Privacy Policy

NERON Store Privacy Policy

Online store: https://neronpila.pl/
Version dated 23 October 2026. Informational update dated 30 October 2026.

This Privacy Policy describes the rules for processing personal data of people using the NERON online store, particularly website visitors, people creating an Account, logging in, placing orders and contacting Store support.

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter the “GDPR”. Information about cookies and similar technologies is also provided in the separate Cookie Policy available in the Store.

1. Joint controllers and contact

The joint controllers of personal data are Krzysztof Przewoźniak and Marcin Wojciechowski, jointly trading as Neron Spółka Cywilna Przewoźniak Krzysztof, Wojciechowski Marcin, ul. Wybickiego 17, 64-920 Piła, NIP 7642675766, REGON 366187029, BDO 000363504. In the remainder of this document, “Controller” refers jointly to both joint controllers.

The joint controllers jointly determine the purposes and means of processing and jointly handle requests concerning individuals’ rights, without a permanent division of these matters between the partners. The common contact point is biuro@neronpila.pl. Regardless of joint handling, rights may be exercised against either joint controller.

• Email: biuro@neronpila.pl.
• Telephone: +48 664 726 856.
• Correspondence address: Neron S.C., ul. Wybickiego 17, 64-920 Piła.

2. Categories of data processed

The scope of data depends on how the Store is used. It may include:

• identification and contact details such as first name, surname, company name, address, email address, telephone number and NIP,
• customer Account data and information needed for login and Account administration,
• order data, selected payment and delivery methods, purchase history and accounting documents,
• content of correspondence, requests, complaints, returns, guarantee matters and reviews,
• data relating to analytics and advertising-effectiveness measurement, and records of consents given or withdrawn,
• technical and usage data such as IP address, browser and device information, session and cookie identifiers and security logs,
• if Google or Facebook login is selected, data used to confirm identity and create or link an Account, described in section 4.

3. Purposes, legal bases and processing periods

Customer Account and electronic services. We process data to create and administer the Account and provide selected electronic services. The basis is conclusion and performance of a contract under Article 6(1)(b) GDPR. Data necessary for Account administration are retained while it is maintained and, after the service ends, only to the extent and for the period justified by a legal obligation or establishment, exercise or defence of claims.

Google and Facebook login. We process data necessary for authentication and Account linking to perform the Account service selected by the user under Article 6(1)(b) GDPR. Linking data are needed while this login method is used. Rules for ending use of the link are described in section 4.

Orders, payments and deliveries. We process data to conclude and perform a sales contract under Article 6(1)(b) GDPR. We retain them during contract performance and afterwards to the extent required by legal obligations and for the period needed to establish, exercise or defend claims.

Invoices and accounting. We process data to fulfil tax and accounting obligations under Article 6(1)(c) GDPR for the period required by applicable provisions.

Complaints, returns and guarantees. We process data to handle the matter and fulfil the contract and legal obligations under Article 6(1)(b) and (c) GDPR. After the matter is closed, data may be retained to the extent necessary to establish, exercise or defend claims.

Contact and request handling. Processing is based on taking steps at a person’s request before entering into a contract or performing a contract under Article 6(1)(b) GDPR, or the Controller’s legitimate interest in handling correspondence under Article 6(1)(f) GDPR. We retain data while handling the matter and afterwards to the extent needed for protection against claims.

Correspondence and absence of a newsletter. We do not operate a newsletter or send promotional offer emails. We send messages needed to administer Accounts, orders and requests on the bases described above.

Product reviews. Depending on how the function is provided, we process data to perform the review-publication service or on consent under Article 6(1)(b) or (a) GDPR. Prevention of abuse is based on legitimate interest under Article 6(1)(f) GDPR. The processing period depends on how long the review is available, its removal rules and the need to retain evidence.

Security and claims. We process data to protect Accounts, prevent abuse, handle incidents and establish, exercise or defend claims. The basis is the Controller’s legitimate interest under Article 6(1)(f) GDPR. Retention depends on the nature of the event, security needs and applicable limitation periods.

Analytics and advertising using cookies. Where technologies require consent, we use them on that basis under Article 6(1)(a) GDPR and applicable rules concerning terminal equipment. After withdrawal, we stop further collection using technologies covered by the withdrawn consent. A cookie’s lifetime on a device is not the retention period in an analytics or advertising service. Cookie expiry or deletion and consent withdrawal do not automatically delete data previously sent to a provider. Previously collected data remain subject to the relevant service’s retention rules, purpose and legal-basis restrictions and the exercise of user rights described in section 7. Cookie lifetimes are described in the Cookie Policy. They must not be equated with server-side data retention.

4. Account login using Google or Facebook

4.1. Voluntary choice

The Store offers Google and Facebook login. The choice is voluntary. Email-and-password login is also available. Authentication with an external provider takes place within its service. The Store does not receive the Google or Facebook account password.

4.2. Scope of data

Google login uses the scopes openid, email and profile: account identifier, email address and verification information, and basic profile data, particularly first name and surname. This does not give access to Gmail, Google Drive, contacts or the calendar.

