Privacy Policy

1. Who we are

NEXX GSM SERVICE POINT S.R.L., trading as NEXX GSM (“NEXX GSM”, “we”, “us”), is the controller of personal data processed under this Privacy Policy.

Registered address: Calea Moșilor 158, etaj 4, camera 4 M586, Sector 2, București, Romania

Email: [email protected]

Phone: +40 758 117 409

2. Information we collect

Depending on how you contact us or use our services, we may collect:

• Name and contact details, such as email address and phone number;
• Device information, such as laptop model, reported issue, BIOS screen code, and suffix;
• When you press Check code and price, we save your email with the BIOS code, result, price, language, source page, country and repeat count to handle your service enquiry. This is not an order or a marketing subscription. Our staff receive a Telegram notification with the code, email and check result to handle your enquiry;
• Order, payment, and service communication details;
• Technical data necessary to operate and secure the website, such as IP address, browser information, and security logs;
• Information you provide through email, Telegram, contact forms, or repair requests.

An email address is required to check a BIOS code and to request recovery, so we can contact you about your request. If you request a suffix launch notification, we save your email, suffix, optional BIOS code, language and request date to provide that notification at your request. This is not a paid order or a marketing subscription. You can cancel the request at [email protected].

3. Why we use your information

We process personal data to:

• Review and respond to service and BIOS recovery requests;
• Check compatibility and provide a quote or invoice where applicable;
• Process repair orders and provide customer support;
• Communicate about an order, payment, or service status;
• Prevent fraud, abuse, and unauthorized use of our services;
• Maintain website security and improve our services;
• Meet legal, accounting, and tax obligations.

4. Legal bases for processing

We process your data when:

• It is necessary to take steps at your request or perform a contract with you;
• It is necessary for our legitimate interests, including service security, fraud prevention, and improving our operations;
• We are legally required to retain certain information;
• You have given consent, where consent is required. You may withdraw consent at any time.

5. Ownership and authorization

The BIOS recovery service is intended only for device owners or repair shops acting with the owner’s written permission. We may request reasonable proof of ownership or authorization before providing a paid service. We use this information only to review the request, prevent misuse, and provide the requested service.

6. Who may receive your information

We do not sell personal data.

We share the data needed for hosting, email, payment, security, analytics and customer support. Providers acting as our processors follow our instructions under applicable data-processing terms. Payment and communications providers may also act as independent controllers for their own legal, security and service obligations, under their own privacy notices; they do not all act solely on our instructions.

We may also disclose information where required by law or necessary to protect our rights, users, or the public.

7. International transfers

Some service providers may process data outside the European Economic Area. Where this happens, we use appropriate safeguards required by applicable data-protection law, such as contractual protections approved by the European Commission.

8. How long we keep data

We retain request and support information only for as long as necessary to respond to the request, provide the service, resolve disputes, and meet legal obligations.

• Unpaid service requests: 12 months;
• Service and support records: 24 months after completion;
• BIOS contract snapshots, recorded choices, payment confirmations and withdrawal notices are kept as needed to perform and prove the contract, comply with accounting obligations and handle legal claims. Relevant legal retention periods and any unresolved dispute are assessed before deletion; this does not permit indefinite retention without a purpose;
• Invoices and payment records: for the period required by Romanian tax and accounting law;
• Security logs: 90 days.

9. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorized access, loss, misuse, or disclosure. No online service can guarantee absolute security.

10. Your rights

Subject to applicable law, you may request:

• Access to your personal data;
• Correction of inaccurate data;
• Deletion of data;
• Restriction of processing;
• Objection to processing based on legitimate interests;
• Data portability;
• Withdrawal of consent where processing is based on consent.

To exercise these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Romanian data-protection authority, ANSPDCP.

11. Cookies and analytics

Our website uses essential cookies and security technologies required for the site to function. With your consent, Google Analytics measures site usage and confirmed purchases, and Microsoft Clarity helps us understand clicks, scrolling and the order flow. BIOS form fields and payment details are masked in recordings.

Separately, with your advertising consent, Meta Ireland may receive server-side advertising measurement for page visits and confirmed purchases, including amount and currency. This may include technical identifiers, IP address, device and browser information. We do not send your name, email, BIOS or service codes. This measurement uses the server-side Conversions API, without a third-party browser pixel.

12. Changes to this policy

We may update this Privacy Policy when our services or legal obligations change. The latest version will always be published on this page with its updated date.