Privacy Policy

The data controller for personal data collected through the website www.meoro.luxury (the "Website") is MEORO COSMETICS S.R.L., with registered office at Corso Magenta 46, 20123 Milan (MI), Italy, tax code and VAT number 10519850969, REA MI-2537800, share capital €53,125.00.

Contacts: email hello@meoro.luxury

This privacy policy describes how the Data Controller collects, uses, stores, and discloses the personal data of users who visit the Site, create an account, place an order, request assistance, subscribe to promotional communications, or interact with the online store's features. The Site is built and hosted using the Shopify platform.

Depending on your interaction with the Website, the following categories of data may be processed:

• identification and contact information, such as first name, last name, address, email address, and phone number;
• data related to the customer's account, preferences, and settings;
• data related to orders, purchased products, returns, refunds, shipping, and billing;
• payment information and transaction outcome. Complete card data is processed by payment providers and is not stored directly by the Data Controller;
• the content of communications sent to customer service;
• technical and navigation data, such as IP address, online identifiers, device, browser, operating system, pages viewed, and interactions with the Website;
• cookies, marketing, and promotional communication preferences;
• information necessary to prevent fraud, abuse, or unauthorized access.

The Data Controller does not intentionally request special categories of personal data, such as health, biometric, or genetic data, or data relating to religious beliefs or sexual orientation. Therefore, please do not submit such information via the Website or support channels.

Data may be collected directly from the data subject, automatically during use of the Site through cookies and similar technologies, or received from Shopify and the providers involved in order fulfillment, payment, shipping, customer support, or Site security.

Data is processed exclusively for specific purposes and based on one of the lawful grounds set forth in Article 6 of the GDPR.

Order Management and Contractual Relationship

Purpose: to create and manage the account, receive and confirm orders, process payments and refunds, prepare and deliver products, and handle returns or complaints.

Legal basis: performance of a contract or pre-contractual measures requested by the data subject.

Retention: for the time necessary to fulfill the contract and, thereafter, for the period necessary to protect the rights of the Data Controller and the customer.

Tax, Accounting, and Legal Compliance

Purpose: to issue and store tax and accounting documents and comply with legal obligations.

Legal basis: compliance with a legal obligation.

Retention: generally 10 years, unless longer retention periods are required by law or necessary in the event of disputes.

Assistance and Service Communications

Purpose: to respond to requests, provide assistance, and send communications regarding accounts, orders, payments, deliveries, returns, or security.

Legal basis: performance of the contract and, where applicable, legitimate interest in effectively managing the relationship with customers.

Retention: for the time necessary to process the request and, generally, up to 24 months after its closure, unless there is litigation or legal obligations.

Security and Fraud Prevention

Purpose: to protect the Site, verify transactions, prevent fraud, abuse, and unauthorized access, and protect the rights of the Data Controller and users.

Legal basis: the Data Controller’s legitimate interest in the security of the service and the protection of its rights.

Retention: for the time strictly necessary for verification and, generally, up to 12 months, unless there are investigations, disputes, or legal obligations.

Newsletters and Direct Marketing

Purpose: to send, via email or other authorized channels, news, initiatives, and commercial offers from Meoro.

Legal basis: consent of the data subject, which may be freely revoked at any time.

Retention: until consent is revoked or deletion is requested, and in any case in accordance with applicable terms and periodic reviews of the recipient's interest.

Analysis, personalization, and advertising

Purpose: to measure the use of the Site, improve services, personalize the experience, and, if authorized, display relevant advertisements, including through partners.

Legal basis: consent, when required by law, obtained through the banner or the cookie preference center; for strictly necessary activities, legitimate interest, or the performance of the requested service.

Retention: in accordance with the time periods specified in the cookie preference center and in the privacy policies of the relevant providers; consent may be modified or revoked at any time.

Assertion and Defense of Rights

Purpose: to prevent or resolve disputes and respond to requests from competent authorities.

Legal basis: legitimate interest in the protection of rights and the fulfillment of legal obligations.

Retention: for the duration of the dispute and until the expiration of the applicable statutes of limitations.

Providing data marked as required during the purchase, payment, delivery, or account creation process is essential to provide the requested service. Failure to provide such data may prevent the order from being completed or fulfilled. Providing data for newsletters, marketing, non-essential analysis, and personalized advertising is optional, and refusal does not affect your ability to make purchases on the Website.

