Privacy policy

Last updated: 4 July 2026

NORTH Performance Corporation ("NORTH Performance", "we", "us", or "our") is a corporation registered in Delaware, United States. We operate the websites northperformance.com and headstart.northperformance.com, including all related information, content, features, tools, products and services (collectively, the "Services").

For the purposes of applicable data protection laws (including the EU General Data Protection Regulation and the UK GDPR), NORTH Performance Corporation is the data controller of your personal information, except where this Privacy Policy states that a third party acts as an independent controller.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services, sign up to our waitlist, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described below.

1. What personal information we collect

When we use the term "personal information," we mean information that identifies or can reasonably be linked to you. This does not include anonymised or de-identified information.

Depending on how you interact with the Services, we may collect the following:

  • Contact details — your name, address, billing address, shipping address, phone number, and email address.
  • Waitlist information — your first name, email address, and the date and time of your signup.
  • Financial information — credit and debit card details, payment account information, transaction details, and payment confirmation.
  • Account information — your username, password, security questions, preferences and settings.
  • Transaction information — items you view, add to your cart, purchase, return, exchange, or cancel, and your past transactions.
  • Location data — your IP address and estimated location data derived from it (country, city, and timezone).
  • Device and browser information — your device type, browser, network connection, user agent, and other unique identifiers.
  • Usage information — how and when you interact with or navigate the Services.
  • Attribution data — how you found us, including UTM parameters and referral data.
  • Consent records — a record of any consent you have given us.
  • Communications with us — information you include in messages to our support team or other correspondence.

2. How we collect your information

We may collect personal information from the following sources:

  • Directly from you — when you create an account, make a purchase, join our waitlist, communicate with us, or otherwise provide us with your information.
  • Automatically through the Services — from your device when you use our websites or services, and through cookies and similar technologies (see Section 8).
  • From our service providers — when we engage them to provide services on our behalf and they collect or process your personal information in doing so.
  • From our partners or other third parties — including advertising and analytics partners.

3. Why we collect it and our lawful basis

We collect and process your personal information for the following purposes:

Purpose Lawful basis
To notify you when NORTH Performance launches Consent (given at signup)
To send you pre-launch offers and updates Consent (given at signup)
To process your orders, payments, and account Contract performance
To provide customer support Contract performance / Legitimate interests
To measure and improve our marketing Legitimate interests
To protect our website from spam and abuse Legitimate interests
To understand where our audience is located and tailor communications accordingly Legitimate interests
To detect and prevent fraud or illegal activity Legitimate interests / Legal obligation
To comply with applicable law Legal obligation


For users in the European Economic Area (EEA) and United Kingdom, our lawful basis for processing is your explicit consent where stated, contract performance where applicable, and our legitimate interests otherwise. Where we rely on legitimate interests, we have carried out a balancing test to ensure that our interests are not overridden by your interests or fundamental rights and freedoms.

4. How we use your personal information

Depending on how you interact with us, we may use your personal information to:

  • Provide, tailor, and improve the Services — process payments, fulfil orders, manage your account, arrange shipping, handle returns, remember your preferences, and create a personalised experience for you.
  • Marketing and advertising — send you marketing communications by email or other channels, and show you relevant online advertising based on your activity and preferences.
  • Security and fraud prevention — authenticate your account, detect and investigate fraudulent or malicious activity, and keep the Services secure.
  • Communicate with you — respond to your enquiries, provide customer support, and maintain our business relationship with you.
  • Legal compliance — comply with applicable law, respond to valid legal process, enforce our terms and policies, and participate in legal proceedings where required.

We do not intentionally collect or process sensitive personal information (for example, information about your health, biometric identifiers, or government-issued identification numbers) unless required for a specific, clearly described purpose and permitted by applicable law.

Where we use automated tools to help personalize your experience or our marketing (for example, to group users with similar interests), we do so in a way that does not produce legal or similarly significant effects for you. You can object to this type of processing by contacting us.

5. Who we share your data with

We may disclose your personal information to third parties for legitimate purposes in the following circumstances:

  • When directed or authorised by you — for example, to fulfil a shipment or when you use social media login integrations.
  • With our affiliates or corporate group.
  • In connection with a business transaction such as a merger, acquisition, or bankruptcy, or to comply with applicable legal obligations (including subpoenas and search warrants), enforce our terms, or protect our rights and the rights of our users.

