Privacy Policy of Nexus Digital Goods EOOD

Identification Number: 207978095
Address: Bulgaria, 1517 Sofia, Mimi Balkanska Str., 132
Website: Nexgoods.net
Data Protection Officer (DPO): Denys Semerenko
Email: info@nexgoods.net
Telephone: +447922142949

1. General Provisions
This Privacy Policy governs the personal data processing activities of Nexus Digital Goods EOOD (“the Operator”) in compliance with the Personal Data Protection Act of Poland and the General Data Protection Regulation (GDPR). It ensures adherence to laws and transparency in handling personal data.

2. Legal Bases for Processing
Under Article 6 of the GDPR, the Operator processes personal data based on the following legal grounds:

1. Consent
   ○ Personal data is processed based on explicit, informed, and voluntary consent provided by the data subject for specific purposes (e.g., receiving newsletters or marketing communications).
2. Contractual Necessity:
   ○ Processing is necessary for the performance of a contract to which the data subject is a party (e.g., processing orders, delivering purchased digital goods) or to take steps at the request of the data subject prior to entering into a contract.
3. Legal Obligation:
   ○ Processing is necessary for compliance with a legal obligation to which the Operator is subject (e.g., maintaining transaction records for tax compliance).
4. Legitimate Interests:
   ○ Processing is necessary for the purposes of legitimate interests pursued by the Operator or a third party (e.g., fraud prevention, improving services), provided these do not override the rights and freedoms of the data subject.
5. Public Interest or Official Authority:
   ○ Processing may be carried out for reasons of public interest or in the exercise of official authority vested in the Operator, where applicable.

3. Data Subject Rights
Data subjects have extensive rights under the GDPR, as outlined below:

1. Right to Access:
   ○ Data subjects have the right to request access to their personal data and obtain information about how their data is being processed.
2. Right to Rectification:
   ○ The right to correct inaccurate or incomplete personal data.
3. Right to Erasure (“Right to Be Forgotten”)
   ○ The right to request deletion of personal data, subject to legal and contractual obligations.
4. Right to Restrict Processing:
   ○ Data subjects may request a temporary halt to the processing of their data under specific circumstances.
5. Right to Data Portability:
   ○ The right to receive their personal data in a structured, commonly used, and machine-readable format and transmit it to another data controller.
6. Right to Object:
   ○ The right to object to data processing activities, including for direct marketing purposes.
7. Right Not to Be Subject to Automated Decision-Making and Profiling:
   ○ The right not to be subject to decisions made solely based on automated processing that significantly affects them.

To exercise any of these rights, data subjects may contact the DPO via the email provided above.

4. Cookie Policy
Our website uses cookies and tracking technologies to enhance user experience and analyze site traffic. These include:

1. Essential Cookies:
   ○ Necessary for the website to function properly.
2. Performance Cookies:
   ○ Help measure and improve website performance by collecting anonymous analytics data.
3. Analytics Cookies:
   ○ Allow us to understand user behavior and improve services.

Users can manage and withdraw consent for non-essential cookies via the cookie banner or browser settings.

5. Third-Party Data Sharing
Personal data may be shared with third-party service providers, including:

• Hosting Providers: Ensure secure data storage and website functionality.
• Payment Processors: Handle transaction payments and ensure compliance with financial regulations.
• Marketing Platforms: Deliver targeted advertisements and communications.

We ensure third parties comply with strict data protection requirements. Links to their privacy policies are available upon request.

6. Data Protection Officer (DPO)
Denys Semerenko serves as the appointed DPO, ensuring GDPR compliance and addressing data protection queries. You can reach the DPO using the contact information provided.

7. Data Retention Policy
The Operator retains personal data only as long as necessary for the purposes stated, including:

• Account Data: Retained while the account remains active.
• Transaction Data: Retained for a minimum of 5 years to comply with tax and legal obligations.
• Marketing Data: Retained until consent is withdrawn.

Specific retention periods for different categories of data are available upon request.

8. Data Breach Notification
In the event of a data breach, the Operator will notify affected individuals and the relevant supervisory authority within 72 hours, as required by GDPR Articles 33 and 34. Immediate steps will be taken to mitigate the breach and prevent recurrence.

9. Cross-Border Data Transfers
When transferring personal data outside the European Economic Area (EEA), we ensure appropriate safeguards, including:

• Standard Contractual Clauses (SCCs).
• Adequacy decisions by the European Commission.
• Binding corporate rules, where applicable.

10. Children’s Data
Our services are not intended for children under 16. We do not knowingly collect personal data from minors. If such data is discovered, it will be deleted immediately.

11. Digital Content Access and Use
After purchasing digital goods, users can access and activate their content as follows:

1. Log in to your personal account on our website.
2. Navigate to the “License Keys” section to retrieve your product key.
3. Verify that the activation region matches your Steam account region.
4. If needed, download and install the Steam client.
5. Log in to your Steam account or create a new one.
6. Go to the “Games” menu in the Steam client and select “Activate a Product on Steam…”.
7. Enter the activation key from your personal account.
8. Once activated, the game will appear in your Steam library for download and installation.

12. Automated Decision-Making and Profiling
The Operator does not engage in automated decision-making or profiling that produces legal or similarly significant effects on users.

13. Review and Update of Privacy Policy
This Privacy Policy is reviewed and updated regularly to reflect changes in data processing practices or legal requirements. The latest version is always accessible on our website.

Effective Date: January 23, 2025.