Privacy policy

The data controller for personal data collected through the website www.meoro.luxury (the "Website") is MEORO COSMETICS S.R.L., with registered office in Corso Magenta 46, 20123 Milan (MI), Italy, tax code and VAT number 10519850969, REA MI-2537800, share capital € 53,125.00.

Contacts: email hello@meoro.luxury

This privacy policy describes how the Data Controller collects, uses, stores, and discloses the personal data of users who visit the Site, create an account, place an order, request assistance, subscribe to promotional communications, or interact with the online store's features. The Site is built and hosted using the Shopify platform.

Depending on your interaction with the Website, the following categories of data may be processed:

• identification and contact data, such as name, surname, address, email and phone number;
• data relating to the customer's account, preferences and settings;
• data relating to orders, products purchased, returns, refunds, shipping and billing;
• payment information and transaction outcome. Complete card data is processed by payment providers and is not directly stored by the Data Controller;
• content of communications sent to customer service;
• technical and navigation data, such as IP address, online identifiers, device, browser, operating system, pages viewed and interactions with the Website;
• cookie, marketing and promotional communication preferences;
• information necessary to prevent fraud, abuse or unauthorized access.

The Data Controller does not intentionally request special categories of personal data, such as health, biometric, genetic data, or data relating to religious beliefs or sexual orientation. Therefore, please do not transmit such information via the Website or support channels.

Data may be collected directly from the data subject, automatically during use of the Site through cookies and similar technologies, or received from Shopify and the providers involved in order fulfillment, payment, shipping, assistance, or Site security.

Data is processed exclusively for specific purposes and based on one of the lawful conditions provided for in Article 6 GDPR.

Order management and contractual relationship

Purpose: to create and manage the account, receive and confirm orders, process payments and refunds, prepare and deliver products, and manage returns or complaints.

Legal basis: performance of a contract or pre-contractual measures requested by the data subject.

Retention: for the time necessary for the performance of the contract and subsequently for the period necessary to protect the rights of the Data Controller and the customer.

Tax, accounting, and legal compliance

Purpose: to issue and store tax and accounting documents and comply with legal obligations.

Legal basis: fulfillment of a legal obligation.

Retention: generally 10 years, unless longer terms are required by law or necessary in case of disputes.

Assistance and service communications

Purpose: to respond to requests, provide assistance, and send communications regarding accounts, orders, payments, deliveries, returns, or security.

Legal basis: performance of the contract and, where applicable, legitimate interest in effectively managing the relationship with customers.

Retention: for the time necessary to manage the request and, generally, up to 24 months from its closure, unless there is litigation or legal obligations.

Security and fraud prevention

Purpose: to protect the Site, verify transactions, prevent fraud, abuse, illicit access, and protect the rights of the Data Controller and users.

Legal basis: legitimate interest of the Data Controller in the security of the service and the protection of their rights.

Retention: for the time strictly necessary for verification and, generally, up to 12 months, unless there are investigations, disputes, or legal obligations.

Newsletter and direct marketing

Purpose: to send, via email or other authorized channels, news, initiatives, and commercial offers from Meoro.

Legal basis: consent of the data subject, freely revocable at any time.

Retention: until consent is revoked or deletion is requested, and in any case in compliance with applicable terms and periodic checks on the recipient's interest.

Analysis, personalization, and advertising

Purpose: to measure the use of the Site, improve services, personalize the experience, and, if authorized, propose relevant advertising also through partners.

Legal basis: consent, when required by law, collected through the banner or the cookie preference center; for strictly necessary activities, legitimate interest or performance of the requested service.

Retention: according to the durations indicated in the cookie preference center and in the privacy policies of the involved providers; consent can be modified or revoked at any time.

Assertion and defense of rights

Purpose: to prevent or manage disputes and respond to requests from competent authorities.

Legal basis: legitimate interest in the protection of rights and fulfillment of legal obligations.

Retention: for the duration of the dispute and until the expiry of applicable limitation periods.

The provision of data marked as necessary during purchase, payment, delivery, or account creation is essential to provide the requested service. Failure to provide such data may prevent the conclusion or execution of the order. The provision of data for newsletters, marketing, non-essential analysis, and personalized advertising is optional, and refusal does not affect the ability to make purchases on the Website.

