Privacy Policy

Last updated: September 15, 2026

1. Introduction

Northaven ("Northaven," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you entrust to us. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and legal rights available to you.

Northaven is operated by RONDINELLI PATRIX SILVA TOLEDO, 11 Fernando Mauricio Street, Lisbon, Lisbon 1950-447, Portugal, which is the controller responsible for the personal information described in this Policy. You can reach us at any time at help@northavencompany.com.

This Policy applies to our website, our online store, and all related sales, marketing, and customer service activities (collectively, the "Services"). It does not apply to third-party websites or services that we do not control. Please read this Policy together with our Terms of Service and our Return & Refund Policy.

2. Information We Collect

2.1 Information you provide to us

• Order and account information: first and last name, billing address, shipping address, email address, telephone number, and order history.
• Payment information: billing details and the last four digits and expiration date of your payment card. Full card numbers are entered directly with our payment processors and are never stored on our systems.
• Customer service information: the contents of emails and messages you send us, including photographs, order numbers, and any documentation you submit in connection with a return, warranty claim, or delivery investigation.
• Marketing information: your email address, telephone number, and preferences if you subscribe to our newsletter or SMS updates, together with a record of your consent.
• Customs and compliance information: where required by law for international shipments, identification or tax identification details requested by customs authorities.
• Content you submit: product reviews, survey responses, and messages you send through social media.

2.2 Information collected automatically

• Device and connection data: IP address, browser type and version, operating system, device identifiers, screen resolution, language, and time zone.
• Usage data: pages viewed, products viewed, referring and exit pages, search terms used on our site, items added to cart, session duration, and the dates and times of your visits.
• Approximate location: the general region or city derived from your IP address. We do not collect precise geolocation from your device.
• Cookie and tracking data: as described in Section 5.

2.3 Information from third parties

• E-commerce platform: our store runs on Shopify, which provides us with order, checkout, and store analytics data.
• Payment processors: confirmation of payment, authorization results, and fraud and risk indicators.
• Carriers and logistics partners: shipment tracking, delivery confirmation, signature records, and customs status.
• Advertising and analytics providers: aggregated campaign performance and audience measurement data.
• Social media platforms: information you make available to us when you interact with our pages or advertisements.

We do not collect biometric information, precise geolocation, government identification numbers other than where customs authorities require them, or any other category of sensitive personal information for the purpose of inferring characteristics about you.

3. How We Use Your Information

• To process, verify, fulfill, and ship your orders, and to arrange customs clearance and delivery.
• To communicate with you about your order, including confirmations, shipping notifications, delays, and delivery issues.
• To handle returns, exchanges, refunds, warranty claims, and customer service requests.
• To detect, investigate, and prevent fraud, chargeback abuse, counterfeiting, and other unlawful activity, and to protect the security of our Services.
• To send you marketing communications where you have asked to receive them or where otherwise permitted by law, and to measure the performance of those communications.
• To personalize your experience, remember your cart and preferences, and show you relevant products and advertisements.
• To analyze and improve our website, product range, pricing, and service quality.
• To comply with legal, tax, accounting, customs, and regulatory obligations, and to establish, exercise, or defend legal claims.

We do not use your personal information to make decisions that produce legal or similarly significant effects about you through automated means alone, other than automated fraud screening applied at checkout, which you may ask us to review manually.

4. Categories of Personal Information and Disclosures

The following table sets out, for the twelve months preceding the date of this Policy, the categories of personal information we collect, the sources from which we collect them, the business purposes for which we use them, and the categories of third parties to whom we disclose them. Category labels follow the California Consumer Privacy Act.

We do not collect biometric identifiers, professional or employment information, education records, or sensitive personal information as defined by California law.

5. Cookies and Similar Technologies

We and our service providers use cookies, pixels, tags, local storage, and similar technologies to operate our store and understand how it is used. The categories we use are:

• Strictly necessary: required for the site to function, including session management, shopping cart, checkout, security, and fraud prevention. These cannot be disabled through our site.
• Performance and analytics: help us understand traffic, page performance, and how visitors move through the store.
• Functional: remember your preferences, such as language, currency, and previously viewed products.
• Advertising and targeting: used to measure campaign performance and to show you Northaven products on other websites and social platforms.

You can manage non-essential cookies through the cookie preferences control on our website, through your browser settings, and through the opt-out tools offered by the Digital Advertising Alliance and the Network Advertising Initiative. Blocking cookies may affect how parts of the store function.

Do Not Track and Global Privacy Control. Our website does not currently respond to browser "Do Not Track" signals, because no common industry standard for them has been adopted. We do treat a Global Privacy Control signal transmitted by your browser or extension as a valid request to opt out of the sale or sharing of personal information and of targeted advertising, in the states where that is required by law.

6. How We Share Your Information

We disclose personal information only as described below, and only to the extent necessary for the purpose concerned:

• E-commerce platform: Shopify Inc., which hosts our online store and processes orders on our behalf.
• Payment processors: to authorize and settle transactions, and to screen for fraud. These providers handle your card data as independent controllers under their own privacy policies.
• Fulfillment and logistics partners: suppliers, warehouses, carriers, and customs brokers, so that your order can be prepared, cleared, and delivered.
• Technology and support providers: email, helpdesk, hosting, backup, security, review, and analytics providers acting on our instructions.
• Advertising partners: platforms that deliver and measure our advertising campaigns.
• Professional advisers: accountants, auditors, insurers, and lawyers, where necessary.
• Legal and safety disclosures: where required by law, subpoena, court order, customs or tax authority, or where necessary to protect our rights, property, or the safety of others.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will require the recipient to honor this Policy or notify you of any material change.

