Privacy policy

NORTH OUTDOOR – PRIVACY POLICY

This privacy policy explains how we process personal data in our online store and related services in accordance with the EU General Data Protection Regulation (GDPR 2016/679).

1. Data controller

North Outdoor / PYKA Oy
Kelatie 11, 90620 Oulu, Finland
Business ID: 1976355-0
Email: shop@nurthoutdoor.com
Phone: +358 46 920 7128

2. Contact for data protection matters

We have not appointed a separate data protection officer. Data protection matters are handled by North Outdoor customer service (shop@nurthoutdoor.com).

3. Name of the register

Customer register

4. Legal bases for processing personal data

  • Performance of a contract (GDPR Art. 6(1)(b)): delivery of orders, payment processing and customer service.
  • Consent (GDPR Art. 6(1)(a)): newsletters and SMS marketing, marketing cookies, targeting of direct marketing, and the profile information and survey responses you provide voluntarily.
  • Legal obligation (GDPR Art. 6(1)(c)): retention of records as required by accounting and tax legislation.
  • Legitimate interest (GDPR Art. 6(1)(f)): ensuring the security of the online store, analytics, developing the customer experience and our business, and operating the loyalty programme.

5. Personal data we process

We process the following categories of data. Not all data is collected from every customer – some of it only arises if a customer, for example, joins the loyalty programme or responds to a survey.

  • Basic and contact details: name, email address, postal address, phone number, and the language and country of the customer relationship.
  • Order details: order, delivery and return history and payment method details. We do not store payment card numbers – they are processed in the payment provider’s system.
  • Voluntary profile information: gender, date of birth and age. Providing these is voluntary, and they are used to tailor content and offers.
  • Survey and feedback data: responses to customer surveys, such as willingness to recommend (NPS), satisfaction ratings, reasons behind purchase decisions, interests and open-ended answers in your own words. The register also contains responses from previously conducted surveys.
  • Product reviews: the reviews you have submitted and their ratings. The register also contains review data collected through a previously used review service.
  • Loyalty programme data: points balance, tier, referral codes and links, and the date of joining the programme.
  • Marketing preferences: newsletter and SMS permissions and when they were given, as well as interest group and segmentation markers.
  • Customer service communication: your enquiries and their attachments.
  • Technical data: IP address, browser and device information, country of location and information about the use of the website.
  • Website usage events: page views, product views and cart events, which we store in our own event data store. Without analytics consent, events are stored without identifying information.
  • Derived data: estimates calculated by our systems, such as a forecast of the timing of your next order and an activity score.

6. Sources of data

  • From you: when placing an order, creating an account, subscribing to the newsletter, responding to a survey, submitting a review or contacting customer service.
  • From the use of the website: through cookies and similar technologies.
  • Calculated by our systems: derived data is generated from your previous customer history.

7. Disclosure of data and third-party services

We use service providers that process personal data on our behalf as processors and with whom data processing agreements (DPA) have been concluded:

  • E-commerce platform: Shopify
  • Email and SMS marketing: Klaviyo
  • Customer service and on-site sales promotion: Gorgias
  • Customer surveys: Zigpoll
  • Loyalty programme and reviews: Growave
  • Reviews and review invitations: Trustpilot
  • Affiliate marketing: Adtraction
  • Analytics and advertising: Google (Analytics, Ads, Merchant Center), Meta (Facebook, Instagram), Pinterest, Microsoft Clarity
  • Own event data store: Supabase
  • Functional services of the online store: Orbe (location and market routing), Ovido (digital product passport), Hextom (campaign messages), SC Easy Redirects (redirects), Google Fonts (typefaces)
  • Payment processing: e.g. Klarna, PayPal, Shop Pay
  • Logistics and shipment management: DHL and other carriers, and Packrooster
  • Returns: ReturnZap
  • Enterprise resource planning: NetSuite
  • Store maintenance tools: systems we use to maintain product and order data and to monitor our business

You can read how Google processes data on behalf of advertisers: business.safety.google/privacy.

The register also contains data accumulated through services used previously. These services are no longer used to collect new data.

We also disclose data to authorities where required by law. We do not sell personal data, nor do we disclose it to third parties for their own purposes.

Integration of the Trusted Shops Trustbadge / other widgets (joint controllership)

Trusted Shops widgets are integrated in this website to display Trusted Shops services (e.g. trust mark, collected reviews) and to offer Trusted Shops products to buyers after they place an order. This serves to protect our legitimate interests in optimal marketing by enabling secure shopping in accordance with Art. 6(1)(f) GDPR, which outweigh in the context of a balancing of interests. The Trustbadge and the services advertised with it are an offer of Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne, Germany ("Trusted Shops"), with whom we are jointly responsible for data protection in accordance with Art. 26 GDPR. Within the scope of this privacy policy, we inform you below about the essential contents of the arrangement pursuant to Art. 26(2) GDPR.

When interacting with the Trustbadge AI+, session cookies are set to store the login status and to display the so-called Welcome Layer. This displays the data of the respective online shop, including company information, reviews, information on the existence of buyer protection and the #trstd secret.

To recognise logged-in users, a cookie is set that is stored for a maximum of 400 days after login. In addition, session cookies are set to send push notifications when the app is used, provided the user has consented to this.

This is necessary to ensure that Trusted Shops can provide the digital service you have requested. Trusted Shops is responsible for the data processing when interacting with the Trustbadge AI+.

