Privacy Policy

This Privacy Policy describes how NexoRush, operated by GlobalBay, collects, uses, shares, and protects personal information when users access the platform and related services, including any advertising, analytics, or third-party integrations.

By using NexoRush, you acknowledge this policy. If you do not agree, please discontinue use of the platform.

Data Controller

The data controller responsible for personal data processing is:

GlobalBay
De Nieuwe Erven 3 Unit 13664
5431 NV Cuijk
Netherlands
Email: [email protected]

For privacy-related requests or complaints, please contact us at the email above. We aim to respond within 30 days.

Information We Collect

We collect the following categories of personal data:

Account & Profile Data

• Name and email address
• Seller profile information
• Username and password (hashed)

Transaction Data

• Purchase and order records
• Payment method type (no full card details stored)
• Billing address

Technical & Usage Data

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time on site, click behavior
• Referral source and UTM parameters
• Cookie identifiers and advertising IDs

Communications Data

• Support messages and tickets
• Feedback and survey responses

Advertising & Analytics Data

• Ad interaction data (impressions, clicks, conversions)
• Behavioral and interest-based profiling data (via third-party tools)
• Hashed email addresses used for custom audience matching

Legal Basis for Processing

• Performance of a contract — account creation, purchases, and marketplace services
• Legal obligations — tax records, accounting, fraud prevention
• Legitimate interest — platform security, abuse prevention, and improving services
• Consent — advertising cookies, marketing communications, and behavioral tracking (where required under GDPR and ePrivacy Directive)

You may withdraw consent at any time by updating your cookie preferences or contacting us. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

How We Use Data

• Provide and improve marketplace services
• Process orders and transactions
• Prevent fraud, abuse, and unauthorized access
• Provide customer support
• Comply with legal obligations
• Send transactional and (with consent) marketing communications
• Serve personalized and interest-based advertisements
• Measure advertising effectiveness and campaign performance
• Build and target custom audiences on advertising platforms
• Conduct analytics to understand user behavior and improve UX

Cookies & Similar Technologies

We use cookies and similar tracking technologies for the following purposes:

You can manage, update, or withdraw your cookie consent at any time via our Cookie Settings panel.

Where required by law, we will only activate non-essential cookies (such as analytics and advertising cookies) after you have provided your explicit consent through our cookie banner.

You may also withdraw your consent for analytics and advertising cookies at any time. When consent is withdrawn, tracking technologies such as Google Analytics, Meta Pixel, and Microsoft UET will be disabled and no longer collect data from your device.

Additionally, you can configure your browser to block or delete cookies. However, please note that disabling certain cookies may affect the functionality of the platform.

Payment Processing

Payments are processed by third-party providers such as Stripe. NexoRush does not store credit card details. Payment data is handled directly and securely by these providers under their own privacy policies.

Stripe's privacy policy is available at stripe.com/privacy.

Data Sharing

Personal data may be shared with:

• Payment providers (e.g., Stripe) — to process transactions
• Email and communication services — to send transactional messages
• Analytics providers (e.g., Google Analytics) — to analyze platform usage
• Advertising platforms (e.g., Google, Meta) — for ad targeting and measurement
• Sellers — only when required to fulfill an order or product support
• Legal authorities — when required by law, court order, or to protect rights

We do not sell personal data to third parties. Data shared with advertising platforms is subject to those platforms' own data policies and use restrictions.

International Data Transfers

Data may be transferred outside the European Economic Area (EEA), including to the United States, where advertising and analytics providers such as Google and Meta operate. Such transfers are made under appropriate safeguards including Standard Contractual Clauses (SCCs) as approved by the European Commission.

Automated Decision-Making & Profiling

We may use automated tools to detect fraud, assess risk, and personalize content or advertising. This may constitute profiling under GDPR. Such processing is based on legitimate interest or consent where applicable.

You have the right to object to automated decision-making that produces significant legal or similarly significant effects. Contact us to exercise this right.

Data Retention

• Account data — retained while your account is active and for up to 2 years after deletion
• Transaction records — retained for up to 7 years for legal and tax compliance
• Analytics data — retained for up to 26 months (Google Analytics default)
• Advertising data — retained per the policies of respective ad platforms
• Support communications — retained for up to 3 years

Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent — at any time, without affecting prior processing

To exercise your rights, email [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl

Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS), access controls, and regular security reviews.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

Children's Privacy

NexoRush services are not intended for individuals under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at [email protected] and we will delete it promptly.

Contact

For privacy-related inquiries:
[email protected]

For general support:
[email protected]