PRIVACY POLICY

This Privacy Policy sets out the rules governing the collection, use, storage and protection of personal data of users of the website https://neex.shop (hereinafter referred to as the “Website”), owned and operated by NEEX COSMETICS Iryna Boyko, registered in accordance with the laws of the Republic of Poland (hereinafter referred to as the “Controller”).

We process personal data in accordance with the applicable laws of the European Union, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

1. Data Controller

The Controller of personal data is:

NEEX COSMETICS Iryna Boyko

Address: ul. Fabryczna 32/49, 05-500 Piaseczno, Poland

NIP: 7011311894

E-mail: neexcosmeticsoffice@gmail.com

Phone: +48519495385

For matters relating to the processing of personal data, users may contact the Controller at the above e-mail address.

2. What Personal Data We Process

Depending on how the Website is used, we may process:

• first and last name;
• e-mail address;
• telephone number;
• delivery address;
• data required to issue an invoice or other payment document;
• information concerning orders and purchased products;
• information concerning payments and their status;
• information voluntarily provided by the user when contacting us;
• technical data related to the use of the Website, including IP address, device and browser information, and activity on the Website, in accordance with cookie settings and applicable law.

Full payment card details are not stored on the Controller’s servers when payment is processed through an external payment provider.

3. Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

3.1. Processing and Fulfilment of Orders

Accepting, confirming and fulfilling orders, arranging payment and delivery of products, and contacting customers regarding their orders.

3.2. Compliance with Legal Obligations

Fulfilling obligations imposed by law, including accounting, tax and financial reporting obligations.

3.3. Customer Service

Responding to enquiries, handling customer requests, complaints and other communications with users.

3.4. Marketing

Sending information about products, new releases, promotions and special offers where there is an appropriate legal basis for doing so and, where required, with the user’s consent.

Users may withdraw their consent at any time.

3.5. Protection of Rights and Legitimate Interests

Establishing, exercising or defending against claims and legal proceedings, as well as protecting the legitimate interests of the Controller.

4. Legal Bases for Processing Personal Data

Personal data is processed on the legal bases provided for by the GDPR, including:

• the necessity to perform a contract or to take steps at the user’s request prior to entering into a contract;
• compliance with a legal obligation to which the Controller is subject;
• the legitimate interests of the Controller;
• the user’s consent, where consent is required.

5. Recipients of Personal Data

For the purpose of fulfilling orders and ensuring the operation of the Website, personal data may be transferred to or made accessible to authorised service providers, including:

• payment service providers;
• courier and postal services;
• hosting and IT service providers;
• software and service providers supporting the operation of the Website;
• accounting and legal service providers, where necessary;
• analytics and marketing service providers, in accordance with applicable law and the user’s consent settings;
• public authorities and other entities where required by law.

We do not sell users’ personal data to third parties.

6. Transfers of Data Outside the European Economic Area

Where personal data is transferred outside the European Economic Area (EEA), such transfers are carried out in accordance with the requirements of the GDPR.

Where applicable, the safeguards provided for by the GDPR are used to ensure an appropriate level of protection for personal data.

7. Retention of Personal Data

We retain personal data for as long as necessary to fulfil the purposes for which it was collected or for the period required by law.

In particular:

• order-related data is retained for the period necessary to perform the contract and fulfil legal obligations;
• accounting and tax data is retained for the periods required by applicable law;
• data processed on the basis of consent is retained until consent is withdrawn, unless another lawful basis permits further processing;
• data necessary to establish, exercise or defend legal claims is retained for the period necessary for the relevant proceedings.

After the applicable retention period has expired, the data is deleted or anonymised unless further retention is required by law.

8. Users’ Rights

Under the GDPR, users have the right to:

• access their personal data;
• request the rectification of inaccurate or incomplete data;
• request the erasure of personal data where provided for by law;
• request restriction of the processing of personal data;
• receive their personal data and request its transfer to another controller where provided for by the GDPR;
• object to the processing of personal data where provided for by the GDPR;
• withdraw consent to the processing of personal data at any time where processing is based on consent;
• lodge a complaint with the competent data protection supervisory authority.

To exercise their rights, users may contact the Controller at: neexcosmeticsoffice@gmail.com

9. Right to Lodge a Complaint

Users have the right to lodge a complaint with the supervisory authority responsible for personal data protection.

For a company registered in Poland, the competent authority is:

Prezes Urzędu Ochrony Danych Osobowych (UODO)

ul. Stanisława Moniuszki 1A

00-014 Warszawa

Poland

Users may also contact the Controller directly in order to resolve the matter.

10. Cookies

The Website uses cookies and similar technologies.

Cookies may be used for:

• ensuring the proper functioning of the Website;
• operating the shopping cart and order placement process;
• storing user preferences;
• analysing Website traffic and usage;
• improving the functionality of the Website;
• marketing purposes, where permitted by law and, where required, with the user’s consent.

Users can manage cookie settings through the tools available on the Website or through their browser settings.

11. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The level of security measures applied is appropriate to the nature and risks associated with the processing of personal data.

12. Automated Decision-Making and Profiling

If users are subject to automated decision-making or profiling falling within the scope of Article 22 of the GDPR, information concerning such processing, its logic, significance and possible consequences will be provided to the user in accordance with the requirements of the GDPR.

If such processing does not take place, this provision does not apply.

13. Changes to the Privacy Policy

We may update this Privacy Policy due to changes in applicable law, Website functionality, technologies used or methods of processing personal data.

The current version of the Privacy Policy is always available on the Website.

Last updated: 15.09.2026