Privacy Policy

NEXELTRON PRIVACY POLICY

effective from 14 September 2026

§ 1. General Information

This Privacy Policy defines the rules for processing personal data in connection with the use of services and solutions of the Nexeltron brand, specifically:the nexeltron.com website,the Nexeltron online store,the Nexeltron Longevity Members Club,NEXELTRON TEST PASS,the Nexeltron App,Nexeltron OS,contact forms,newsletter and marketing communications,contact with Nexeltron,order fulfillment, reservations, and memberships,business cooperation.
Personal data is processed in accordance with applicable regulations, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council – GDPR.
Nexeltron applies the principle of data minimization and processes only the data necessary for specified purposes.

§ 2. Personal Data Controller

The Controller of personal data is:

PROSPER Andrzej Janda
ul. Miła 17A
78-400 Szczecinek, Poland
NIP: 6731734033
REGON: 080289834

hereinafter referred to as: "Controller" or "Nexeltron".

For matters concerning personal data, you can contact:

e-mail: nexeltron@nexeltron.com
tel.: +48 510 024 345

Correspondence address:

PROSPER / Nexeltron
ul. Prądzyńskiego 31G/18
66-400 Gorzów Wielkopolski
Poland

§ 3. What data we may process

Depending on how you use Nexeltron, we may process, in particular:

Identification data:first name,last name,company name,Tax Identification Number (NIP),other data required for the performance of a specific service.
Contact data:email address,phone number,correspondence address,delivery address,billing address.
Order-related data:order number,purchased products,order value,payment method,delivery method,order history,data regarding complaints and returns.
Nexeltron membership-related data:type of Membership Plan,membership status,validity period,payment history,privileges assigned to the Account.
Reservation and Session data:selected location,selected Technology,reservation date and time,reservation status,service usage history.
Nexeltron Account data:user ID,login data,account settings,activity history related to services,access rights.
Technical data:IP address,device type,operating system,browser type and version,device identifiers,system logs,information on how the website, application, or system is used.
Communication data:email content,reports,inquiries,complaints,contact history with Nexeltron.
Marketing data:information about granted consents,communication preferences,reactions to marketing communication,information about website or service usage, if regulations and user settings allow.

§ 4. Purposes and legal bases for data processing

Personal data may be processed for the following purposes:

1. Store operation and order fulfillment

We process data for the purpose of:

accepting and fulfilling orders,
payment processing,
delivery organization,
issuing sales documents,
handling returns and complaints.

The primary basis for processing is the necessity to perform a contract or take steps prior to entering into a contract, and the Controller's legal obligations.

2. Nexeltron Longevity Members Club operations

Data may be processed for the purpose of:

concluding and fulfilling Membership,
supporting NEXELTRON TEST PASS,
managing access to the Club,
handling Reservations,
managing user permissions,
contact regarding provided services.

The primary basis for processing is the performance of a contract or taking action at the user's request before entering into it.

3. Nexeltron App and Nexeltron OS

Data may be processed for the purpose of:

creating and managing an Account,
user authentication,
Membership management,
making Reservations,
managing access,
presenting Session history,
ensuring system security,
error diagnostics,
feature development.

The basis for processing may be the performance of a contract, a legal obligation, user consent, or the legitimate interest of the Controller – depending on the specific function.

4. Contact with Nexeltron

Data provided via form, email, phone, or other communication channels are processed for the purpose of:

providing a response,
presenting information about the offer,
conducting correspondence,
preparing for cooperation.

The basis for processing is taking action at the request of the data subject or the Controller's legitimate interest in conducting communication related to Nexeltron's activities.

5. B2B Cooperation

Data of business partners' representatives, employees, and contact persons may be processed for the purpose of:

conducting sales discussions,
preparing an offer,
implementing cooperation,
concluding and performing a contract,
ongoing business contact,
pursuing or defending claims.

The basis may be the performance of a contract, actions preceding its conclusion, and the legitimate interest of the Controller.

6. Accounting, tax, and legal obligations

Data may be processed to fulfill obligations arising from regulations, including those concerning:

accounting,
taxes,
sales documentation,
consumer rights protection,
complaint handling.

The basis for processing is a legal obligation incumbent on the Controller.

7. Pursuit and defense of claims

Data may be processed for the purpose of establishing, pursuing, or defending against claims.

The basis is the Controller's legitimate interest in protecting its rights and interests.

8. Security

Technical data and activity information may be processed for the purpose of:

ensuring website security,
protecting user Accounts,
preventing abuse,
detecting errors and incidents,
securing infrastructure.

The basis is the Controller's legitimate interest in ensuring the security of services and systems.

