Privacy Policy

1. Data Controller

The controller of your personal data is Onyx NxtGen s.r.o., with registered office at Plzeňská 3352/156, Smíchov, 150 00 Prague 5, Czech Republic, Reg No: 234 28 643. For any privacy-related inquiries, you can contact us at info@nysapouches.co.

2. Types of Data and Collection

We process only the data necessary to provide our services and ensure website functionality:

• Contact details: When using the contact form, we process your name, e-mail address, and the content of your inquiry. Providing this data is a contractual requirement for us to respond to your request; without it, we cannot process your inquiry.
• Technical and analytical data: We use Google Analytics 4 (GA4) to collect anonymized information. Data is processed by Google Ireland Ltd. and may be transferred to Google LLC in the USA under the EU-U.S. Data Privacy Framework.
• Consent Management: We use the Cookiebot tool to manage and store your preferences regarding cookies and tracking technologies.

3. Purpose and Legal Basis

Your data is processed based on the following legal grounds:

• Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR): Handling inquiries from the contact form to provide a quote or information you requested.
• Legitimate Interest (Art. 6(1)(f) GDPR): Handling and responding to inquiries sent via the contact form and ensuring the security and technical optimization of our website.
• Consent (Art. 6(1)(a) GDPR): Analysis and advanced tracking are carried out only if you grant explicit consent via the cookie banner.

4. Data Retention

We store your personal data only for as long as necessary for the purposes for which it was collected:

• Contact form data: If a contract is not concluded, data is stored for a maximum of 2 years from the last communication for the purpose of potential future collaboration.
• Analytical data: Anonymized data in GA4 is stored for a period of 14 months.
• Legal obligations: If required by law (e.g., accounting or tax purposes), data is stored for the duration of the statutory period.

5. Third-Party Services

To provide our services, we use trusted processors who comply with high security standards:

• Google Ireland Ltd. (Google Analytics 4 and Google Apps Script): Used for anonymized analysis and as a technical interface for form delivery. Google LLC (USA) may act as a sub-processor.
• Usercentrics A/S (Cookiebot): Used to manage your privacy preferences and store consent logs.

6. Your Rights

Under GDPR, you have the right to access your data, rectify or erase them, the right to restrict processing, and the right to data portability. You also have the right to object to processing based on legitimate interest.

Withdrawal of Consent: You have the right to withdraw your consent to data processing (e.g., for cookies) at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent via the Cookiebot settings on our website.

If you believe your data is being handled unlawfully, you have the right to lodge a complaint with the relevant supervisory authority (in CZ: ÚOOÚ, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz).

7. Data Security

We implement strict technical and organizational measures, including encryption (SSL/TLS) and access control, to protect your personal data from unauthorized access, loss, or misuse.