Privacy Policy

Effective from: 17.10.2026

1. Data controller and definitions

1. The controller of the personal data of Customers / Users of the Online Shop (hereinafter also the “Seller”) is: Nexotec spółka z ograniczoną odpowiedzialnością with its registered office in Ruda Śląska, ul. Marii Kuncewiczowej 3, 41-706 Ruda Śląska, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001053922 by the District Court in Gliwice, 10th Commercial Division of the National Court Register, VAT ID (NIP): PL6412563804, REGON: 526163427, phone: +48 600 025 770.
2. You can contact the controller:
   • by post: ul. Marii Kuncewiczowej 3, 41-706 Ruda Śląska, Poland,
   • by e-mail: contact@nexotec.pl.
3. User – a natural person who visits the pages of the Online Shop or uses the services and functions described in this Privacy and Cookie Policy.
4. Customer – a natural person with full legal capacity, a Consumer, a legal person or an organisational unit without legal personality to which the law grants legal capacity, who concludes a Distance Sales Agreement (within the meaning of the Terms and Conditions) with the Seller.
5. Online Shop – the online service run by the Seller at https://nexotec.pl, through which the Customer / User can obtain information about Goods and their availability and buy Goods.
6. Newsletter – information, including commercial information, sent by the Seller to the Customer / User electronically; receiving it is voluntary and requires the consent of the Customer / User.
7. Account – the set of data stored in the Online Shop and in the Seller's IT system concerning a Customer / User, their orders and concluded agreements, through which the Customer / User can place orders and conclude agreements.
8. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
9. Electronic Communications Law – the Polish Act of 12 July 2024 – Prawo komunikacji elektronicznej (Electronic Communications Law).

2. Purposes, legal bases and period of processing

1. The controller processes personal data for the following purposes:
   • Conclusion and performance of the Distance Sales Agreement (order handling, delivery of the Goods, payment, refunds). Data: first and last name or company name, registered office address, delivery and correspondence address, e-mail address, phone number, VAT ID, bank account number (for refunds) and other data necessary to complete the purchase that the controller requests in the ordering process. Legal basis: performance of a contract or steps taken at the Customer's request before entering into it (Art. 6(1)(b) GDPR). Period: until the contract has been performed, and then according to the further purposes below.
   • Orders placed on sales platforms (Allegro, eBay, InPost) and fulfilled by the Seller. We receive the data from the platform operator to the extent needed to fulfil the order (first and last name or company name, delivery address, e-mail address, phone number, invoice details). Legal basis: Art. 6(1)(b) GDPR. Period: as for orders in the Online Shop. The platform operator's own privacy policy applies to its processing of your data.
   • Setting up and maintaining the Account. Legal basis: performance of the Account agreement (Art. 6(1)(b) GDPR). Period: until the Account is deleted.
   • Compliance with the controller's legal obligations, in particular accounting and tax obligations (issuing and keeping invoices and accounting records). Legal basis: Art. 6(1)(c) GDPR. Period: 5 years from the end of the calendar year in which the tax payment deadline expired (Polish Tax Ordinance) and for the period required by the Polish Accounting Act.
   • Handling complaints and withdrawals from the contract, and establishing, pursuing and defending claims. Legal basis: Art. 6(1)(b) and (f) GDPR (the controller's legitimate interest in protecting its rights). Period: until the limitation periods for claims expire.
   • Handling enquiries (contact form, e-mail, phone). Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). Period: until the matter is closed, and then in line with the rules on keeping documents.
   • Operation and security of the Online Shop – technical data about the device and activity on the pages: IP address, information stored in cookies and similar technologies, session data, browser and device data, server logs, data on activity on individual subpages, strictly necessary cookies, and protection of forms against spam (Google reCAPTCHA). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the proper and secure operation of the services); for strictly necessary cookies also Art. 399 of the Electronic Communications Law. Period: for the duration of the session or for the period stated for each cookie; logs – as long as needed for security.
   • Publishing reviews of Goods and of the Shop. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting customer reviews). Period: until the review is deleted or an objection is raised.
   • Google Customer Reviews survey – after an order is placed, the Shop may display a request for consent to Google sending you a survey about the order; if you consent, Google receives your e-mail address, order number, delivery country and estimated delivery date. Legal basis: your consent (Art. 6(1)(a) GDPR). Period: until consent is withdrawn.
   • Traffic measurement and statistics (analytics cookies and similar technologies: Google Analytics, Microsoft Clarity). Legal basis: your consent (Art. 399 of the Electronic Communications Law, Art. 6(1)(a) GDPR). Period: until consent is withdrawn, no longer than the cookie lifetimes given in section 10.
   • Product recommendations and advertising (advertising cookies and similar technologies, including the Google advertising network: Google Ads conversion measurement, remarketing and enhanced conversions). With enhanced conversions, the e-mail address or phone number given in the order is one-way encrypted (SHA-256 hash function) before being sent to Google and is used only to attribute the purchase to an ad. Legal basis: your consent (Art. 399 of the Electronic Communications Law, Art. 6(1)(a) GDPR). Period: until consent is withdrawn, no longer than the cookie lifetimes given in section 10.
   • Sending the Newsletter and commercial information by electronic means. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 398 of the Electronic Communications Law). Period: until consent is withdrawn.
2. Providing the data necessary to conclude and perform the Distance Sales Agreement and to maintain the Account is a condition of the contract – without it the order cannot be fulfilled and the Account cannot be set up. Providing data required by law (e.g. for accounting) is a statutory obligation. Providing data for the Newsletter and consenting to analytics and advertising cookies is voluntary; not doing so does not affect your ability to shop.
3. Information about the device and activity on the pages does not on its own identify the User, but combined with other information it may constitute personal data, so the controller protects it fully in accordance with the GDPR.
4. The controller applies the technical and organisational measures required by Art. 32 GDPR to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope and purposes of processing.
5. The controller does not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you. If you consent to advertising cookies, data is profiled in order to show you product recommendations and ads matched to your interests (section 10). You can withdraw your consent at any time.