For Facebook login, we receive the account identifier and basic profile data provided during login, and the email address if shared within the selected authorisation process. The data scope and access granted are presented in the provider’s login process. Both methods also involve necessary authentication messages and technical session-security data.

4.3. Use of data

We use data to confirm identity, log in, create an Account once registration requirements are met or link a login method to an existing Account, and protect those actions. Linking requires confirmation of authority over the Account according to the Store procedure. External login does not replace acceptance of the Terms and Conditions or provision of data needed to fulfil an order.

Choosing Google or Facebook is not consent to analytics, advertising measurement or optional cookies. We do not share login data for those purposes merely because an external login method was chosen.

4.4. Disconnecting a login method and deleting data

We retain linking data while this method is used. Further retention requires a separate basis, such as a legal obligation or protection against claims. To disconnect the method or delete an Account or data, write to biuro@neronpila.pl. We consider the request after necessary confirmation of authority over the Account.

Application access can also be revoked in Google or Facebook account settings. This does not automatically delete the Store Account or order documentation. Deleting the Store Account does not delete the provider account. Before disconnecting, it is advisable to arrange an alternative access method.

4.5. Providers’ policies

Google and Meta process data relating to their own services under their privacy information provided through those services. Google Privacy Policy describes Google’s rules. The Controller is responsible for data received to administer the Store Account. Information on transfers outside the EEA is in section 6. Customer login is separate from authorisation of Neron Growth Desk operators described in section 12.

5. Data recipients

Data may be shared with or entrusted to entities involved in Store operations, only to the extent needed for a specific purpose, in particular:

• providers of hosting, PrestaShop platform maintenance, IT services, email and security,
• payment operators and banks, depending on the chosen payment method,
• carriers, parcel-locker operators and transport providers,
• the accounting firm, accounting-system providers and legal and tax advisers,
• Google in connection with login, GA4, Google Ads conversion measurement and the services described in section 12, to the extent appropriate to the processing purpose and basis,
• Meta in connection with the selected Facebook login, which does not mean using the Meta Pixel or Conversions API,
• OpenAI, for selected report excerpts sent for analysis using Codex/OpenAI, under section 12,
• public authorities and other authorised entities if disclosure is required by law.

Where an entity processes data on the Controller’s behalf, we use legally required data-processing agreements. Entities acting as separate controllers also process data according to their own privacy information.

6. Transfers outside the EEA

Using some technology providers, including Google, Meta and OpenAI, may involve processing outside the European Economic Area.

Any such transfer must rely on an appropriate mechanism provided by the GDPR, such as an applicable European Commission adequacy decision or standard contractual clauses with supplementary safeguards where required.

Information on the mechanism used for a particular provider and how to obtain a copy of the relevant safeguards can be obtained by contacting the Controller.

7. Data subjects’ rights

Under the conditions laid down in the GDPR, the user has:

• the right of access to data and to receive a copy,
• the right to rectify inaccurate data and complete incomplete data,
• the right to erasure and restriction of processing in cases provided by law,
• the right to data portability where processing is automated and based on consent or a contract,
• the right to object on grounds relating to a particular situation to processing based on legitimate interest,
• the right to object to processing for direct marketing, including related profiling,
• the right to withdraw consent at any time without affecting the lawfulness of processing before withdrawal,
• the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

Requests may be sent to biuro@neronpila.pl. Where necessary, we will request information needed to confirm identity or Account authority without requiring excessive data.

Withdrawal of consent concerns processing based on that consent. It does not automatically delete data that must be processed on another basis, such as documentation required by tax rules.

8. Voluntary provision of data

Data marked as required are needed to create and administer an Account, conclude and perform a contract or consider a request. Not providing them may prevent the selected action.

Choosing Google or Facebook login, providing optional data and giving marketing consent are voluntary. Marketing consent is not a condition of purchasing or creating an Account. Declining Google or Facebook does not prevent use of another available login method.

9. Cookies, analytics and advertising measurement

Necessary cookies serve, among other things, sessions, the cart, security and remembering consent choices. They operate separately from analytics and advertising. Details are in the Cookie Policy and SEIGI consent panel.

We use Google Analytics 4 (GA4) to analyse use of the Store. We use basic mode: GA4 starts after analytics consent, not before a choice or after refusal. Consent can be withdrawn in cookie settings. Withdrawal stops further analytics and deletes analytics cookies in the browser but does not automatically delete data previously lawfully collected.

We use Google Ads, with conversion measurement based on importing conversions from GA4. Consent to analytics alone is not consent to advertising use of data. Advertising measurement is subject to appropriate consent and its restrictions. We do not use remarketing.

The Store does not use the Meta Pixel, Meta Conversions API or other integrations for sending purchase events to Meta. This does not exclude communication needed for the selected Facebook login. NERON’s use of Facebook alone does not mean its tracking tools are installed in the Store.

Consents can be changed using the Store’s cookie settings button. Refusing or withdrawing optional consents does not prevent purchases, use of the cart or login. Clicking Google or Facebook login does not replace analytics and advertising consents.