We do not sell your personal information for money, and we do not disclose your personal information to third parties for their own independent direct marketing purposes. However, our use of advertising and analytics cookies may be considered a "sale" or "sharing" of personal information, or "targeted advertising," under certain state privacy laws. You may opt out at any time as described in Section 10. We do not sell or share the personal information of consumers we know to be under 16 years of age.

7. Marketing Communications

If you subscribe to our newsletter, we will send you product announcements, offers, and store news. Every marketing email includes an unsubscribe link, and we honor unsubscribe requests promptly, consistent with the CAN-SPAM Act. You may also email help@northavencompany.com to be removed from our marketing lists.

If you opt in to SMS updates, you consent to receive recurring automated marketing text messages at the number you provide. Consent is not a condition of purchase. Message and data rates may apply. Reply STOP to unsubscribe or HELP for assistance.

Transactional messages relating to an order you have placed, such as order confirmations, shipping notices, and delivery updates, are not marketing communications and will continue to be sent while your order is active.

8. Data Retention

We keep personal information only for as long as necessary for the purposes described in this Policy, unless a longer period is required by law. In general:

• Order, invoicing, and customs records: up to 10 years, to satisfy tax, accounting, and customs obligations.
• Customer service correspondence: up to 3 years after the matter is closed.
• Marketing contact data: until you unsubscribe, and then a minimal suppression record kept indefinitely so that we do not contact you again.
• Analytics and cookie data: generally up to 24 months from collection.
• Fraud and chargeback records: up to 7 years, to defend against claims.

When personal information is no longer needed, we delete it or irreversibly anonymize it.

9. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption of data in transit using TLS, restricted and role-based access to customer data, and the use of payment processors that maintain PCI-DSS compliance. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and the competent authorities where required by applicable law.

10. Your Privacy Rights in the United States

Depending on your state of residence, you may have some or all of the following rights. We honor these rights for all United States customers, regardless of whether your state has enacted a privacy statute.

• Right to know and access: to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Right to delete: to request deletion of personal information we have collected from you, subject to legal exceptions such as completing a transaction or meeting a record-keeping obligation.
• Right to correct: to request correction of inaccurate personal information.
• Right to portability: to receive a copy of your personal information in a portable, readily usable format.
• Right to opt out: to opt out of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects.
• Right to limit sensitive information: to limit the use and disclosure of sensitive personal information. We do not use sensitive personal information for purposes that require this right.
• Right to non-discrimination: we will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised a privacy right.
• Right to appeal: if we decline your request, you may appeal by replying to our decision. We will respond to an appeal within 45 days and, if the appeal is denied, will tell you how to contact your state attorney general.

How to exercise your rights. Email help@northavencompany.com with the subject line "Privacy Request," stating which right you wish to exercise. To protect your information, we will ask you to verify your identity, usually by confirming details associated with an order such as the order number, the email address used, and the shipping address. We will acknowledge your request within 10 business days and respond within 45 calendar days, and we may extend that period once by a further 45 days where reasonably necessary, in which case we will inform you. There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We will ask for written proof of the agent's authority and may ask you to verify your identity directly with us.

California Shine the Light. Under California Civil Code section 1798.83, California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes. As stated in Section 6, we do not make such disclosures.

11. Your Rights in the European Economic Area, the United Kingdom, and Switzerland

Because Northaven is operated from Portugal, the EU General Data Protection Regulation applies to our processing. Where it applies, we rely on the following legal bases: performance of a contract with you, when we process your order and provide customer service; compliance with a legal obligation, for tax, accounting, and customs records; your consent, for marketing communications and non-essential cookies; and our legitimate interests in securing our store, preventing fraud, improving our products, and promoting our business, balanced against your rights.

You have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests or carried out for direct marketing, and to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Requests may be sent to help@northavencompany.com and will be answered within one month. You also have the right to lodge a complaint with your local supervisory authority or with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados.

12. International Transfers of Information

We operate internationally, and your personal information may be transferred to, stored in, and processed in countries other than the one in which you live, including the United States, Portugal, other European Union member states, and countries where our suppliers and logistics partners operate. Privacy laws in these countries may differ from those in your jurisdiction. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, together with additional safeguards where appropriate. You may request a copy of the relevant safeguards by contacting us.

13. Children's Privacy

Our Services are intended for adults and are not directed to children. We do not knowingly collect personal information from children under 13 years of age, consistent with the Children's Online Privacy Protection Act, or from children under 16 in jurisdictions where that higher age applies. If you believe a child has provided us with personal information, please contact help@northavencompany.com and we will delete it promptly.

14. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, and payment pages. We are not responsible for the privacy practices or content of those third parties. We encourage you to read their privacy policies before providing them with personal information.

15. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. The revised version will be posted on this page with a new "Last updated" date. Where the changes are material, we will provide a more prominent notice, such as an email or a banner on our website. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

16. Contact Us

If you have questions about this Policy, wish to exercise a privacy right, or would like to make a complaint about how we handle your personal information, please contact us. We respond to all privacy inquiries within 2 business days and aim to resolve complaints promptly.

Northaven
Email: help@northavencompany.com
Data controller: RONDINELLI PATRIX SILVA TOLEDO
11 Fernando Mauricio Street
Lisbon, Lisbon 1950-447
Portugal