3. Marketing activities of the controller

1. The controller may publish marketing information about its products on the pages of the Online Shop. This is based on Art. 6(1)(f) GDPR, i.e. the controller's legitimate interest in publishing content related to the Goods offered and to promotional campaigns in which it is involved. This does not infringe the rights and freedoms of Customers / Users, who expect such content and are often visiting the Online Shop for it.

4. Recipients of data

1. The controller discloses personal data only to the following recipients:
   • processors acting on the controller's behalf under data processing agreements, in particular the provider of the Online Shop platform and hosting (IAI S.A. – IdoSell), the e-mail provider (Microsoft – Microsoft 365), the provider of the accounting and warehouse system (enova365), IT service providers and analytics tools (Microsoft – Clarity),
   • carriers (DHL, FedEx, and in Poland also InPost and DPD) – to the extent needed to deliver the parcel: first and last name or company name and delivery address; e-mail address and phone number only where needed for delivery or shipment notification,
   • payment service providers (IdoPay, Przelewy24, PayPal, PayPo) – to the extent needed to process the payment using the method you choose,
   • operators of sales platforms (Allegro, eBay, InPost) – for orders placed on these platforms, to the extent needed to handle the order and shipment,
   • providers of analytics and advertising services (Google, Microsoft) – only with your consent; Google also as the provider of reCAPTCHA form protection,
   • providers of accounting, tax and legal services,
   • public authorities – where the law requires the data to be disclosed.
2. The currently available delivery methods are listed at: https://nexotec.pl/en/delivery.html, and the currently available payment methods at: https://nexotec.pl/en/payments.html.

5. Transfer of personal data to third countries

1. Some recipients, in particular Google, Microsoft and PayPal, may process personal data outside the European Economic Area, including in the United States of America. Such transfers take place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission. You can obtain a copy of the relevant safeguards from the controller using the contact details in section 1.