10. Automated decisions and profiling

The Controller does not make decisions concerning the user with legal or similarly significant effects solely by automated means. We do not use remarketing. Advertising-effectiveness analyses and operational recommendations, including in Neron Growth Desk, are not automated decisions about customer rights.

11. Security and changes to the Policy

The Controller uses technical and organisational measures appropriate to risk, in particular access control, protection of data transmission, backups and incident-handling procedures.

The Policy may be updated if legislation, Store functions, processing methods or service providers change. The version date appears at the start. Material changes are communicated in a manner appropriate to their nature and applicable requirements.

A Policy change does not replace obtaining new consent or providing additional information where required for a new purpose or processing method.

12. Neron Growth Desk — internal analytics application

12.1. Purpose and users

Neron Growth Desk is a local application for authorised NERON operators. It monitors the store, marketing activities and costs and prepares reports and recommendations. It is not the Store’s customer-login system and is not required for purchases.

12.2. Google authorisation and resource access

The operator connects the application to Google via OAuth on Google’s screen. The application does not receive the Google password and uses access and refresh tokens. Access depends on operator permissions, selected resources, configuration and API availability. The application may retrieve available-resource lists and then read data from selected accounts.

Authorisation scopes include analytics.readonly, webmasters.readonly, content and adwords. The scopes content and adwords are broader than read-only access. Current collector and panel functions serve reading and local reporting. This does not mean that the OAuth permissions themselves are technically limited to read-only access.

12.3. Data categories and sources

• Google Ads: account and campaign identifiers and names, statuses, budgets, costs, impressions, clicks, conversions and values, search terms and budget-change information.
• GA4: property, currency and time-zone information and aggregate statistics on sessions, events, purchases and revenue. Reports are limited to selected neronpila.pl Store hosts.
• Google Search Console: properties, queries, URLs, clicks, impressions, CTR and positions.
• Merchant Center and Keyword Planner: reading product data and approval issues or keyword suggestions, search volumes, competition and bids is possible only after access to the relevant service/API is obtained. These functions are not currently treated as working data sources where access is blocked or has not been granted. Planner queries may use a website address or phrases specified by the operator.
• Local and technical data: configuration, resource choices, check times, connection statuses, errors, analyses and alerts. The application also reads the public home page, robots.txt and sitemap, checking matters including response status, title and indexing directives.

The standard collector does not retrieve Gmail, Google Drive files, contacts, calendars, full Store orders, delivery addresses, payment-card details or customer passwords. Reports must not automatically be considered anonymous, however. Identifiers, queries and URLs may contain information relating to individuals.

12.4. Purposes, bases and restrictions on use

Data serve performance summaries, cost and measurement-quality control, search-visibility analysis, error diagnosis and recommendations. For necessary personal data relating to operators, configuration and internal business monitoring, the basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR), taking account of individuals’ rights and interests. This does not replace consents required for collecting and advertising use of Store visitors’ data. Analytics and advertising-measurement data remain subject to purpose and consent restrictions described in sections 3 and 9. Granting OAuth access alone is technical authorisation, not an independent legal basis for unrestricted data processing.

The current application does not automatically change budgets, campaigns, advertisements or products. An alert does not block advertising expenditure. A recorded conversion need not mean a purchase. Its meaning depends on measurement configuration. Recommendations require operator assessment.

12.5. Storage, safeguards and deletion

Reports, configuration and history are stored locally in the application directory. Reports and copies are not synchronised with OneDrive or another cloud. This does not exclude separately sharing selected excerpts for analysis as described below.

Stored credentials are protected by Windows DPAPI tied to the Windows user account. Communication with services uses HTTPS. This protection does not automatically encrypt all report files. Computer and directory access should be limited to authorised people.

Application history is limited to 450 entries, with the oldest replaced when new ones are added. This is an entry-count limit, not a number of days. Latest-report files are overwritten. Stopping the application does not automatically delete data due to elapsed time.

At least every three months, we manually review reports and analyses and delete data no longer needed. When use of the application ends, we delete credentials, configuration and reports except specific data whose further retention is necessary because of a legal obligation or establishment, exercise or defence of claims. This is an organisational procedure, not an automatic application deletion function.

12.6. Operator access and analysis using Codex/OpenAI

Authorised operators have access. Selected report excerpts may be sent to Codex/OpenAI to prepare analyses and recommendations. This is a separate workflow. The collector has no direct AI API integration. Sending an excerpt to that service means it leaves the local computer even without cloud directory synchronisation.

We limit shared material to the necessary minimum. Tokens, passwords, full order details and other unnecessary personal data should not be included. The provider’s processing depends on the terms and settings of the service used. The collector’s local nature does not guarantee that material sent to an AI service stays exclusively local or within the EEA. Sections 5 and 6 apply to recipients and transfers.

12.7. Revoking access and individuals’ rights

The operator can revoke the connection in Google account settings. Once access is revoked, the application cannot make further reads using it. Revoking authorisation does not automatically delete previously downloaded local reports or copies. They require separate deletion.

For data access, objection or deletion matters, contact biuro@neronpila.pl. Section 7 describes rights and limitations. Deleting local application data does not delete Google accounts, campaigns, source analytics services, products or customer orders.