§ 5. Marketing and newsletter

If the user grants appropriate consent, Nexeltron may send marketing information regarding:Nexeltron services,new locations,new Technologies,Nexeltron App and Nexeltron OS,events,offers,other information related to Nexeltron's activities.
Communication may take place in particular via:email,electronic messages,app notifications,other channels to which the user has consented.
The user may withdraw consent for marketing communication at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Opting out of marketing does not disable communications necessary for contract fulfillment, Reservations, Account management, or security.

§ 6. Health data and special categories of data

As a general rule, Nexeltron does not require the submission of health data during normal use of the website or store.
However, some Nexeltron Technologies or services may require the submission of specific information related to the safe use of the service.
If such information constitutes health data within the meaning of the GDPR, it will be processed only when there is an appropriate legal basis provided for special categories of data.
If the basis for processing is the user's explicit consent, the user will receive appropriate information before submitting such data.
The user may withdraw consent for the processing of health data to the extent that consent constitutes the basis for their processing.
Withdrawal of consent may prevent the use of a feature or service for which the processing of such data is essential for safety or functional reasons.
If the Nexeltron App in the future allows voluntary connection with wearable devices, sensors, or other user data sources, the scope of data, the purpose of their processing, and the appropriate legal basis will be presented before activating such a function.

§ 7. Data Sources

Most data is obtained directly from the data subject.
Data may also be received from:a business partner,an employer or organization that provides the user with access to services,a payment operator,a technology partner,systems used to provide services,publicly available sources in the case of business contacts.
If data is acquired from another source, the information obligation is fulfilled in accordance with applicable regulations.

§ 8. Data Recipients

Data may be transferred to entities supporting Nexeltron in conducting its business, if necessary.
Recipients of data may include, in particular:IT infrastructure providers,hosting and cloud service providers,e-commerce platform providers,payment operators,courier and logistics companies,reservation system providers,CRM system providers,communication tool providers,email providers,analytical tool providers,marketing tool providers,Nexeltron App and Nexeltron OS infrastructure providers,service companies,accounting services,law firms,advisors,IT security service providers,public authorities, if the obligation to provide data results from law.
Entities processing data on behalf of the Controller may use them only within the scope resulting from concluded agreements and the Controller's instructions.

§ 9. Shopify

The Nexeltron online store uses the infrastructure of the Shopify platform.
In connection with the use of the store, certain data may be processed using Shopify's infrastructure and services.
The scope of this processing depends on how the Store is used and the functionalities utilized.
Information regarding Shopify's data processing principles is available in the documentation and privacy policies of that provider.

§ 10. Payments

Nexeltron may use external payment operators.
Data necessary for payment processing may be transferred to the selected operator.
Nexeltron may not receive full payment instrument data if it is processed directly by the payment operator.
Payment operators may act as independent data controllers to the extent defined by their own terms and conditions and privacy policies.

§ 11. Cookies and similar technologies

The Nexeltron website may use cookies and similar technologies.
They may be used in particular to:ensure proper functioning of the website,maintain user sessions,handle shopping carts,ensure security,remember settings,conduct statistics,analyze website usage,personalization,marketing activities.
Technologies that are not essential for the website's operation are used in accordance with applicable regulations and the user's consent settings.
The user can manage their cookie choices using the tool available on the website.
Detailed information can be found in the separate Nexeltron Cookie Policy.

§ 12. Analytical and marketing data

Nexeltron may use tools that allow analyzing website usage and the effectiveness of marketing activities.
Depending on the consents granted, information such as:visited subpages,source of visit,device information,events performed on the website,interactions with content or advertisements.
Technologies requiring consent are activated in accordance with the user's choices regarding cookies and similar technologies.

§ 13. Transfer of data outside the European Economic Area

Some technology providers used by Nexeltron may process data outside the European Economic Area.
In such a case, the transfer of data takes place in accordance with GDPR requirements.
Depending on the case, the following may be applied in particular:European Commission decisions stating an adequate level of protection,standard contractual clauses,other mechanisms provided for by applicable regulations.
The user can contact Nexeltron to obtain additional information regarding the applied safeguards.

§ 14. Data retention period

Data is stored for the period necessary to achieve the purpose for which it was collected.