6. Rights of data subjects

1. Every data subject has the right:
   • of access (Art. 15 GDPR) – to obtain confirmation from the controller as to whether their personal data is being processed and, if so, access to it and information on the purposes of processing, categories of data, recipients or categories of recipients, the storage period or the criteria for determining it, the right to request rectification, erasure or restriction of processing, and the right to object,
   • to obtain a copy of the data (Art. 15(3) GDPR) – the first copy is free of charge; for further copies the controller may charge a reasonable fee based on administrative costs,
   • to rectification (Art. 16 GDPR) – to have inaccurate data corrected or incomplete data completed,
   • to erasure (Art. 17 GDPR) – where the controller no longer has a legal basis for processing or the data is no longer needed for the purposes of processing,
   • to restriction of processing (Art. 18 GDPR), where:
     • the data subject contests the accuracy of the data – for a period enabling the controller to verify it,
     • the processing is unlawful and the data subject opposes erasure and requests restriction of use instead,
     • the controller no longer needs the data, but the data subject needs it to establish, exercise or defend legal claims,
     • the data subject has objected to processing – pending verification whether the controller's legitimate grounds override,
   • to data portability (Art. 20 GDPR) – to receive the data they provided to the controller in a structured, commonly used and machine-readable format and to transmit it to another controller, where processing is based on consent or a contract and is carried out by automated means,
   • to object (Art. 21 GDPR) – at any time, on grounds relating to their particular situation, to processing based on the controller's legitimate interests, including profiling. The controller then assesses whether there are compelling legitimate grounds that override the interests, rights and freedoms of the data subject or grounds for establishing, exercising or defending legal claims; if not, it stops processing for that purpose. Objection to processing for direct marketing can be raised at any time, and the controller then stops processing the data for that purpose,
   • to withdraw consent at any time without giving reasons; withdrawal does not affect the lawfulness of processing carried out before it.
2. To exercise these rights, contact the controller using the details in section 1 and state which right you wish to exercise and to what extent.

7. Complaint to a supervisory authority

1. Every data subject has the right to lodge a complaint with a supervisory authority. As the controller has its registered office in Poland, the lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl, hotline: +48 606 950 000. You can also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence.

8. Data protection contact

1. The controller has not appointed a data protection officer. In all matters concerning the processing of personal data and the exercise of your rights, you can contact the controller directly by e-mail or by post at the address given in section 1.

9. Changes to the Privacy Policy

1. This Privacy and Cookie Policy may be supplemented or updated according to the controller's current needs in order to provide Customers / Users with up-to-date and reliable information. The effective date of the current version is given at the top of the document.