We use the following third-party services, which may receive your personal data:

  • Shopify — Our store is hosted on Shopify, which processes personal information to provide and improve the Services. See the Shopify Consumer Privacy Policy and the Shopify Privacy Portal for details. See also Section 6 below.
  • Meta Platforms (Facebook/Instagram) — We share hashed versions of your email address and name with Meta via their Conversions API for advertising measurement and audience building. Data is transferred under Meta's standard contractual clauses. See Meta's privacy policy at facebook.com/privacy/policy.
  • Google — We use Google Analytics 4 and Google Tag Manager to measure website traffic and user behaviour. See Google's privacy policy at policies.google.com/privacy.
  • Google Ads — We use Google Ads to advertise our products and measure the effectiveness of our advertising campaigns. Google Ads may set cookies on your device to track conversions (such as purchases made after clicking an ad) and to serve relevant ads based on your prior visits to our website. This data is processed by Google Ireland Limited. You can opt out of personalised advertising by visiting Google Ad Settings. For more information, see Google's Privacy Policy. We have enabled Google Analytics Advertising Features, including Google Signals. When you are signed in to a Google account and have Ads Personalisation turned on, Google may link information about your activity on our website with your Google account to enable cross-device measurement, demographics and interests reporting, and personalised advertising. We do not merge personally identifiable information with Google Analytics data. You can opt out via Google Ad Settings at adssettings.google.com, by disabling Ads Personalisation in your Google account, or using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.
  • Klaviyo — We use Klaviyo to manage our email marketing list and send you communications. When you sign up, your name, email address, and attribution data are stored in Klaviyo. See their privacy policy at klaviyo.com/legal/privacy.
  • Gorgias — We use Gorgias to manage customer support enquiries across email, live chat, and other channels. When you contact us, Gorgias may access your name, email address, order history, and the content of your messages to help our team respond to you. See their privacy policy at gorgias.com/legal/privacy.
  • Cloudflare — We use Cloudflare Turnstile to protect our forms from spam and abuse. See their privacy policy at cloudflare.com/en-gb/turnstile-privacy-policy/.
  • Microsoft Clarity — We use Microsoft Clarity to analyse how visitors interact with our websites through heatmaps and session recordings. Clarity may collect data about clicks, scrolls, and mouse movements, and sessions may be linked with your Google Analytics data. Microsoft acts as a data processor on our behalf. See Microsoft's privacy policy at privacy.microsoft.com.

Our business and marketing partners will use your information in accordance with their own privacy notices. Depending on where you reside, you may have the right to direct us not to share your information for targeted advertising purposes. You can exercise that right here.

We do not sell your personal data to any third party in the traditional sense of receiving money in exchange for your information. However, under certain privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA), some of our activities—such as sharing hashed identifiers with advertising partners for targeted or cross-context behavioral advertising—may be considered “sharing” of personal information. You can opt out of this type of sharing at any time using our data-sharing opt-out tool.

6. Our relationship with Shopify

The store at headstart.northperformance.com is hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit via the store will be transmitted to and shared with Shopify and third parties that may be located in countries other than your own.

To help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data from your interactions with our store, other merchants, and Shopify. In these circumstances, Shopify is responsible for the processing of your personal information and for responding to requests to exercise your rights over that data. To learn more, visit the Shopify Consumer Privacy Policy or the Shopify Privacy Portal.

In many cases, Shopify acts as our data processor, handling personal information on our behalf in accordance with our instructions. In some cases, particularly where Shopify uses data to provide, improve, or secure its platform for all merchants and users, Shopify may act as an independent data controller and be responsible for such processing and for responding to requests to exercise rights over that data.

7. Data retention

We retain your personal information for as long as necessary to maintain your account, provide you with the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

For waitlist subscribers, we retain your data for 3 years from the date of your last interaction with us, after which it will be securely deleted. You may request deletion at any time (see Section 9).

8. Cookies

We use cookies and similar tracking technologies across our websites. These include:

  • Strictly necessary cookies — required for the website to function, including security cookies set by Cloudflare Turnstile and cookies needed to operate our online store.
  • Analytics cookies — set by tools such as Google Analytics and Microsoft Clarity to help us understand how visitors use our websites, including through heatmaps and session recordings, and to improve the Services.
  • Marketing cookies — set by tools such as Meta Pixel and other advertising technologies to measure the effectiveness of our advertising and to show you more relevant content.

