Privacy Policy
Effective from: 15 February 2025
1. Controller
The controller of your personal data is NEOFENIX SP. Z O.O., ul. Taneczna 37A, 02-819 Warszawa, Poland, KRS 0001070937, NIP 9512582932, REGON 527020121 ("we").
For all matters relating to personal data, write to [email protected] or to the postal address above. We have not appointed a Data Protection Officer.
2. What data we process
- Account data: first and last name, e-mail address, phone number, profession, company or clinic name, VAT/Tax ID, country, address, preferred language, your professional-status declaration and your login details.
- Pre-order and order data: ordered Products, quantities and amounts, delivery details (recipient, address, phone, e-mail), company details for the invoice, comments, the chosen delivery and payment method, correspondence about the order.
- Contact form data: name, e-mail address, phone number (optional), topic and content of the message, and, to protect the form against spam, the IP address and browser information.
- Technical data: IP address, date and time of the request and browser information recorded in server logs, and the session identifier (see section 8).
Providing data is voluntary, but without the data marked as required we cannot create an Account, handle a Pre-order or answer a message. The Store is not intended for persons under 18.
Sources of data. We receive data mainly from you. To verify your professional status we may check data in public registers (for example CEIDG, KRS, VIES and professional registers). If you provide data of another person (for example a delivery recipient or an employee), please inform them of this and of this Policy.
3. Purposes, legal bases and retention
| Purpose | Legal basis (GDPR) | How long we keep the data |
|---|---|---|
| Account and Store services (cart, Pre-orders, order history) | Art. 6(1)(b) – performance of the contract for electronic services | Until the Account is deleted |
| Handling Pre-orders, issuing Proformas, concluding and performing sales contracts, delivery, complaints | Art. 6(1)(b) – performance of a contract and steps before entering into it | Until the contract is performed, then as below |
| Checking that the Store is used only by professionals; compliance with the rules on medical devices, including traceability | Art. 6(1)(c) – legal obligation; Art. 6(1)(f) – our legitimate interest in selling only to authorised persons | For the duration of the Account and the limitation period for claims |
| Accounting and tax | Art. 6(1)(c) – legal obligation | 5 years from the end of the calendar year in which the tax payment deadline expired (Article 86 of the Polish Tax Ordinance) |
| Establishing, pursuing and defending claims | Art. 6(1)(f) – legitimate interest | Until the limitation periods expire |
| Answering messages from the contact form and e-mail | Art. 6(1)(f) – legitimate interest in replying | 12 months after the matter is closed; IP address and browser information – 30 days |
| Security of the Store, preventing abuse, server logs | Art. 6(1)(f) – legitimate interest | Up to 12 months |
| Unfinished carts | Art. 6(1)(f) – legitimate interest in keeping your cart | Up to 12 months of inactivity |
| Website statistics (Google Analytics) | Art. 6(1)(a) – your consent in the cookie banner | Until you withdraw consent; statistics are kept in Google Analytics for up to 14 months |
| Measuring and showing our ads (Google Ads) | Art. 6(1)(a) – your consent in the cookie banner | Until you withdraw consent; cookie lifetimes – see section 8 |
| Showing the Google map after you click "Show map" | Art. 6(1)(a) – your consent given by clicking | See section 8 |
We do not send newsletters. Only if you consent to marketing cookies, Google Ads may use information about your visit to show you our ads on other sites (advertising profiling); you can refuse or withdraw this consent at any time. We do not make decisions producing legal effects based solely on automated processing.
4. Who receives your data
We share data only to the extent necessary.
Processors acting on our behalf (under data processing agreements):
- our hosting provider (the server is located in Poland);
- Cloudflare, Inc. – content delivery network and protection of the website;
- Mailgun Technologies, Inc. – sending e-mails from the Store (EU region);
- our accounting office;
- Google Ireland Limited – Google Analytics statistics (only with your consent).
Separate controllers processing data for their own purposes:
- courier and postal companies – to deliver orders;
- banks – to process payments;
- legal advisers;
- Google Ireland Limited and Google LLC – Google Ads (only with your consent) and Google Maps (after you click "Show map");
- public authorities, where required by law.
5. Transfers outside the European Economic Area
Some of our providers (Cloudflare, Mailgun, Google) belong to US groups. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.
If you order delivery to a country outside the EEA (for example Ukraine), your delivery details are transferred to that country because this is necessary to perform the contract (Art. 49(1)(b) GDPR).
6. Your rights
You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, write to [email protected]. We reply within one month.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland, or with the supervisory authority of the EU Member State where you live or work.
7. Security
The Store works only over an encrypted connection (HTTPS). Access to data is limited to authorised persons.
8. Cookies and similar technologies
Necessary cookies are always on. Analytics and marketing cookies are used only if you agree to them in the cookie banner; you can change your choice at any time via “Cookie settings” at the bottom of every page.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| PHPSESSID | Cookie | Keeps you signed in and remembers your cart and language | Until the browser is closed |
| cookieConsent | Browser local storage | Remembers your cookie choice and acceptance of the Terms | 12 months, then we ask again |
| professionalConsent | Browser local storage | Remembers your confirmation that you are a professional | 24 hours, then we ask again |
| _ga | Cookie (Google Analytics, only with consent) | Distinguishes visitors for statistics | 2 years |
| _ga_<ID> | Cookie (Google Analytics, only with consent) | Keeps the state of the visit for statistics | 2 years |
| _gcl_au | Cookie (Google Ads, only with consent) | Measures the effect of our ads (conversions) | 90 days |
The first three are strictly necessary to provide a service you request, so under Article 399 of the Polish Electronic Communications Law they do not require consent. The Google Analytics and Google Ads cookies are set only after your consent (Article 399 of that law and Art. 6(1)(a) GDPR); until then the Google tags are not loaded at all.
Google Maps. The map on our website is loaded only after you click "Show map". From that moment Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA) receives your IP address, the address of the page and information about your browser, and may set its own cookies (for example NID, AEC, SOCS, with lifetimes of up to 13 months). Google processes this data as a separate controller under its own rules. Google LLC is certified under the EU-U.S. Data Privacy Framework. More information:
- Google Privacy Policy
- How Google uses information from sites that use its services
- Cookies used by Google
- Google Maps Additional Terms of Service
Google Analytics and Google Ads. If you agree to analytics cookies, Google Ireland Limited processes data about your visit (pages viewed, device and browser information, approximate location; Google Analytics 4 does not store IP addresses) on our behalf to prepare statistics. If you agree to marketing cookies, Google uses data about your visit as a separate controller to measure the effectiveness of our ads and to show you our ads on other sites. Google LLC is certified under the EU-U.S. Data Privacy Framework. You can manage personalised ads in My Ad Center and install the Google Analytics opt-out browser add-on.
You can delete cookies and local storage data at any time in your browser settings.
9. Changes to this Policy
We may update this Policy, for example when our services or the law change. The current version is always available on this page with its effective date.