Privacy Policy

Last update: 29.10.2026

1. Data controller

The controller of your personal data is JONEX Sp. z o.o. Sp.k., ul. Gen. W. Sikorskiego 22, 78-400 Szczecinek, Poland, National Court Register (KRS) no. 0000707974, NIP 6731900052, REGON 363397068 ("JONEX"). No data protection officer has been appointed; please use the contact in section 11.

2. Purposes and legal bases

We process your personal data to:

• create and run the B2B account, verify the company and handle sign-in (Art. 6(1)(b) GDPR - electronic services contract; for persons acting for a customer Art. 6(1)(f) GDPR - contact with the customer)
• accept, confirm and fulfil orders, delivery, payment and complaints (Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the customer’s staff and representatives)
• issue invoices, keep accounts and meet other tax and accounting obligations (Art. 6(1)(c) GDPR)
• answer contact and quotation forms (Art. 6(1)(f) GDPR)
• handle orders sent by e-mail and run the cart assistant, including with artificial intelligence tools (Art. 6(1)(b) and (f) GDPR)
• keep the platform secure, prevent abuse and keep technical logs (Art. 6(1)(f) GDPR)
• establish, pursue or defend claims (Art. 6(1)(f) GDPR)
• direct marketing of our own products, including news and promotions (Art. 6(1)(f) GDPR; commercial e-mails only with the consent required by telecommunications law)
• traffic analytics and Google advertising based on consent given in the cookie banner (Art. 6(1)(a) GDPR) - see the Cookie policy

3. Categories of data

We process:

• identification and contact data: name, position, company name, e-mail, phone number
• company and billing data: VAT number, REGON, KRS, billing and delivery addresses, bank account for refunds
• account data: login (e-mail), password hash (we do not know the password), dates of accepting the terms at registration and with orders
• order and transaction data: orders, individual prices, invoices, payments, complaints, e-mail correspondence
• content entered in forms, order notes and the cart assistant
• technical data: IP address, server logs, browser and device type, cookie and browser storage data - see the Cookie policy

If you did not provide the data yourself, we received it from the company you act for (e.g. as a contact person or delivery recipient) or from public registers (KRS, CEIDG, VAT white list) when verifying the company.

4. Recipients

Data may be disclosed only to the extent necessary to:

• IT service providers: platform server hosting, e-mail server, maintenance and development of the platform and sales system software (under data processing agreements)
• Google (Google Ireland Ltd. and Google LLC) - Google sign-in, the map on the Contact page, fonts, and with your consent Google Analytics 4 and Google Ads
• Anthropic PBC - provider of the artificial intelligence model used by the cart assistant and to read orders sent by e-mail; it receives the text entered into the assistant or the content of the order e-mail
• courier and transport companies
• banks and payment operators
• accounting, legal and debt collection service providers
• public authorities where required by law (e.g. tax office, National e-Invoicing System)

5. Transfers outside the European Economic Area

Google LLC and Anthropic PBC are based in the United States, so data may be transferred to the USA. Transfers rely on the European Commission adequacy decision (EU-US Data Privacy Framework) for certified entities and otherwise on standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards using the contact in section 11.

6. Retention

We keep data:

• B2B account data - until the account is deleted, and afterwards for the limitation period of claims
• order, invoice and settlement data - for 5 years from the end of the calendar year in which the tax payment deadline expired, or longer until claims under the contract are time-barred
• form enquiries - until handled and then up to 12 months unless they lead to a contract
• web server logs - 14 days; application logs - until overwritten by newer entries (size-limited); order change history and sent e-mail log - like order data
• data processed on consent - until withdrawn; data processed for marketing - until an effective objection

7. Your rights

You have the right to:

• access your data and receive a copy
• rectification
• erasure
• restriction of processing
• portability of data processed under a contract or consent
• object to processing based on legitimate interests, including direct marketing
• withdraw consent at any time without affecting the lawfulness of earlier processing
• lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw

8. Obligation to provide data

Providing data is voluntary but necessary to create an account, place and fulfil an order and issue an invoice. Without it we cannot provide the B2B platform or conclude a sales contract.

9. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Cart assistant suggestions and AI reading of e-mail orders are checked by a person: the customer before sending the order and JONEX before confirming it.

10. Security

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), storing passwords only as hashes, access control to the admin panel and backups, to protect data against unauthorised access, loss, alteration or destruction.

11. Contact regarding personal data

For personal data matters, contact the Controller: