Privacy policy

NORTH OUTDOOR – PRIVACY POLICY

This privacy policy explains how we process personal data in our online store and related services in accordance with the EU General Data Protection Regulation (GDPR 2016/679).

1. Data controller

North Outdoor / PYKA Oy
Kelatie 11, 90620 Oulu, Finland
Business ID: 1976355-0
Email: shop@northoutdoor.com
Phone: +358 46 920 7128

2. Contact for data protection matters

We have not appointed a separate data protection officer. Data protection matters are handled by North Outdoor customer service (shop@northoutdoor.com).

3. Name of the register

Customer register

4. Legal bases for processing personal data

Performance of a contract (GDPR Art. 6(1)(b)): delivery of orders, payment processing and customer service.
Consent (GDPR Art. 6(1)(a)): newsletters and SMS marketing, marketing cookies, targeting of direct marketing, and the profile information and survey responses you provide voluntarily.
Legal obligation (GDPR Art. 6(1)(c)): retention of records as required by accounting and tax legislation.
Legitimate interest (GDPR Art. 6(1)(f)): ensuring the security of the online store, analytics, developing the customer experience and our business, and operating the loyalty programme.

5. Personal data we process

We process the following categories of data. Not all data is collected from every customer – some of it only arises if a customer, for example, joins the loyalty programme or responds to a survey.

Basic and contact details: name, email address, postal address, phone number, and the language and country of the customer relationship.
Order details: order, delivery and return history and payment method details. We do not store payment card numbers – they are processed in the payment provider’s system.
Voluntary profile information: gender, date of birth and age. Providing these is voluntary, and they are used to tailor content and offers.
Survey and feedback data: responses to customer surveys, such as willingness to recommend (NPS), satisfaction ratings, reasons behind purchase decisions, interests and open-ended answers in your own words. The register also contains responses from previously conducted surveys.
Product reviews: the reviews you have submitted and their ratings. The register also contains review data collected through a previously used review service.
Loyalty programme data: points balance, tier, referral codes and links, and the date of joining the programme.
Marketing preferences: newsletter and SMS permissions and when they were given, as well as interest group and segmentation markers.
Customer service communication: your enquiries and their attachments.
Technical data: IP address, browser and device information, country of location and information about the use of the website.
Website usage events: page views, product views and cart events, which we store in our own event data store. Without analytics consent, events are stored without identifying information.
Derived data: estimates calculated by our systems, such as a forecast of the timing of your next order and an activity score.

6. Sources of data

From you: when placing an order, creating an account, subscribing to the newsletter, responding to a survey, submitting a review or contacting customer service.
From the use of the website: through cookies and similar technologies.
Calculated by our systems: derived data is generated from your previous customer history.

7. Disclosure of data and third-party services

We use service providers that process personal data on our behalf as processors and with whom data processing agreements (DPA) have been concluded:

E-commerce platform: Shopify
Email and SMS marketing: Klaviyo
Customer service and on-site sales promotion: Gorgias
Customer surveys: Zigpoll
Loyalty programme and reviews: Growave
Reviews and review invitations: Trustpilot, Trusted Shops
Affiliate marketing: Adtraction
Analytics and advertising: Google (Analytics, Ads, Merchant Center), Meta (Facebook, Instagram), Pinterest, Microsoft Clarity
Own event data store: Supabase
Functional services of the online store: Orbe (location and market routing), Ovido (digital product passport), Hextom (campaign messages), SC Easy Redirects (redirects), Google Fonts (typefaces)
Payment processing: e.g. Klarna, PayPal, Shop Pay
Logistics and shipment management: DHL and other carriers, and Packrooster
Returns: ReturnZap
Enterprise resource planning: NetSuite
Store maintenance tools: systems we use to maintain product and order data and to monitor our business

You can read how Google processes data on behalf of advertisers: business.safety.google/privacy.

The register also contains data accumulated through services used previously. These services are no longer used to collect new data.

We also disclose data to authorities where required by law. We do not sell personal data, nor do we disclose it to third parties for their own purposes.

8. Cookies and similar technologies

We use cookies and other identifiers stored in the browser. We use the Consentmo tool to manage consents, and you can change your settings at any time via the Cookie settings link at the bottom of the page. Technically necessary cookies do not require consent (Finnish Act on Electronic Communications Services 917/2014, section 205).

Necessary: shopping cart, login, language and currency selection, security and remembering your cookie choices. Always in use.
Functional: recently viewed products, loyalty programme session, language setting, market routing and content ordering.
Analytics: Shopify, Google Analytics, Microsoft Clarity and our own event data store.
Marketing: Google Ads, Meta, Pinterest, Klaviyo and Adtraction.

Functional, analytics and marketing cookies require consent. The lifetime of cookies ranges from the duration of the session to a maximum of 13 months, and you can delete them at any time in your browser settings.

9. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by law.

Order and accounting records: 6 years from the end of the calendar year in which the financial year ended (Accounting Act).
Customer account and order history: for the duration of the customer relationship. You can request deletion of your account at any time.
Marketing permissions and newsletter subscriptions: until you withdraw your consent or the customer relationship ends.
Voluntary profile information and segmentation markers: for the duration of the customer relationship or until you request their deletion.
Survey and feedback data: for as long as needed to develop the customer experience. Responses used for statistical purposes are anonymised.
Product reviews: for as long as the review is published in the online store.
Loyalty programme data: for the duration of programme membership.
Customer service messages: for as long as needed to manage the customer relationship and handle any complaints.
Website analytics data: in accordance with the service provider’s retention policy.

10. Transfers of data outside the EU and EEA

Some of the service providers we use (including Shopify, Google, Meta, Pinterest, Microsoft Clarity and Klaviyo) may transfer personal data outside the European Union and the European Economic Area, particularly to the United States. Transfers are based on the Standard Contractual Clauses (SCC) approved by the European Commission and, where applicable, the EU–US Data Privacy Framework.

11. Targeted marketing and profiling

We target marketing and personalise content using, for example, purchase history, interests, the profile information you have provided voluntarily and derived data calculated by our systems. In practice, this means you are more likely to see products and messages that interest you. We may also arrange the content of the online store according to the products you have browsed on the site. This is based on information stored in your browser and does not hide any products.

We do not make automated decisions about you that have legal effects or similarly significantly affect you (GDPR Art. 22).

You can object to direct marketing and related profiling at any time (GDPR Art. 21) by withdrawing your consent via the link in the newsletter or by contacting our customer service.

12. Rights of the data subject

You have the right to:

access your data (GDPR Art. 15)
rectify inaccurate data (GDPR Art. 16)
request erasure of your data (GDPR Art. 17)
restrict processing (GDPR Art. 18)
data portability (GDPR Art. 20)
object to processing, including direct marketing (GDPR Art. 21)
withdraw your consent at any time

Requests: shop@northoutdoor.com. We will respond to your request within one month.

13. Right to lodge a complaint with a supervisory authority

If you consider that the processing of your personal data infringes the data protection regulation, you can lodge a complaint with the supervisory authority:

Office of the Data Protection Ombudsman (Finland)
Lintulahdenkuja 4, 00530 Helsinki
Postal address: PL 800, 00531 Helsinki
tietosuoja.fi

You can also lodge a complaint with the supervisory authority of your country of residence.

14. Changes to this privacy policy

We may update this privacy policy as our operations or legislation change. We will announce material changes on our website.

Last updated: 18 September 2026