Within the framework of the joint controllership existing between us and Trusted Shops SE, please contact Trusted Shops preferably using the contact options given in their privacy information for data protection questions and to assert your rights. Irrespective of this, you can always contact the controller of your choice. Your request will then, if necessary, be forwarded to the other controller for a response.

1. Data processing when integrating the Trustbadge/other widgets

The Trustbadge is provided by a US CDN provider (Content Delivery Network). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which can be accessed here for the USA. Service providers from the USA are generally certified under the EU-US Data Privacy Framework (DPF). Further information is available here. If service providers are not certified under the DPF, standard contractual clauses have been concluded as suitable guarantees.

When the Trustbadge is called up, the web server automatically saves a so-called server log file, which also contains your IP address, the date and time of the call-up, the transferred data volume and the requesting provider (access data) and documents the call-up. The IP address is anonymised immediately after collection so that the stored data cannot be assigned to you personally. The anonymised data is used in particular for statistical purposes and for error analysis.

2. Data processing after order completion

After the order is completed, the order information (total order amount, order ID, purchased product if applicable) and your email address, hashed with a cryptological one-way function, are transmitted to Trusted Shops. The legal basis is Art. 6(1)(f) GDPR. This serves to check whether you are already registered for Trusted Shops services and is therefore necessary to fulfil our and Trusted Shops’ overriding legitimate interests in providing the buyer protection linked to the specific order and the transactional review services in accordance with Art. 6(1)(f) GDPR. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will subsequently be given the opportunity to do so for the first time. Further processing after registration also depends on the contractual agreement with Trusted Shops. If you do not register, all transmitted data will be automatically deleted by Trusted Shops and a personal reference is then no longer possible.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1)(f) GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the EU Commission, which can be accessed here for the USA and here for Israel. Service providers from the USA are generally certified under the EU-US Data Privacy Framework (DPF). Further information is available here. If service providers are not certified under the DPF, standard contractual clauses have been concluded as suitable guarantees.

8. Cookies and similar technologies

We use cookies and other identifiers stored in the browser. We use the Consentmo tool to manage consents, and you can change your settings at any time via the Cookie settings link at the bottom of the page. Technically necessary cookies do not require consent (Finnish Act on Electronic Communications Services 917/2014, section 205).

  • Necessary: shopping cart, login, language and currency selection, security and remembering your cookie choices. Always in use.
  • Functional: recently viewed products, loyalty programme session, language setting, market routing and content ordering.
  • Analytics: Shopify, Google Analytics, Microsoft Clarity and our own event data store.
  • Marketing: Google Ads, Meta, Pinterest, Klaviyo and Adtraction.

Functional, analytics and marketing cookies require consent. The lifetime of cookies ranges from the duration of the session to a maximum of 13 months, and you can delete them at any time in your browser settings.

9. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by law.

  • Order and accounting records: 6 years from the end of the calendar year in which the financial year ended (Accounting Act).
  • Customer account and order history: for the duration of the customer relationship. You can request deletion of your account at any time.
  • Marketing permissions and newsletter subscriptions: until you withdraw your consent or the customer relationship ends.
  • Voluntary profile information and segmentation markers: for the duration of the customer relationship or until you request their deletion.
  • Survey and feedback data: for as long as needed to develop the customer experience. Responses used for statistical purposes are anonymised.
  • Product reviews: for as long as the review is published in the online store.
  • Loyalty programme data: for the duration of programme membership.
  • Customer service messages: for as long as needed to manage the customer relationship and handle any complaints.
  • Website analytics data: in accordance with the service provider’s retention policy.

10. Transfers of data outside the EU and EEA

Some of the service providers we use (including Shopify, Google, Meta, Pinterest, Microsoft Clarity and Klaviyo) may transfer personal data outside the European Union and the European Economic Area, particularly to the United States. Transfers are based on the Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework.

11. Targeted marketing and profiling

We target marketing and personalise content using, for example, purchase history, interests, the profile information you have provided voluntarily and derived data calculated by our systems. In practice, this means you are more likely to see products and messages that interest you. We may also arrange the content of the online store according to the products you have browsed on the site. This is based on information stored in your browser and does not hide any products.

We do not make automated decisions about you that have legal effects or similarly significantly affect you (GDPR Art. 22).

You can object to direct marketing and related profiling at any time (GDPR Art. 21) by withdrawing your consent via the link in the newsletter or by contacting our customer service.

12. Rights of the data subject

You have the right to:

  • access your data (GDPR Art. 15)
  • rectify inaccurate data (GDPR Art. 16)
  • request erasure of your data (GDPR Art. 17)
  • restrict processing (GDPR Art. 18)
  • data portability (GDPR Art. 20)
  • object to processing, including direct marketing (GDPR Art. 21)
  • withdraw your consent at any time

Requests: shop@nurthoutdoor.com. We will respond to your request within one month.

13. Right to lodge a complaint with a supervisory authority

If you consider that the processing of your personal data infringes the data protection regulation, you can lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman (Finland)
Lintulahdenkuja 4, 00530 Helsinki
Postal address: PL 800, 00531 Helsinki
tietosuoja.fi

You can also lodge a complaint with the supervisory authority of your country of residence.

14. Changes to this privacy policy

We may update this privacy policy as our operations or legislation change. We will announce material changes on our website.

Last updated: 30 October 2026