10. Cookies and similar technologies

1. The Online Shop obtains information about Customers, Users and their behaviour:
   • from information voluntarily entered in forms – for the purposes resulting from the function of the form,
   • by storing cookies and similar data (e.g. in browser storage) on end devices,
   • from server logs collected by the hosting operator of the Online Shop (necessary for the proper operation of the service).
2. Cookies are IT data, in particular text files, stored on the Customer's / User's end device and intended for using the pages of the Online Shop. They usually contain the name of the website they come from, their storage time on the device and a unique number.
3. The Online Shop sets strictly necessary cookies without consent, because they are required for the Shop to work and for the functions you request (e.g. basket, login, form security) – Art. 399 of the Electronic Communications Law. The Online Shop uses analytics and advertising cookies and similar technologies only on the basis of your prior, voluntary and active consent (Art. 399 of the Electronic Communications Law, Art. 6(1)(a) GDPR). You give consent by clicking the accept button in the cookie notice shown on your first visit or by selecting categories in the consent settings. Merely closing the notice or continuing to use the site does not constitute consent.
4. If you do not consent, you can reject analytics and advertising cookies in the notice or change your browser settings (strictly necessary cookies are always set; refusing the others does not affect your ability to shop). You can withdraw consent at any time by changing the cookie settings or deleting cookies in your browser.
5. The Online Shop uses Google Consent Mode to manage Google tools. Until you give consent, Google tools do not store analytics or advertising cookies, and Google receives only technical signals about the page view, without those cookies and without advertising identifiers.
6. You can manage cookie settings in your web browser or operating system – instructions are in your browser's help: Chrome, Safari, Firefox, Opera, Edge, Android, Safari (iOS).
7. The legal basis for processing personal data from strictly necessary cookies is the controller's legitimate interest in ensuring high quality and security of the services (Art. 6(1)(f) GDPR). For analytics and advertising cookies the legal basis is your consent.
8. The Online Shop uses “session cookies”, stored until you log out, leave the Online Shop or close the browser, and “persistent cookies”, stored for the time set in their parameters or until deleted by the Customer / User.
9. Analytics and advertising tools used in the Online Shop (their cookies are described in the table below):
   • Google Tag Manager (Google) – a tool for managing code on the site; it does not store cookies itself.
   • Google Analytics 4 (Google) – statistics on traffic and behaviour on the pages, category: analytics (consent only).
   • Google Ads (Google) – measuring ad effectiveness (conversions, including enhanced conversions), remarketing and ad personalisation in the Google network, category: advertising (consent only). Google may also set its own cookies on the doubleclick.net and google.com domains.
   • Microsoft Clarity (Microsoft) – click and scroll heatmaps and recordings of the visit (mouse movements, clicks, scrolling) that help find errors and inconvenient places on the pages; the content of form fields is masked and is not sent to Microsoft. Category: analytics (consent only). Microsoft may also set its own cookies on the clarity.ms domain.
   • Google reCAPTCHA (Google) – protection of forms (contact, login, newsletter) against spam and abuse, category: strictly necessary.
10. Cookies of the Online Shop platform (IdoSell) and the services built into it, by category:

    Advertising cookies

    Google Ads

    _gcl_au: 90 days, cookie
    Attributes visits and purchases to Google Ads clicks (conversion tracking).

    _gcl_aw: 90 days, cookie
    Stores the ID of the Google Ads click (GCLID) that led to the visit.

    _gcl_gs: 90 days, cookie
    Stores information about the Google Ads click source needed for conversion tracking.

    _gcl_ls: 90 days, local storage
    Copy of Google Ads click data in browser storage (conversion tracking).

    nexotec.pl

    RSSID: 180 days, cookie
    IdoSell RS user ID, used for the purpose of displaying tailored product recommendations on the website.

    __IAIRSUSER__: 60 minutes, cookie
    IdoSell RS user ID, used for the purpose of displaying tailored product recommendations on the website.

    
    

    Analytics cookies

    Google Analytics

    _ga: 400 days, cookie
    Distinguishes users in Google Analytics statistics.

    _ga_FP1KKQJB11: 400 days, cookie
    Stores the session state in Google Analytics (number and time of visits).

    Microsoft Clarity

    _clck: 365 days, cookie
    Microsoft Clarity user ID – links visits from the same browser.

    _clsk: 1 days, cookie
    Links page views into one visit in Microsoft Clarity (click maps, recording of mouse movements, clicks and scrolling).

    IAI S.A.

    __IAI_AC2: 45 days, cookie
    Activity Tracking identifier to collect the history of pre-order sources as well as the source through which the order was placed according to the last click attribution model.

    Google Customer Reviews

    *-*: 14 days, cookie
    It stores information about whether a 'Google Consumer Reviews' popup has already been displayed, asking for consent to send a survey about the order.

    Google Maps

    SID: 3650 days, cookie
    Contain digitally signed and encrypted records of a user’s Google Account ID and most recent sign-in time. The combination of these cookies (SID, HSID) allows Google to block many types of attack, such as attempts to steal the content of forms submitted in Google services.

    
    

    Necessary cookies (required)

    nexotec.pl

    monit_token: 365 days, cookie
    Identifies the shop's customer.

    shop_monit_token: 30 minutes, cookie
    Identifies the shop's customer.

    client: 1 days, cookie
    Identifies the logged-in customer / basket of the non-logged-in customer.

    affiliate: 90 days, cookie
    It stores information about the partner ID from which the shop was entered.

    ordersDocuments: cookie
    Stores information about the print status of a document.

