Privacy Policy
This Privacy Policy explains how we process the personal data of people who use nexalyq.pl, contact us, or express an interest in NEXALYQ services.
Last updated: 22 October 2026
1. Data controller
The controller of your personal data is Yurii Rovinskyi, operating under the NEXALYQ brand (the “Controller” or “NEXALYQ”). NEXALYQ is a brand name and does not represent a registered company or a separate legal entity.
For privacy and personal-data matters, contact the Controller at hello@nexalyq.pl.
Postal address: [ADD ADDRESS].
2. Personal data we process
Depending on how you use the website, we may process:
- the content of conversations with us via the website chat, Facebook Messenger, Instagram Direct or Telegram, your account identifier in the messaging app, and information about the ad from which the conversation started;
- data submitted through the contact form, such as your name, email address, telephone number, company name, and message;
- information provided during correspondence, consultations, quotation preparation, or contract performance;
- billing data required to issue accounting documents;
- technical data, such as your IP address, device and browser type, visit date and time, pages viewed, and cookie data;
- records of consent and privacy preferences.
We do not ask you to provide special categories of personal data. Please do not include such information in forms or messages unless it is necessary.
3. Purposes, legal bases, and retention periods
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to enquiries and communicating before entering into a contract | Article 6(1)(b) GDPR or Article 6(1)(f) GDPR — our legitimate interest in handling enquiries | Until the communication ends and then for as long as necessary to establish, exercise, or defend legal claims |
| Preparing a quotation and entering into and performing a contract | Article 6(1)(b) GDPR | For the duration of the contract and then for the period required by law or until claims become time-barred |
| Accounting and tax obligations | Article 6(1)(c) GDPR | For the period required by applicable tax and accounting laws |
| Website security, error diagnosis, and protection against claims | Article 6(1)(f) GDPR — website security and protection of the Controller’s rights | Until the purpose ends or claims become time-barred; technical logs follow the hosting provider’s retention period |
| Analytics and website performance measurement | Article 6(1)(a) GDPR — consent, where optional cookies or similar technologies are used | Until consent is withdrawn or the retention period of the relevant tool expires |
| Commercial communications or a newsletter | Article 6(1)(a) GDPR — consent, together with applicable electronic-communications rules | Until consent is withdrawn; evidence of consent may be kept as long as necessary to demonstrate compliance |
| Handling conversations in the AI chat and messaging apps (Messenger, Instagram, Telegram, website chat) | Article 6(1)(b) and (f) GDPR | 12 months from the last message; sales enquiry data — up to 24 months from the last contact |
Providing data through the contact form is voluntary, but without the required information we may be unable to respond. Data required to enter into or perform a contract is necessary to handle the engagement.
4. AI chat, messaging apps and social media
You can contact us through the website chat, Facebook Messenger, Instagram Direct, Telegram, or by replying to our ads on Meta platforms. Messages in these channels are handled first by an AI assistant — replies are generated automatically by an artificial intelligence model. You can ask to speak to a human at any time.
- What data: message content, your account identifier in the messaging app, your name or profile name, data you provide in the conversation (e.g. phone number, email, company name), and information about the ad from which you started the conversation.
- Purpose and legal basis: replying to your enquiry, preparing an offer and arranging a call — Article 6(1)(b) and (f) GDPR.
- Summary for our team: the assistant may prepare a short summary of your enquiry and an assessment of its urgency for our team. This has no legal or similarly significant effects on you.
- Retention: we keep conversation history for 12 months from the last message, and sales enquiry data for up to 24 months from the last contact, unless we enter into a contract.
- Please do not send health data or other special categories of personal data in the chat.
For our Facebook and Instagram profiles, Meta Platforms Ireland Ltd. also processes data under its own rules (Meta Privacy Policy). For profile statistics (Insights), we are joint controllers together with Meta.
5. Recipients of personal data
We may entrust data to service providers supporting the website and our activities, including providers of:
- hosting, domains, email, and backups;
- forms, CRM, automation, and communications tools;
- analytics services, in accordance with your consent choices;
- accounting, legal, and IT services;
- payment or other services necessary to perform a contract, where applicable.
In particular, we use the services of: OpenAI (generating AI assistant replies), the provider of our own server running the n8n message-automation platform ([PROVIDER NAME, COUNTRY]), Meta Platforms Ireland Ltd. (Messenger, Instagram, ads), Telegram (Telegram bot and notifications for our team), Google (Google Analytics 4 — only with your consent), and our website hosting provider.
We may also disclose data to authorised public authorities where required by law. Processors act on our instructions and under appropriate agreements where required.
6. Transfers outside the EEA
Some technology providers may process data outside the European Economic Area. Where this occurs, we use safeguards required by the GDPR, such as a European Commission adequacy decision or Standard Contractual Clauses and, where necessary, supplementary measures.
This applies in particular to OpenAI and Google (USA) and to Telegram. You can obtain details of the safeguards applied by writing to the address given in section 1.
7. Your rights
Subject to the conditions set out in the GDPR, you may request:
- access to your data and a copy of it;
- rectification of your data;
- erasure of your data;
- restriction of processing;
- data portability;
- an objection to processing based on legitimate interests.
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise your rights, contact us using the details in section 1. We may request additional information needed to confirm your identity.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) if you believe your data is processed unlawfully.
Deleting conversation data. To delete data from conversations via the website chat, Messenger, Instagram or Telegram, email hello@nexalyq.pl with the subject “Data deletion” and tell us the channel and the profile name you wrote from. We will delete the conversation history and related data within 30 days, unless the law requires us to keep it longer.
8. Automated decision-making
We do not make decisions about users based solely on automated processing where those decisions produce legal effects or similarly significantly affect them.
9. Cookies
The website uses cookies and similar technologies. Information about their categories, purposes, duration, and consent controls is available in our Cookie Policy.
10. Security
We use appropriate organisational and technical measures to protect personal data against loss, unauthorised access, alteration, or disclosure. Safeguards are adapted to the nature of the data and the risks involved.
11. Changes to this Privacy Policy
We may update this Policy when the law, the website, or the tools we use change. The current version and its update date are always available at https://nexalyq.pl/en/privacy/.