Google Analytics cookies on this site may also serve advertising purposes through Google Signals, where you are signed in to a Google account and have Ads Personalisation enabled. You can opt out at any time via adssettings.google.com.

Where required by law (including in the EEA and UK), we will only set analytics and marketing cookies after you have given your consent through our cookie consent tool. Strictly necessary cookies are always active because they are required for the Services to function. You can withdraw or change your cookie preferences at any time by using our cookie consent tool or the “Cookie settings” link available on our websites.

Our cookie consent tool explains the categories of cookies we use, the purposes for which we use them, the third parties that set cookies through our Services, and the duration of each cookie.

9. Your rights and choices

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute and may apply only in certain circumstances. We may need to verify your identity before processing a request.

  • Right to access / know — request a copy of the personal information we hold about you.
  • Right to rectification — ask us to correct inaccurate data.
  • Right to erasure / deletion — ask us to delete your personal information.
  • Right to restriction — ask us to limit how we use your data.
  • Right to portability — receive your data in a machine-readable format and, in certain circumstances, request that we transfer it to a third party.
  • Right to object — object to our processing of your personal information.
  • Right to withdraw consent — withdraw consent at any time without affecting the lawfulness of prior processing.
  • Right to opt out of sale or sharing for targeted advertising — you can exercise this right here. If you visit our website with the Global Privacy Control opt-out preference signal enabled, we will treat this as an opt-out request for that device and browser. To learn more about Global Privacy Control, visit globalprivacycontrol.org. We do not otherwise recognise "Do Not Track" signals.
  • Managing communication preferences — you may opt out of marketing emails at any time using the unsubscribe link in any email we send. We may still send you non-promotional emails related to your account or orders.

California residents may also have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale or sharing of personal information for targeted advertising. We do not sell personal information, but you may opt out of certain types of sharing using our data-sharing opt-out tool.

To exercise any of these rights, contact us. We will respond within 30 days. You may also designate an authorised agent to make requests on your behalf, provided that agent supplies proof of your authorisation. We will not discriminate against you for exercising any of these rights.

The availability and scope of these rights depend on where you live and which privacy laws apply to you. We will explain any limitations that apply when you make a request.

10. Children's privacy

Our websites and products are not directed at children under the age of 18, and we do not knowingly collect personal information from anyone under 13 years of age. If you are a parent or guardian and believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

As of the effective date of this Privacy Policy, we do not knowingly sell or share the personal information of individuals under 16 years of age.

11. Security

We take reasonable steps to protect your personal information from unauthorised access, use, or disclosure. However, no security measures are perfect or impenetrable, and we cannot guarantee absolute security. We recommend that you do not use unsecured channels to communicate sensitive information to us.

If we become aware of a security incident that affects your personal information, we will investigate and, where required by law, notify you and any relevant authorities.

12. International transfers

NORTH Performance is registered in the United States, and your data may be transferred to, stored in, and processed there or in other countries outside your own.

If we transfer your personal information outside the European Economic Area or the United Kingdom, we will rely on recognised transfer mechanisms such as adequacy decisions issued by the European Commission or UK authorities, or the European Commission’s Standard Contractual Clauses (or UK-approved equivalent contracts), unless the destination country already provides an adequate level of protection.

13. Third-party websites and links

The Services may include links to websites or platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, you should review their privacy and security policies. We are not responsible for the privacy or security of third-party sites or the accuracy of information found on them. Our inclusion of such links does not imply any endorsement of those sites or their operators.

14. Complaints

If you have a complaint about how we handle your personal information, please contact us using the details in Section 16. Depending on where you live, you may also have the right to lodge a complaint with your local data protection authority.

Depending on where you live, you may also have the right to lodge a complaint with your local data protection authority or supervisory authority. We encourage you to contact us first so we can try to resolve your concerns.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons. We will post the updated policy on this page and update the "Last updated" date above. We encourage you to review this policy periodically.

16. Contact us

For any privacy-related questions, to exercise your rights, or to submit a complaint, please contact us:

  • NORTH Performance Corporation
  • Email: Via Contact Form
  • Address: 550 Water St, Building I, Unit 3, Santa Cruz, CA 95060, United States
  • Website: northperformance.com