8. References

For procurement teams that require references from comparable accounts, we can supply two B2B customer references on request, subject to those customers' consent. Reference contact details are not published in this pack.

9. Outstanding items (transparent statement)

Things we do not have today, which a procurement reviewer may ask about, and our timeline:

• SOC 2 Type 1: targeted within 12 months of launch
• B Corp certification: year 2 application
• Take back programme (end of life): within 12 months of launch
• Full Scope 3 LCA per product: rolling completion through year 1
• ISO 27001: not on near term roadmap; SOC 2 covers comparable ground for UK and US buyers

If any of these are launch blockers for your procurement review, please raise them at the walkthrough call and we can discuss alternatives or workarounds.

10. Contact

For procurement questions: hello@normamade.com (1 working day response). For security questionnaires: hello@normamade.com (NDA on request). For legal contracts and DPA: hello@normamade.com. For billing and invoicing: hello@normamade.com.

[LEGAL_ENTITY_NAME], [REGISTERED_ADDRESS], United Kingdom.