In particular:

Data regarding contracts, orders, and memberships – for the duration of the contract, and then for the period required by regulations and until the expiry of any claims.
Accounting and tax documentation – for the period required by law.
Account data – for the period of having an active Account, and then for the period necessary to fulfill legal obligations or protect claims.
Reservation data and service history – for the period necessary to provide services, manage the Account, and fulfill Nexeltron's legitimate purposes, and then in accordance with legal requirements.
Data regarding complaints – for the duration of the complaint procedure and an appropriate period related to the possibility of pursuing claims.
Data processed based on consent – until its withdrawal, unless there is another legal basis for further processing.
Marketing data processed based on a legitimate interest – until an effective objection is raised or the purpose of processing ceases.
Technical logs and security data – for a period justified by the need to ensure security, diagnostics, and protection against abuse.

§ 15. Rights of the data subject

The data subject may have – depending on the basis and circumstances of processing – the following rights:

Right of access to data – the ability to obtain information about processing and a copy of the data.
Right to rectification of data – the ability to correct inaccurate data or complete incomplete data.
Right to erasure of data – in cases provided for by the GDPR.
Right to restriction of processing – in cases provided for by the GDPR.
Right to data portability – if processing is carried out by automated means based on consent or a contract and other GDPR conditions are met.
Right to object – to processing based on the Controller's legitimate interest, including direct marketing.
Right to withdraw consent – at any time, if processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The Polish Data Protection Authority (UODO) indicates that the controller should inform, among other things, about the right of access, rectification, erasure, restriction, data portability, and objection. (UODO)

§ 16. How to exercise your rights

Requests regarding personal data can be sent to:

nexeltron@nexeltron.com

To protect data, the Controller may request information to confirm the identity of the person submitting the request.
The Controller responds to requests in accordance with the deadlines and principles resulting from applicable regulations.

§ 17. Right to lodge a complaint

A person who believes that their data is being processed unlawfully has the right to lodge a complaint with the supervisory authority.
In Poland, the supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)

Exercising the right to complain does not limit the possibility of contacting Nexeltron beforehand to clarify the matter.

§ 18. Automated decision-making and profiling

Nexeltron may use automation to improve website operation, communication, Reservations, and user support.
If Nexeltron employs automated decision-making that produces legal effects concerning the individual or similarly significantly affects them, that individual will receive the information required by the GDPR.
Data may be used for personalization of communication or content if there is an appropriate legal basis.
The mere analysis of service usage or assigning a user to a specific marketing segment does not automatically mean automated decision-making that produces legal effects.

§ 19. Monitoring at Nexeltron locations

Selected Nexeltron locations may be subject to video surveillance for the purpose of:ensuring personal safety,protecting property,preventing incidents,determining the circumstances of events.
Monitoring is used only in places where it is lawful and justified.
Monitoring should not cover areas where the user has a reasonable expectation of particular privacy.
Information about the use of monitoring is provided at the given Location.
Recordings are stored for the period necessary for the purpose of monitoring, unless specific material is necessary to clarify an incident or pursue claims.

§ 20. Data Security

Nexeltron employs appropriate technical and organizational measures to protect personal data.
These measures may include, in particular:access control,security of IT systems,authentication mechanisms,restriction of data access to authorized persons,backup copies,security monitoring,incident response procedures.
The scope of applied safeguards is adapted to the nature of the data and the risk associated with their processing.

§ 21. Data of minors

Nexeltron's services are generally intended for adults, unless the rules of a specific service explicitly state otherwise.
If the use of a specific service by a minor is permissible, Nexeltron may require the consent or participation of a parent or legal guardian in accordance with applicable regulations.
Nexeltron does not intend to knowingly obtain data of minors to an extent not required for the provision of a specific service.

§ 22. Data of business partners and contact persons

As part of B2B cooperation, Nexeltron may process data of:entrepreneurs,company representatives,employees,collaborators,contact persons.
Data may include, in particular:name and surname,position,organization name,business email address,phone number,information related to ongoing cooperation.
The basis for processing is, respectively, the performance of a contract or the legitimate interest of the Administrator, consisting in maintaining business contacts and realizing cooperation.

Data of persons representing companies or being contact persons may also constitute personal data covered by the GDPR. (UODO)

§ 23. Links to external services

The Nexeltron website or application may contain links to external websites and services.
External entities may have their own data protection policies.
Nexeltron does not determine the purposes and methods of data processing by independent external services solely because the user was redirected to them via a link.

§ 24. Changes to the Privacy Policy

The Privacy Policy may be updated, in particular, in the event of:changes in regulations,development of Nexeltron's operations,launch of new Locations,development of Nexeltron App,development of Nexeltron OS,introduction of new features or services,changes in technologies used.
The current version of the Policy is published on nexeltron.com.
The effective date of the current version is indicated at the beginning of the document.

§ 25. Contact

For matters concerning privacy and personal data protection, you can contact Nexeltron:

PROSPER Andrzej Janda
ul. Miła 17A
78-400 Szczecinek