Privacy Policy

Effective from: 15 February 2025

1. Controller

The controller of your personal data is NEOFENIX SP. Z O.O., ul. Taneczna 37A, 02-819 Warszawa, Poland, KRS 0001070937, NIP 9512582932, REGON 527020121 ("we").

For all matters relating to personal data, write to [email protected] or to the postal address above. We have not appointed a Data Protection Officer.

2. What data we process

Account data: first and last name, e-mail address, phone number, profession, company or clinic name, VAT/Tax ID, country, address, preferred language, your professional-status declaration and your login details.
Pre-order and order data: ordered Products, quantities and amounts, delivery details (recipient, address, phone, e-mail), company details for the invoice, comments, the chosen delivery and payment method, correspondence about the order.
Contact form data: name, e-mail address, phone number (optional), topic and content of the message, and, to protect the form against spam, the IP address and browser information.
Technical data: IP address, date and time of the request and browser information recorded in server logs, and the session identifier (see section 8).

Providing data is voluntary, but without the data marked as required we cannot create an Account, handle a Pre-order or answer a message. The Store is not intended for persons under 18.

Sources of data. We receive data mainly from you. To verify your professional status we may check data in public registers (for example CEIDG, KRS, VIES and professional registers). If you provide data of another person (for example a delivery recipient or an employee), please inform them of this and of this Policy.

3. Purposes, legal bases and retention

Purpose	Legal basis (GDPR)	How long we keep the data
Account and Store services (cart, Pre-orders, order history)	Art. 6(1)(b) – performance of the contract for electronic services	Until the Account is deleted
Handling Pre-orders, issuing Proformas, concluding and performing sales contracts, delivery, complaints	Art. 6(1)(b) – performance of a contract and steps before entering into it	Until the contract is performed, then as below
Checking that the Store is used only by professionals; compliance with the rules on medical devices, including traceability	Art. 6(1)(c) – legal obligation; Art. 6(1)(f) – our legitimate interest in selling only to authorised persons	For the duration of the Account and the limitation period for claims
Accounting and tax	Art. 6(1)(c) – legal obligation	5 years from the end of the calendar year in which the tax payment deadline expired (Article 86 of the Polish Tax Ordinance)
Establishing, pursuing and defending claims	Art. 6(1)(f) – legitimate interest	Until the limitation periods expire
Answering messages from the contact form and e-mail	Art. 6(1)(f) – legitimate interest in replying	12 months after the matter is closed; IP address and browser information – 30 days
Security of the Store, preventing abuse, server logs	Art. 6(1)(f) – legitimate interest	Up to 12 months
Unfinished carts	Art. 6(1)(f) – legitimate interest in keeping your cart	Up to 12 months of inactivity
Showing the Google map after you click "Show map"	Art. 6(1)(a) – your consent given by clicking	See section 8

We do not send newsletters or marketing messages, we do not use your data for profiling and we do not make decisions based solely on automated processing.

4. Who receives your data

We share data only to the extent necessary.

Processors acting on our behalf (under data processing agreements):

our hosting provider (the server is located in Poland);
Cloudflare, Inc. – content delivery network and protection of the website;
Mailgun Technologies, Inc. – sending e-mails from the Store (EU region);
our accounting office.

Separate controllers processing data for their own purposes:

courier and postal companies – to deliver orders;
banks – to process payments;
legal advisers;
public authorities, where required by law.

5. Transfers outside the European Economic Area

Some of our providers (Cloudflare, Mailgun) belong to US groups. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

If you order delivery to a country outside the EEA (for example Ukraine), your delivery details are transferred to that country because this is necessary to perform the contract (Art. 49(1)(b) GDPR).

6. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to [email protected]. We reply within one month.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, or with the supervisory authority of the EU Member State where you live or work.

7. Security

The Store works only over an encrypted connection (HTTPS). Access to data is limited to authorised persons.

8. Cookies and similar technologies

We use only what is necessary for the Store to work. No analytics or advertising cookies are used.

Name	Type	Purpose	Lifetime
PHPSESSID	Cookie	Keeps you signed in and remembers your cart and language	Until the browser is closed
cookieConsent	Browser local storage	Remembers that you have seen the cookie notice	Until you clear your browser data
professionalConsent	Browser local storage	Remembers your confirmation that you are a professional and accept the Terms	24 hours, then we ask again

These technologies are strictly necessary to provide a service you request, so under Article 399 of the Polish Electronic Communications Law they do not require consent.

Google Maps. The map on our website is loaded only after you click "Show map". From that moment Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) receives your IP address, the address of the page and information about your browser, and may set its own cookies (for example NID, AEC, SOCS, with lifetimes of up to 13 months). Google processes this data as a separate controller under its own rules. Google LLC is certified under the EU-U.S. Data Privacy Framework. More information:

You can delete cookies and local storage data at any time in your browser settings.

9. Changes to this Policy

We may update this Policy, for example when our services or the law change. The current version is always available on this page with its effective date.