    __idsui: 1095 days, cookie
    File required for the so-called lightweight login function on the website.

    __idsual: 1095 days, cookie
    File required for the so-called lightweight login function on the website.

    __IAI_SRC: 90 days, cookie
    It only stores the source from which the page was accessed.

    login: cookie
    Stores information about whether the user has logged in to the site.

    CPA: 28 days, cookie
    Includes information on the variables for the CPA / CPS programmes in which the site participates.

    __IAIRSABTVARIANT__: 30 days, cookie
    Variant identifier for the A/B test and IdoSell RS engine configuration.

    basket_id: 365 days, cookie
    The site user's shopping cart identifier, assigned for the duration of the ongoing session.

    page_counter: 1 days, cookie
    Counter of pages visited.

    LANGID: 180 days, cookie
    Stores information about the language selected by the site user.

    REGID: 180 days, cookie
    Stores information about the site user's region.

    CURRID: 180 days, cookie
    Stores information about the currency of the site selected by the user.

    __IAIABT__: 30 days, cookie
    It stores the A/B test identifier, for the purpose of testing and improving shop functionality.

    __IAIABTSHOP__: 30 days, cookie
    It stores the identifier of the shop participating in the A/B test.

    __IAIABTVARIANT__: 30 days, cookie
    Stores the identifier of the variant drawn as part of the ongoing A/B test.

    toplayerwidgetcounter[]: cookie
    Stores the number of times a pop up message has been displayed.

    samedayZipcode: 90 days, cookie
    Stores information about the site user's postcode, which is required to offer courier delivery on the SameDay service.

    applePayAvailability: 30 days, cookie
    Stores information about whether an ApplePay payment method is available for the user.

    paypalMerchant: 1 days, cookie
    PayPal account ID.

    toplayerNextShowTime_: cookie
    Stores information about the time at which the next pop up message is to be displayed. 

    rabateCode_clicked: 1 days, cookie
    Stores information about the closure of the active discount bar.

    freeeshipping_clicked: 1 days, cookie
    Stores information about the closing of the free delivery bar.

    redirection: cookie
    Stores information on the closure of the pop-up message indicating the suggested language for the shop.

    filterHidden: 365 days, cookie
    When the option to collapse the filter for goods is clicked, it saves which filter is to be collapsed when the goods list is refreshed.

    toplayerwidgetcounterclosedX_: cookie
    It stores information about closing the pop-up message.

    cpa_currency: 60 minutes, cookie
    Includes currency information for CPA / CPS programmes in which the site participates.

    basket_products_count: cookie
    Stores information on the number of products in the basket.

    wishes_products_count: cookie
    Stores information on the number of products in the favorites list.

    HOMELANDID: 180 days, cookie
    Stores information about the visitor's country.

    remembered_shop_mfa: 365 days, cookie
    CookieNameRememberedShopMfa

    IAI S.A.

    iai_accounts_toplayer: 30 days, cookie
    Ensures the correct display of the pop up message informing about the IdoAccounts login service (https://www.idosell.com/en/idoaccounts-is-a-system-that-facilitates-the-process-of-logging-in-to-many-stores-with-one-account-and-placing-orders-in-online-stores/).

    IdoSell

    platform_id: cookie
    Stores information about whether the page is displayed in the mobile app.

    paypalAvailability_: 1 days, cookie
    Stores information on whether a PayPal payment method is available for the user.

    ck_cook: 3 days, cookie
    Stores information about whether the user of the website has consented to cookies.

    IdoAccounts

    accounts_terms: 365 days, cookie
    Stores information on whether the user has accepted consent to use the IdoAccounts service.

    express_checkout_login: 365 days, cookie
    CookieNameExpressCheckoutLogin

    Google

    NID: 180 days, cookie
    These cookies (NID, ENID) are used to remember your preferences and other information, such as your preferred language, how many results you prefer to have shown on a search results page (for example, 10 or 20), and whether you want to have Google’s SafeSearch filter turned on. This cookie is also required to offer the Google Pay payment service.

    Google reCAPTCHA

    _GRECAPTCHA: 1095 days, cookie
    This cookie is set by Google reCAPTCHA, which protects our site against spam enquiries on contact forms.

    PayPal

    ts: cookie
    This cookie is generally provided by PayPal and supports payment services on the website.

    ts_c: 1095 days, cookie
    This cookie is generally provided by PayPal and is used to prevent fraud.

    x-pp-s: cookie
    This cookie is generally provided by PayPal and supports payment services on the website.

    enforce_policy: 365 days, cookie
    This cookie is generally provided by PayPal and supports payment services on the website.

    tsrce: 3 days, cookie
    This cookie is generally provided by PayPal and supports payment services on the website.

    l7_az: 60 minutes, cookie
    This cookie is necessary for the PayPal login-function on the website.

    LANG: 1 days, cookie
    This cookie is generally provided by PayPal and supports payment services on the website.

    nsid: cookie
    Used in the context of transactions on the Website. The cookie is required for secure transactions.

    
    
11. Cookies are used for:
    • creating statistics that help understand how Customers / Users use the pages of the Online Shop, which makes it possible to improve their structure and content,
    • maintaining the Customer's / User's session (after logging in), so that they do not have to re-enter their login and password on every subpage,
    • determining the Customer's / User's profile in order to show them product recommendations and matched content in advertising networks, in particular the Google network.
12. Web browsers usually allow cookies to be stored on the end device by default. You can change this in your browser settings, which also let you delete cookies and block them automatically. Restricting cookies may affect some functions of the Online Shop.
13. With your consent, Google cookies may be used to show ads matched to the way you use the Online Shop, e.g. by remembering your navigation path or the time spent on a page: https://policies.google.com/technologies/partner-sites. You can view and change the preferences collected by the Google advertising network in: https://myadcenter.google.com/.
14. The pages of the Online Shop contain modules that may transfer Customers' / Users' data to other entities, such as: Google Maps, PayPal, Google reCAPTCHA, IdoAccounts, IdoSell, IAI S.A., Google, Google Customer Reviews, Microsoft Clarity.
15. More information on how the tool providers process data: Google – https://policies.google.com/privacy, Microsoft – https://www.microsoft.com/en-gb/privacy/privacystatement, PayPal – https://www.paypal.com/uk/legalhub/privacy-full.

11. Newsletter

1. The Customer can consent to receiving commercial information by electronic means by ticking the relevant option in the registration form or later in the relevant section of the Account. After giving consent, the Customer / User receives the Online Shop Newsletter and other commercial information from the Seller at the e-mail address provided.
2. You can unsubscribe from the Newsletter at any time: by unticking the relevant box on the Account page, via the form at https://nexotec.pl/en/newsletter.html, by clicking the unsubscribe link in each Newsletter or by contacting the Seller.

12. Account

1. The Customer / User may not post in the Online Shop or provide to the Seller unlawful content, including reviews and other data.
2. The Customer / User gains access to the Account after registration.
3. When registering, the Customer / User provides the account type, first name, last name, company name, VAT ID, details for issuing the sales document, shipping details and e-mail address, and sets a password. The Customer / User warrants that the data given in the registration form is true. Registration requires reading the Terms and Conditions and confirming in the form that the Customer / User has read them and accepts all their provisions.
4. When access to the Account is granted, an agreement for the provision of electronic services concerning the Account is concluded between the Seller and the Customer for an indefinite period. A Consumer may withdraw from this agreement under the rules set out in the Terms and Conditions.
5. Registering an Account in one language version of the Online Shop also gives access to the other versions under which the Online Shop is available.
6. The Customer / User may terminate the agreement for the provision of electronic services at any time with immediate effect by informing the Seller by e-mail or by post at the address given in section 1.
7. The Seller may terminate the Account agreement if it ceases to run the Online Shop or transfers it to another entity, if the Customer / User breaches the law or the Terms and Conditions, or if the Customer / User has been inactive for 6 months. The agreement ends after a seven-day notice period. The Seller may require its approval for re-registration of the Account.