Processing is carried out using electronic tools and, when necessary, paper tools, adopting technical and organizational measures appropriate to the risk. The Data Controller limits access to data to authorized individuals and suppliers who need it to carry out assigned activities. However, no system is completely immune to risks; therefore, absolute security of transmissions or archives cannot be guaranteed.

To the extent necessary for the purposes described, data may be disclosed to:

• Shopify International Limited and other companies in the Shopify group, for hosting and operating the platform and related services;
• payment service providers and fraud prevention providers;
• couriers, freight forwarders, logistics operators and parties involved in delivery;
• IT, hosting, security, technical support and communications management providers;
• analytical, advertising or marketing service providers, exclusively in the cases and with the guarantees provided for by law and, where necessary, with prior consent;
• accountants, consultants, lawyers, auditors and other professionals bound by confidentiality;
• public, judicial, tax or public security authorities, when required by law or a legitimate measure.

Providers who process data on behalf of the Controller are appointed as data processors pursuant to Article 28 GDPR, where required. Some entities may operate as independent data controllers according to their own privacy policies.

Shopify provides the technology platform used for the online store and processes personal data to enable its services to function, be secure, and improve. In relation to some functionalities, Shopify may act as a data processor on behalf of MEORO COSMETICS S.R.L.; for other activities, it may act as an independent data controller.

For more information: https://www.shopify.com/legal/privacy/consumers. The Shopify portal for exercising rights related to processing carried out directly by Shopify is available at https://privacy.shopify.com/.

The Site uses cookies and similar technologies necessary for the operation of the store, shopping cart, checkout, security, and preference management. With the user's consent, analytical, advanced functional, advertising, or personalization cookies may also be used.

Upon the first visit, where required, a banner is displayed allowing the user to accept, reject, or configure non-essential cookies. Preferences can be changed at any time via the "Cookie Preferences" link available on the Site. Updated information on cookie categories, providers, and durations is provided in the relevant preference center.

Some providers, including Shopify, may process data in countries outside the European Economic Area. In such cases, the transfer takes place on the basis of an adequacy decision by the European Commission or by means of standard contractual clauses and, where necessary, additional measures suitable for ensuring a level of protection substantially equivalent to that in Europe. Further information can be requested by contacting the Data Controller.

In cases provided for by the GDPR, the data subject may exercise the following rights:

• obtain confirmation of the existence of processing and access their data;
• request the rectification of inaccurate data or the integration of incomplete data;
• request the erasure of data, when the legal conditions apply;
• request the restriction of processing;
• receive data in a structured format and transmit it to another controller, in cases of portability;
• object to processing based on legitimate interest, for reasons related to their particular situation;
• object to direct marketing at any time;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• not be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects, except for exceptions provided by law.

To exercise these rights, you can write to the email address hello@meoro.luxury or, for formal communications, to The Controller may request the information necessary to verify the applicant's identity and responds within the terms provided by applicable law.

The Controller may request the information necessary to verify the applicant's identity and responds within the terms provided by law, usually within one month.

Data subjects who believe that the processing of their data violates applicable regulations may lodge a complaint with the Italian Data Protection Authority, according to the instructions available on https://www.garanteprivacy.it, or contact the competent supervisory authority in the country where they reside or work.

The Site and products are not specifically intended for minors. The Owner does not knowingly collect personal data from minors in violation of applicable law. If a parent or guardian believes that a minor has provided personal data without valid authorization, they may contact the Owner to request its deletion.

The Site may contain links to websites or services operated by third parties. The Data Controller does not control these entities and invites the user to consult their privacy policies before providing personal data.

This privacy policy may be updated to reflect regulatory, technical, or organizational changes, the introduction of new features, or changes in suppliers. The updated version will be published on the Website with the date of the last update indicated. When required by law, further notices will be provided or consent will be collected again.

For questions regarding this privacy policy or the processing of personal data:

MEORO COSMETICS S.R.L.
Corso Magenta 46, 20123 Milan (MI), Italy
Email: hello@meoro.luxury