Privacy Statement OneUp Components

Last updated: 4th November, 2026

Scope

This Privacy Statement governs the collection, use and other processing of personal data by D3 Innovations Inc. operating as OneUp Components (“OneUp Components”, “we”, “our”, or “us”) in connection with our products, services, customer support activities, and websites.

Who is responsible for processing your personal data?

D3 Innovations Inc. operating as OneUp Components
7-39359 Queens Way
Squamish, BC V8B 0T5
Canada

is the legal entity responsible for the collection and processing of personal data in connection with OneUp Components products, services, and websites. OneUp Components is part of Pon Holdings B.V., its affiliates and subsidiaries (“Pon”).

Why do we process your personal data?

Personal data is information that identifies you as an individual or relates to an identifiable individual. When you purchase products, create an account, contact us, register a product, submit a warranty claim, apply for athlete sponsorship, or use our websites, we process personal data for the following purposes:

1. Communicate with you about OneUp Components products, services, orders, warranties and other enquiries, consistent with your preferences.

2. Provide customer service, including support, warranty administration, product registration, product safety recalls, and complaint handling.

3. Administer and fulfil purchases, including payment processing, shipping, returns and logistics.

4. Create and administer your OneUp Components customer account.

5. Conduct market research and improve our products, services, websites and customer experience.

6. Perform statistical analysis and business reporting.

7. Provide and maintain website functionality and online services.

8. Send promotional and marketing communications where permitted by law and consistent with your choices.

9. Aggregate and anonymize information to improve our business and services.

10. Comply with legal obligations, resolve disputes, enforce our agreements, prevent fraud and protect our customers, employees, systems and business.

11. Evaluate athlete sponsorship applications and contact applicants about their application.

Which personal data we process?

The personal data we process depends on the products, services and websites you use. We may process the following categories of personal data:

• Name, billing and shipping address, email address and telephone number.

• Customer account information and login credentials.

• Order history, payment transaction information and shipping information.

• Warranty claims, product registration information and product recall records.

• Customer support enquiries, communications and interaction history managed through HubSpot.

• Marketing preferences and newsletter subscription information.

• IP address, browser and device information, cookie identifiers and website usage information.

• Customer feedback, survey responses and other information you choose to provide.

• Athlete sponsorship application information, including name, email address, age range, country, social media handles, race results, reference contact details, cover letters, videos and social media insight screenshots.

How do we process your personal data?

The table below describes the principal ways in which OneUp Components processes personal data.

HubSpot Customer Support Platform

We use HubSpot to provide customer support, customer relationship management (CRM), and related communication services. When you communicate with us through support forms, live chat, email, self-service portals, warranty workflows, or other customer service channels, personal information such as contact details, order history, communications, support requests, and interaction history may be processed by HubSpot on our behalf.

Jotform Sponsorship Applications

We use Jotform to collect athlete sponsorship applications. Applications are hosted by Jotform on servers in the European Union and are copied to an internal spreadsheet in Google Workspace that is accessed only by our sponsorship team. Videos, files and screenshots you submit are used only to review your application and will not be published without your permission. Submitting an application does not subscribe you to marketing communications.

How do we share or transfer your personal data?

We may share personal data with service providers that support our business operations, including Shopify, HubSpot, Jotform, payment processors, shipping providers, analytics providers, IT hosting providers, Google Workspace, ERP and accounting providers. We do not sell personal data. Personal information may also be shared within Pon companies where there is a lawful basis to do so.

International Transfers

Personal information may be processed in Canada, the United States, the European Union, the United Kingdom, and other jurisdictions where our service providers operate. Appropriate safeguards are implemented where required by applicable law.

How do we protect your personal data?

We implement technical and organizational measures including access controls, encryption, secure communications, monitoring, and vendor management practices designed to protect personal information.

How long do we retain your personal data?

We retain personal information only for as long as necessary for the purposes for which it was collected, to provide our products and services, comply with legal obligations, resolve disputes and enforce our agreements. Retention periods are determined based on the duration of our relationship with you, applicable statutory retention requirements, and our legitimate business and legal interests. Athlete sponsorship applications are kept for 12 months from the date of submission and then deleted, unless we enter into a sponsorship relationship with you.

Cookies, Web Beacons and Similar Technologies

We use cookies and similar technologies to provide website functionality, remember preferences, improve performance, analyze usage, and support marketing activities. Users can manage cookie preferences through our cookie controls and browser settings.

Children

Our websites and services are not directed at children under 13, and we do not knowingly collect personal data from them. Athlete sponsorship applicants must be 13 or older, and applicants aged 13 to 17 must have approval from a parent or guardian before applying. If you believe a child under 13 has provided personal data to us, please contact privacy@pon.com and we will delete it.

Your Rights

Depending on applicable law, you may have the right to request access to, correction, deletion, restriction or portability of your personal information, object to certain processing activities, and withdraw consent where processing is based on consent. Requests may be submitted to privacy@pon.com.

Contact, Questions, Feedback and Data Protection Officer

For questions regarding this Privacy Statement or the processing of personal data, contact privacy@pon.com. You may also contact Pon’s Data Protection Officer through the same email address and lodge a complaint with the appropriate supervisory authority.

Policy Changes

We may update this Privacy Statement from time to time. Any changes become effective when the revised Privacy Statement is published. Last updated: 4th November, 2026.