MK Nexa
Privacy Policy
This privacy policy explains how MK NEXA LTD collects and uses your personal data when you visit our online shop at mk-nexa.com, create a customer account, place an order or contact us. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).
1. Who is responsible for your data
The controller responsible for data processing on this website is:
MK NEXA LTD (shop name: MK Nexa)
42 Firth Park Crescent
Sheffield S5 6HE
England, United Kingdom
Email: support@mk-nexa.com
Telephone: +44 7458 038425
Website: mk-nexa.com
MK NEXA LTD is registered in England and Wales with Companies House under company number 16938367. The director is Samera Karim.
Hosting provider: 1984.hosting
2. Overview: data, purposes and legal bases
We only process personal data where we have a lawful basis under Article 6 of the UK GDPR. The table below summarises the main processing activities. Details follow in the sections after it.
Processing activities and legal bases
| Purpose |
Data involved |
Legal basis |
| Providing the website and server log files |
Technical access data |
Legitimate interests, Article 6(1)(f) UK GDPR |
| Strictly necessary session and device storage |
Session identifier and settings |
Legitimate interests, Article 6(1)(f) UK GDPR; storage is exempt from consent under regulation 6(4) PECR because it is strictly necessary |
| Visitor analytics, security and bot detection |
See section 5 |
Legitimate interests, Article 6(1)(f) UK GDPR |
| Orders, contracts and customer accounts |
Contact, address, order and payment data |
Performance of a contract, Article 6(1)(b) UK GDPR |
| Tax, accounting and company law duties |
Order and invoice data |
Legal obligation, Article 6(1)(c) UK GDPR |
| Enquiries and customer service |
Contact details and message content |
Article 6(1)(b) UK GDPR for contract-related enquiries, otherwise Article 6(1)(f) UK GDPR |
| Newsletter |
Email address |
Consent, Article 6(1)(a) UK GDPR |
3. Hosting and server log files
Hosting provider: 1984.hosting
Each time you open our website, our server automatically records technical access data in log files. This typically includes your IP address, the date and time of the request, the page requested, the website you came from, and information about your browser and operating system.
We use this data to deliver the website correctly, to keep it stable and secure, and to detect and investigate misuse. Our legitimate interests in a secure and functioning website are the legal basis under Article 6(1)(f) UK GDPR.
4. Strictly necessary cookies and browser storage
Our shop stores a small number of items on your device that are needed to run the shop. They are strictly necessary, so PECR does not require your consent for them. Our cookie banner records your cookie choice, but the storage listed here works independently of that choice. More detail is available on our Cookie Policy page.
Cookie
- customer.sid: keeps your customer or guest session, including your basket, your login and the checkout process.
Local storage
- shop.cookieConsent: remembers your cookie choice.
- shop:color-mode: remembers your display setting.
Session storage
- kasse:confirmation: holds the checkout confirmation.
- shop.accountDeleted: holds a short-lived notice after an account has been deleted.
- maintenance-reload-at: holds a short-lived redirect state during maintenance.
The legal basis for the related processing of personal data is our legitimate interest in providing a working, secure shop, Article 6(1)(f) UK GDPR, and, where you place an order, the performance of your contract, Article 6(1)(b) UK GDPR.
5. Visitor analytics and device fingerprinting
We run our own visitor analytics on this website. It is always active and does not depend on your cookie choice. It does not set any cookies of its own and uses the existing session customer.sid described above.
Purposes
- visit statistics
- security and fraud prevention
- detection of automated access (bots)
Data collected
- your IP address and an approximate location derived from it (country, region, city)
- the pages you view and the page you came from (referrer)
- browser, operating system, device type, language setting and screen characteristics
- a device fingerprint (including canvas, WebGL and installed fonts) used as a recognition value
- the link to your shop session or customer account
Legal basis and your choices
The legal basis is our legitimate interest under Article 6(1)(f) UK GDPR in understanding how the shop is used, protecting it and our customers against fraud and misuse, and detecting bots. Because this analytics does not depend on the cookie banner, changing your cookie choice does not switch it off. You have the right to object to this processing at any time on grounds relating to your particular situation (see section 12). We do not apply a fixed deletion period to this data; we keep it only for as long as it is needed for the purposes above.
The shop does not use Google Analytics or Google Ads.
