Privacy Policy
This Privacy Policy explains how Nexbie collects, uses, shares and protects personal data when you visit our European online toy store, create an account, place an order, contact us or interact with our marketing.
Controller: Creality 3D Technology (Europe) GmbH, Wandsbeker Allee 77, 22041 Hamburg, Germany (referred to as “Nexbie”, “we”, “us” or “our”). For privacy enquiries, contact support.eu@nexbie.com.
Contents
- Scope and age notice
- Personal data we collect
- How and why we use data
- Cookies and similar technologies
- How we share data
- International data transfers
- Data retention
- Data security
- Your rights
- Contact and complaints
- Policy updates
1. Scope and Age Notice
This Privacy Policy applies to our European online store and the related sale and delivery of toys, games, wooden puzzles, blind boxes, 3D-printed toys, collectible figures, decorative products and related accessories.
Our store is intended for adults. We do not knowingly request that children create customer accounts, subscribe to marketing or place orders. If you are under the age at which you can validly provide consent in your country, a parent or legal guardian must act on your behalf. If you believe that a child has provided personal data to us without appropriate authorisation, please contact us so that we can review and, where required, delete it.
2. Personal Data We Collect
| Context | Data that may be collected | Source |
|---|---|---|
| Store visits | IP address, device and browser information, cookie identifiers, pages viewed, referral source and interaction data | Your device, Shopify and enabled analytics or advertising tools |
| Account registration and login | Name, email address, password or authentication data, IP address, login date and time | You and our store platform |
| Orders and checkout | Name, billing and delivery address, email address, telephone number, order details, selected products and transaction status | You, Shopify and payment providers |
| Payments and refunds | Payment method, amount, payment status, transaction reference and billing information. Full card details are generally processed directly by the payment provider rather than stored by us | You and payment providers |
| Delivery and returns | Name, address, telephone number, order number, parcel details, tracking events, customs information where required, and return information | You, us and logistics providers |
| Customer service | Contact details, messages, attachments, order information, complaint and resolution history | You and our support providers |
| Marketing | Email address, consent record, campaign interactions, browsing or purchase preferences and advertising identifiers where permitted | You and enabled marketing tools |
Where data is required by law or to enter into or perform a contract, we will indicate this where appropriate. If required order, payment or delivery information is not provided, we may be unable to complete the purchase or deliver the products.
3. How and Why We Use Personal Data
| Purpose | Examples | Legal basis under the GDPR |
|---|---|---|
| Provide accounts and fulfil orders | Create and administer accounts; process orders, payments, delivery, cancellations, withdrawals, returns and refunds | Performance of a contract or steps requested before entering a contract (Art. 6(1)(b)) |
| Customer service | Answer enquiries, investigate delivery issues, handle complaints and provide after-sales support | Contract performance (Art. 6(1)(b)) and our legitimate interests in effective support and dispute management (Art. 6(1)(f)) |
| Legal and accounting duties | Issue invoices, maintain tax and accounting records, respond to lawful requests and meet product-safety obligations | Compliance with legal obligations (Art. 6(1)(c)) |
| Security and fraud prevention | Protect accounts, detect suspicious transactions, prevent abuse and maintain platform security | Our legitimate interests in protecting customers, our business and our systems (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)) |
| Store operation and improvement | Measure essential performance, diagnose errors, improve navigation and understand aggregated store usage | Legitimate interests for strictly necessary or appropriately limited processing (Art. 6(1)(f)); consent where required (Art. 6(1)(a)) |
| Marketing and personalisation | Send newsletters, measure campaigns, provide relevant recommendations and run audience-based advertising | Your consent where required (Art. 6(1)(a)); any legally permitted existing-customer marketing will include an easy opt-out |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override ours. You may object to such processing as described below.
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. Fraud-screening tools may flag an order for review, but relevant decisions are subject to appropriate safeguards.
4. Cookies and Similar Technologies
Our store and enabled service providers may use cookies, pixels, local storage and similar technologies. Some are strictly necessary for functions such as checkout, security, account login, shopping-cart storage and privacy preferences. Others support analytics, personalisation and advertising.
Where consent is required, non-essential technologies are used only after you make a choice through our cookie banner or privacy settings. You may change or withdraw your choice at any time through the cookie or privacy settings available on the website. Withdrawing consent does not affect processing that took place before withdrawal. Blocking strictly necessary technologies may prevent parts of the store from working correctly.
5. How We Share Personal Data
We do not sell your personal data. We disclose only the data reasonably necessary for the relevant purpose to recipients such as:
- Store platform and hosting: Shopify and its authorised subprocessors, to operate the website, account, checkout and order systems.
- Payment providers: for example, Shopify Payments, card networks or PayPal where selected, to authorise payments, prevent fraud and process refunds.
- Logistics and delivery providers: including the carrier assigned to your parcel, such as DPD where used, and customs or fulfilment partners where necessary to deliver or return an order.
- Customer-support and content providers: such as support-ticket, email, content-hosting or technical service providers that we actually use.
- Marketing and analytics providers: such as Omnisend, Google, Meta or TikTok only where the relevant service is enabled and the required consent or other lawful basis exists.
- Professional advisers and authorities: auditors, insurers, lawyers, courts, regulators, law-enforcement bodies or tax authorities where disclosure is required or legally permitted.
- Corporate transactions: a prospective buyer, seller or adviser in connection with a merger, restructuring, financing or sale of all or part of our business, subject to appropriate confidentiality and legal safeguards.
Service providers acting on our behalf are required to process personal data only for authorised purposes and to apply appropriate safeguards. Some providers, including payment platforms and carriers, may also act as independent controllers for parts of their services; their own privacy notices then apply.
6. International Data Transfers
Nexbie is established in Germany, but Shopify and some other service providers operate internationally. Personal data may therefore be processed in countries outside the European Economic Area, including Canada and the United States, and where necessary for fulfilment, in the country from which a product or shipment is handled.
Where the GDPR requires safeguards for an international transfer, we use an applicable adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. We also assess and apply supplementary measures where required. A permitted derogation, such as a transfer necessary to perform your contract, is used only where its legal conditions are met and is not treated as the default basis for routine transfers.
7. How Long We Retain Personal Data
We retain personal data only for as long as necessary for the purpose for which it was collected and for any applicable legal, accounting, warranty, product-safety or dispute period. Typical criteria include:
- Account data: while the account remains active and for a limited period afterwards to address requests, fraud or disputes, unless earlier deletion is required.
- Order, invoice and payment records: for the retention period required under applicable German tax and commercial law.
- Delivery and return records: for the time needed to complete delivery, manage returns, handle claims and establish or defend legal rights.
- Customer-service records: for the period necessary to resolve the matter and manage related legal claims.
- Marketing data: until you withdraw consent or object, after which we may retain limited suppression-list information to respect your choice.
- Cookie and consent records: for the duration stated in the relevant privacy or cookie settings and as needed to demonstrate compliance.
When data is no longer required, it is deleted or anonymised unless continued retention is legally required.
8. Data Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include encrypted transmission, access controls, service-provider assessments, staff confidentiality duties, logging and security monitoring. No internet service can guarantee absolute security, but we review safeguards in light of the nature and risk of the processing.
9. Your Data-Protection Rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
- request access to your personal data and information about its processing;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
- object to processing based on legitimate interests, including profiling based on those interests;
- object at any time to direct marketing, including related profiling;
- withdraw consent at any time, without affecting the lawfulness of earlier processing; and
- lodge a complaint with a competent data-protection supervisory authority.
To exercise a right, email support.eu@nexbie.com and describe your request. We may request information reasonably necessary to verify your identity. We normally respond within one month, subject to any legally permitted extension, and will inform you if an extension is required.
10. Contact and Complaints
Creality 3D Technology (Europe) GmbH
Wandsbeker Allee 77
22041 Hamburg
Germany
Email: support.eu@nexbie.com
You also have the right to lodge a complaint with the data-protection authority in the EU/EEA country of your habitual residence, place of work or place of the alleged infringement. As our controller is established in Hamburg, you may also contact the competent Hamburg data-protection supervisory authority.
11. Updates to This Privacy Policy
We may update this Privacy Policy to reflect changes in our store, service providers, technologies or legal obligations. The current version and “Last updated” date will be posted on this page. Where required, we will provide additional notice of material changes.
This Privacy Policy applies to the Nexbie European online store. Third-party websites and services linked from our store are governed by their own privacy notices.
