Privacy Policy

The data controller responsible for your personal information is Digital Bug s.r.o., Okružná 20, 058 01 Poprad, Slovak Republic. IČO: 54330483. Email: info@nexthorppf.com.

We comply with the EU General Data Protection Regulation (Regulation 2016/679, "GDPR") and Act No. 18/2018 Coll. of the Slovak Republic on Personal Data Protection.

Data Protection Officer: We have not appointed a Data Protection Officer because we are not legally required to do so under GDPR Article 37. For all privacy-related questions or to exercise your rights, contact us at info@nexthorppf.com with the subject line "GDPR Request".

This Privacy Policy applies to four categories of individuals interacting with our Services:

• Retail customers who browse the store, create an account, or place an order for our PPF products.
• B2B partners and applicants who apply to or participate in our Installer Club, Pilot, Scout, or Starter Pack programs.
• Visitors who browse the website without creating an account or making a purchase.
• Contacts who submit a contact form, send an email, or otherwise communicate with us.

For all visitors and customers

• Contact details including your name, address, billing and shipping address, phone number, and email address.
• Account information including your email address, login credentials managed through Shopify, account preferences, settings, and order history.
• Communications including the information you provide when contacting us.
• Device information including device, browser, network, IP address, and unique identifiers.
• Usage information including how and when you interact with the Services.

For retail customers

• Transaction information including items viewed, added to cart, purchased, returned, or exchanged.
• Payment information processed by our payment providers. We receive limited payment information such as payment status, transaction ID, payment method type, billing details, and fraud or risk signals. We do not store full payment card numbers.

For B2B partners and applicants

• Application information including studio or company name, business registration number (IČO, VAT or equivalent), business address, website URL, estimated monthly PPF volume.
• Activity records including cashback rank, approved installation count, milestone progress, commission earnings, payout history, and network referral relationships.
• Agreement consent records including agreement type and version, timestamp, IP address, user agent, and the URL of consent.

Under GDPR Article 6, every processing activity must have a lawful basis. The following sections summarize what we do, what data we use, why, and how long we keep it.

Order processing and fulfillment

Legal basis: Performance of a contract (Art. 6(1)(b)). Retention: 10 years for invoices (Slovak Accounting Act No. 431/2002).

Customer account management

Legal basis: Performance of a contract (Art. 6(1)(b)). Retention: Until account deletion plus 1 year backup.

Marketing emails and promotions

Legal basis: Consent (Art. 6(1)(a)). Retention: Until consent is withdrawn plus 3 years.

Analytics and personalization

Legal basis: Consent for non-essential cookies (Art. 6(1)(a)); legitimate interest for aggregated analytics (Art. 6(1)(f)). Retention: Up to 26 months, depending on our analytics configuration.

Targeted advertising (Meta Pixel, ad networks)

Legal basis: Consent (Art. 6(1)(a)). Retention: According to your cookie settings and the retention periods of the relevant advertising platforms.

B2B partner verification and onboarding

Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interest in fraud prevention (Art. 6(1)(f)). Retention: Application period plus 3 years if not approved; duration of partnership plus 10 years if approved.

B2B partner performance and payout

Legal basis: Performance of a contract (Art. 6(1)(b)) and legal obligation for tax compliance (Art. 6(1)(c)). Retention: Duration of partnership plus 10 years.

Agreement consent logs

Legal basis: Legal obligation (Art. 6(1)(c)) and legitimate interest in legal defense (Art. 6(1)(f)). Retention: Duration of partnership plus 10 years.

Security, fraud prevention, and abuse detection

Legal basis: Legitimate interest (Art. 6(1)(f)). Retention: Server logs 12 months; fraud investigation files up to 5 years.

Customer support

Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). Retention: Contact form submissions 2 years; support tickets 3 years.

Legal compliance

Legal basis: Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).

We use cookies and similar tracking technologies. Cookies fall into four categories:

Strictly necessary cookies

Required for the website to function. These cookies enable basic features such as shopping cart, login, checkout, and security. They cannot be disabled. Provider examples: Shopify cookies used for cart, checkout, login, security, fraud prevention, and store functionality.

Functional cookies

Remember your preferences such as language, region, currency, and theme settings. Legal basis: Consent.

Analytics cookies

Help us understand how visitors use the site. Provider examples: Google Analytics, Shopify Analytics, and similar analytics services. Legal basis: Consent. Retention: Up to 26 months, depending on our analytics configuration.

Marketing and advertising cookies

Used for personalized advertising on third-party platforms. Provider examples: Meta Pixel, Google Ads, Klaviyo tracking pixel, and similar advertising services. Legal basis: Consent. Retention: According to your cookie settings and the retention periods of the relevant advertising platforms.

Managing your cookie preferences

Where required by law, our website displays a cookie banner allowing you to manage your cookie preferences. You can change your choice at any time:

• Click "Manage preferences" in the cookie banner to update your Required, Personalization, Marketing, and Analytics cookie choices.
• Adjust your browser settings to block or delete cookies.
• Enable the Global Privacy Control signal in your browser.

We may disclose your personal information to third parties for legitimate purposes, including:

• Shopify Inc. our e-commerce platform host, for IT management, payment processing, customer accounts, and fulfillment.
• Klaviyo, Inc. for email marketing and customer segmentation. Klaviyo is based in the United States.
• Google LLC for website analytics through Google Analytics with IP anonymization enabled.
• Meta Platforms, Inc. for advertising performance measurement on Facebook and Instagram through the Meta Pixel.
• Shipping carriers (DHL, GLS, Slovak Post, or others) for order fulfillment.
• Payment processors (Shopify Payments, Stripe, PayPal, or others) who process payment data directly.
• Other Nexthor partners in the Partner Network when necessary to operate the multi-level commission structure. Upstream partners (up to three levels) may see limited activity data such as your studio name, region, rank, and number of installations. They will not see your direct contact details, payout information, bank or payment details, or detailed personal profile data.
• Public authorities when required by law.

We do not sell your personal data. We do not sell, rent, or trade your personal information to third parties for their own marketing purposes.

If you apply to or participate in one of our partner programs (Installer Club, Pilot, Scout, Starter Pack), the following additional provisions apply:

• Identity verification. We verify your business registration through public databases (Finstat, Obchodný register SR, or equivalent EU registries).
• Agreement consent logging. When you accept a partner agreement, we log the agreement type, version, your IP address, timestamp, user agent, and the URL of the consent page. Retained for the duration of the partnership plus 10 years.
• Performance and earnings tracking. We track your approved installations, rank progression, cashback, milestones, and commissions.
• Public directory visibility. Your studio name, region, and verified partner status may appear on our public installer directory only with your opt-in consent.
• Internal network visibility. Other partners in your network may see limited activity data such as studio name, region, rank, and number of installations. They will not see your direct contact details, payout information, bank or payment details, or detailed personal profile data.
• Payout records. Retained for 10 years as required by Slovak law.

Under GDPR you have the following rights with respect to your personal information:

• Right of Access (Art. 15) request a copy of your personal data.
• Right to Rectification (Art. 16) correct inaccurate or incomplete data.
• Right to Erasure (Art. 17) request deletion. Data we are required to retain for legal or accounting purposes (invoices, partner agreement consent logs, commission records) cannot be deleted before the statutory retention period expires.
• Right to Restriction (Art. 18) temporarily limit processing.
• Right to Portability (Art. 20) receive data in machine-readable format.
• Right to Object (Art. 21) object to processing based on legitimate interest or direct marketing.
• Right to Withdraw Consent for consent-based processing.
• Right not to be Subject to Automated Decision-Making (Art. 22) we do not currently use such automated decision-making.

To exercise any of these rights, email info@nexthorppf.com with the subject line "GDPR Request". We will respond within 30 days as required under GDPR Article 12(3), with the possibility of extension by a further two months for complex requests.

We protect your personal information through reasonable security measures, including encryption of data in transit via TLS (HTTPS), restricted access controls for authorized personnel, and contractual safeguards with our service providers (Shopify, Klaviyo, payment processors), who maintain SOC 2 and equivalent certifications.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Slovak Data Protection Authority within 72 hours and, where required by law, notify you directly.

Please be aware that no security measures are perfect or impenetrable. We recommend not using unsecure channels to communicate sensitive or confidential information to us.

We may transfer, store and process your personal information outside the country you live in, including in countries outside the European Economic Area (EEA) and the United Kingdom.

Where we transfer your personal information outside the EEA or the UK, we rely on appropriate safeguards recognized under applicable law. Depending on the recipient and the specific service, these may include the EU-US Data Privacy Framework, Standard Contractual Clauses approved by the European Commission, data processing agreements, binding corporate rules, or other legally recognized safeguards.

The Services are not intended for children under 16. We do not knowingly collect personal information about children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@nexthorppf.com and we will delete it.

If you have complaints about how we process your personal information, please contact us first at info@nexthorppf.com. You also have the right to lodge a complaint with your local data protection authority.

For the Slovak Republic, the supervisory authority is:

Úrad na ochranu osobných údajov Slovenskej republiky
Hraničná 12, 820 07 Bratislava 27, Slovak Republic
Phone: +421 2 3231 3214
Email: statny.dozor@pdp.gov.sk
Website: dataprotection.gov.sk

We may update this Privacy Policy from time to time. We will post the revised Privacy Policy on this website and update the "Last updated" date. For material changes, we will notify registered customers and active B2B partners by email at least 30 days before the changes take effect.