6. Customer account, guest orders and order processing
Orders
You can order as a guest or with a customer account. To process an order we use your name, delivery and billing address, email address, telephone number where provided, the products ordered and payment status information. We use this data to confirm your order, deliver the goods, handle returns and withdrawals, and deal with warranty claims. The legal basis is the performance of the contract, Article 6(1)(b) UK GDPR.
We must keep order and invoice records for tax, VAT and company law purposes. This processing is based on a legal obligation, Article 6(1)(c) UK GDPR.
Customer account and order lookup
If you register, we store your account details and your order history so that you can use the customer portal. Guest orders can be followed without an account by using the email address linked to the order. The legal basis is Article 6(1)(b) UK GDPR.
7. Payment service providers
We accept payment by credit card. When you pay, the data needed to carry out the payment is passed to the payment service provider that processes the card payment. Please see our Payment page for information about payment methods.
The legal basis is the performance of the contract, Article 6(1)(b) UK GDPR. The payment service provider may also process your data for its own legal purposes, for example to prevent fraud, and is responsible for that processing under its own privacy information.
8. Delivery service providers
We deliver within the United Kingdom by tracked home delivery. To deliver your order, we pass your name, delivery address and, where needed for delivery or shipment tracking, your email address or telephone number to the delivery service provider. Bulky goods sent by freight may be handled by a freight carrier, which receives the same delivery details. Details of delivery methods, costs and times are on our Shipping page.
The legal basis is the performance of the contract, Article 6(1)(b) UK GDPR.
9. Contact, customer service and newsletter
Contact form, email and telephone
If you contact us through the contact form, by email or by telephone, we process the details you give us and the content of your message to answer your request. The legal basis is Article 6(1)(b) UK GDPR where your request relates to a contract or an order, and otherwise our legitimate interest in answering enquiries, Article 6(1)(f) UK GDPR.
Chat in the customer portal
Logged-in customers can use a chat in the customer portal. Replies in this chat may be generated automatically by artificial intelligence. The messages you enter are processed to answer your request. Please do not enter more personal data than needed.
Newsletter
You can subscribe to our newsletter on the home page. We use your email address to send it only if you have consented, Article 6(1)(a) UK GDPR and regulation 22 PECR. You can withdraw your consent at any time with effect for the future, for example by contacting us at support@mk-nexa.com.
10. Recipients and international transfers
We pass personal data only to recipients who need it: our hosting provider, the payment service provider, delivery service providers, and professional advisers or authorities where we are legally required to do so. Service providers acting on our behalf are bound by data processing terms.
If personal data is transferred to a country outside the United Kingdom, we ensure that it is protected by a transfer mechanism recognised under Chapter V of the UK GDPR, such as an adequacy regulation or appropriate safeguards.
11. How long we keep your data
- Order and invoice data is kept for as long as UK tax, VAT and company law require.
- Customer account data is kept while your account exists. You can ask us to delete your account.
- Enquiries are kept for as long as needed to answer them and to handle any follow-up questions.
- Newsletter data is kept until you withdraw your consent.
- Session storage in your browser is short-lived. Local storage entries remain until you delete them in your browser.
12. Your rights
Under the UK GDPR you have the following rights:
- Access to your personal data and information about its use (Article 15).
- Rectification of inaccurate or incomplete data (Article 16).
- Erasure of your data in the cases set out in the law (Article 17).
- Restriction of processing (Article 18).
- Data portability for data you gave us that we process by automated means on the basis of consent or contract (Article 20).
- Objection to processing based on legitimate interests, on grounds relating to your particular situation (Article 21). This includes our visitor analytics and device fingerprinting.
- Withdrawal of consent at any time with effect for the future, where processing is based on consent (Article 7(3)). Withdrawal does not affect the lawfulness of processing before it.
To exercise your rights, contact us at support@mk-nexa.com, by telephone on +44 7458 038425, or by post at MK NEXA LTD, 42 Firth Park Crescent, Sheffield S5 6HE, England. You do not normally have to pay a fee.
Right to complain
You can send a complaint about how we handle your personal data directly to us by email at support@mk-nexa.com. This does not affect your right to complain to the Information Commissioner's Office.
If you believe we are processing your personal data unlawfully, you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): https://ico.org.uk. We would appreciate the chance to address your concerns first, so please contact us beforehand where possible.
13. Provision of data and updates to this policy
You are not required to give us personal data, but without the data needed for an order we cannot enter into or perform the contract with you. Technical data in server log files is needed to display the website.
We update this privacy policy when our processing or the legal requirements change. The current version is always the one published on this page.