Data processing is carried out using electronic tools and, when necessary, paper-based tools, with technical and organizational measures appropriate to the risk. The Data Controller restricts access to data to authorized individuals and suppliers who need it to perform their assigned tasks. However, no system is completely immune to risks; therefore, absolute security of transmissions or data storage cannot be guaranteed.

To the extent necessary for the purposes described, data may be disclosed to:

• Shopify International Limited and other companies in the Shopify group, for hosting and operating the platform and related services;
• payment service providers and fraud prevention providers;
• couriers, freight forwarders, logistics operators, and parties involved in delivery;
• IT, hosting, security, technical support, and communications management providers;
• analytical, advertising, or marketing service providers, exclusively in the cases and subject to the safeguards provided for by law and, where necessary, with prior consent;
• accountants, consultants, lawyers, auditors, and other professionals bound by confidentiality;
• public, judicial, tax, or public safety authorities, when required by law or a legitimate measure.

Service providers who process data on behalf of the Controller are designated as data processors in accordance with Article 28 of the GDPR, where required. Some entities may act as independent data controllers in accordance with their own privacy policies.

Shopify provides the technology platform used for the online store and processes personal data to ensure that its services function properly, remain secure, and continue to improve. With regard to certain features, Shopify may act as a data processor on behalf of MEORO COSMETICS S.R.L.; for other activities, it may act as an independent data controller.

For more information: https://www.shopify.com/legal/privacy/consumers. The Shopify portal for exercising rights related to processing carried out directly by Shopify is available at https://privacy.shopify.com/.

The Site uses cookies and similar technologies that are necessary for the operation of the store, shopping cart, checkout, security, and preference management. With the user's consent, analytical, advanced functional, advertising, or personalization cookies may also be used.

Upon the first visit, where required, a banner appears allowing the user to accept, reject, or configure non-essential cookies. Preferences can be changed at any time via the "Cookie Preferences" link available on the Site. Updated information on cookie categories, providers, and durations is provided in the relevant preference center.

Some providers, including Shopify, may process data in countries outside the European Economic Area. In such cases, the transfer is based on an adequacy decision by the European Commission or on standard contractual clauses and, where necessary, additional measures designed to ensure a level of protection substantially equivalent to that in Europe. Further information can be requested by contacting the Data Controller.

In the cases provided for by the GDPR, the data subject may exercise the following rights:

• obtain confirmation of whether their data is being processed and access their data;
• request the correction of inaccurate data or the completion of incomplete data;
• request the erasure of data, when the legal conditions apply;
• request the restriction of processing;
• receive data in a structured format and transmit it to another controller, in cases of data portability;
• object to processing based on legitimate interest, for reasons related to their particular situation;
• object to direct marketing at any time;
• withdraw consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal;
• not be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects, except as provided by law.

To exercise these rights, you can send an email to hello@meoro.luxury or, for formal communications, to

. The Data Controller may request the information necessary to verify the applicant’s identity and will respond within the timeframes provided by applicable law. The Data Controller may request the information necessary to verify the applicant’s identity and will respond within the timeframes provided by law, usually within one month.

Data subjects who believe that the processing of their data violates applicable regulations may file a complaint with the Italian Data Protection Authority, in accordance with the instructions available at https://www.garanteprivacy.it, or contact the competent supervisory authority in the country where they reside or work.

The Site and products are not specifically intended for minors. The Owner does not knowingly collect personal data from minors in violation of applicable law. If a parent or guardian believes that a minor has provided personal data without valid authorization, they may contact the Owner to request its deletion.

The Site may contain links to websites or services operated by third parties. The Data Controller has no control over these entities and encourages users to review their privacy policies before providing personal data.

This privacy policy may be updated to reflect regulatory, technical, or organizational changes, the introduction of new features, or changes in suppliers. The updated version will be published on the Website, with the date of the last update indicated. When required by law, additional notices will be provided or consent will be obtained again.

For questions regarding this privacy policy or the processing of personal data:

MEORO COSMETICS S.R.L.
Corso Magenta 46, 20123 Milan (MI), Italy
Email: hello@meoro.luxury