Privacy Policy

The data controller for personal data collected through the website www.meoro.luxury (the “Website”) is MEORO COSMETICS S.R.L., with registered office at Corso Magenta 46, 20123 Milan (MI), Italy, tax ID and VAT number 10519850969, REA MI-2537800, with a share capital of €53,125.00.

Contact: email hello@meoro.luxury

This privacy policy describes how the Data Controller collects, uses, stores, and discloses the personal data of users who visit the Site, create an account, place an order, request assistance, subscribe to promotional communications, or interact with the online store’s features. The Site is built and hosted on the Shopify platform.

Depending on your interaction with the Site, the following categories of data may be processed:

• identification and contact information, such as first name, last name, address, email address, and phone number;
• data related to the customer's account, preferences, and settings;
• data related to orders, purchased products, returns, refunds, shipping, and billing;
• information regarding payment and the outcome of the transaction. Full card details are processed by payment providers and are not stored directly by the Data Controller;
• the content of messages sent to customer service;
• technical and browsing data, such as IP address, online identifiers, device, browser, operating system, pages viewed, and interactions with the Site;
• preferences regarding cookies, marketing, and promotional communications;
• information necessary to prevent fraud, abuse, or unauthorized access.

The Data Controller does not intentionally request special categories of personal data, such as health, biometric, or genetic data, or data relating to religious beliefs or sexual orientation. We therefore ask that you refrain from submitting such information through the Website or support channels.

Data may be collected directly from the data subject, automatically while using the Site through cookies and similar technologies, or received from Shopify and from vendors involved in order fulfillment, payment processing, shipping, customer support, or Site security.

Data is processed exclusively for specific purposes and on the basis of one of the grounds for lawfulness set forth in Article 6 of the GDPR.

Order Management and Contractual Relationships

Purpose: To create and manage your account, receive and confirm orders, process payments and refunds, prepare and deliver products, and handle returns or complaints.

Legal basis: performance of a contract or precontractual measures requested by the data subject.

Retention: for the time necessary to fulfill the contract and, thereafter, for the period necessary to protect the rights of the Data Controller and the customer.

Tax, Accounting, and Legal Compliance

Purpose: To issue and retain tax and accounting documents and to comply with legal obligations.

Legal basis: compliance with a legal obligation.

Retention period: generally 10 years, unless longer periods are required by law or necessary in the event of a dispute.

Customer Support and Service Notices

Purpose: To respond to inquiries, provide assistance, and send communications regarding accounts, orders, payments, deliveries, returns, or security.

Legal basis: performance of the contract and, where applicable, legitimate interest in effectively managing customer relationships.

Retention: for the time necessary to process the request and, as a general rule, up to 24 months after its closure, unless there is a dispute or legal obligations require otherwise.

Security and Fraud Prevention

Purpose: to protect the Website, verify transactions, prevent fraud, abuse, and unauthorized access, and safeguard the rights of the Data Controller and users.

Legal basis: the Data Controller’s legitimate interest in ensuring the security of the service and protecting its rights.

Retention: for the time strictly necessary for verification and, as a general rule, for up to 12 months, unless there are investigations, disputes, or legal obligations.

Newsletters and Direct Marketing

Purpose: To send, via email or other authorized channels, news, promotions, and commercial offers from Meoro.

Legal basis: consent of the data subject, which may be freely revoked at any time.

Retention: until consent is revoked or a request for deletion is made, and in any case in compliance with applicable terms and periodic reviews of the recipient’s interest.

Analytics, Personalization, and Advertising

Purpose: To measure website usage, improve services, personalize the user experience, and, if authorized, display relevant advertisements, including through partners.

Legal basis: consent, when required by law, obtained through the banner or the cookie preferences center; for strictly necessary activities, legitimate interest, or the performance of the requested service.

Retention: as specified in the Cookie Preferences Center and in the privacy policies of the relevant providers; consent may be modified or withdrawn at any time.

Assessment and Protection of Rights

Purpose: to prevent or resolve disputes and respond to requests from competent authorities.

Legal basis: legitimate interest in protecting rights and complying with legal obligations.

Retention: for the duration of the dispute and until the applicable statute of limitations expires.

Providing the data marked as required during the purchase, payment, delivery, or account creation process is essential to providing the requested service. Failure to provide this data may prevent the order from being completed or fulfilled. Providing data for newsletters, marketing, non-essential analytics, and personalized advertising is optional, and refusing to do so does not affect your ability to make purchases on the Site.

Data processing is carried out using electronic means and, when necessary, on paper, employing technical and organizational measures appropriate to the risk. The Data Controller restricts access to the data to authorized individuals and vendors who need it to perform the tasks assigned to them. However, no system is completely immune to risks; therefore, absolute security of transmissions or data storage cannot be guaranteed.

To the extent necessary for the purposes described, the data may be disclosed to:

• Shopify International Limited and other companies in the Shopify group, for hosting and operating the platform and related services;
• payment service providers and fraud prevention providers;
• couriers, freight forwarders, logistics providers, and others involved in delivery;
• IT providers, hosting, security, technical support, and communications management;
• providers of analytics, advertising, or marketing services, exclusively in the cases and subject to the safeguards provided for by law and, when necessary, with prior consent;
• accountants, consultants, attorneys, auditors, and other professionals bound by confidentiality;
• public, judicial, tax, or public safety authorities, when required by law or by a legitimate order.

Vendors that process data on behalf of the Data Controller are designated as data processors pursuant to Article 28 of the GDPR, where required. Some entities may act as independent data controllers in accordance with their own privacy policies.

Shopify provides the technology platform used for the online store and processes personal data to enable the operation, security, and improvement of its services. With respect to certain features, Shopify may act as a data processor on behalf of MEORO COSMETICS S.R.L.; for other activities, it may act as an independent data controller.

For more information: https://www.shopify.com/legal/privacy/consumers. The Shopify portal for exercising your rights regarding data processing carried out directly by Shopify is available at https://privacy.shopify.com/.

This website uses cookies and similar technologies that are necessary for the operation of the store, the shopping cart, the checkout process, security, and preference management. With the user’s consent, analytical, advanced functional, advertising, or personalization cookies may also be used.

During your first visit, if required, a banner will appear allowing you to accept, reject, or configure non-essential cookies. You can change your preferences at any time by clicking the “Cookie Preferences” link available on the Site. Up-to-date information on cookie categories, providers, and durations is provided in the relevant preference center.

Some service providers, including Shopify, may process data in countries outside the European Economic Area. In such cases, the transfer is based on an adequacy decision by the European Commission or on standard contractual clauses and, where necessary, additional measures designed to ensure a level of protection substantially equivalent to that in Europe. You may request further information by contacting the Data Controller.

In the cases provided for by the GDPR, the data subject may exercise the following rights:

• to obtain confirmation of whether personal data is being processed and to access one's personal data;
• request the correction of inaccurate data or the completion of incomplete data;
• request the deletion of data, when the legal requirements are met;
• request the restriction of processing;
• to receive data in a structured format and transmit it to another data controller, in cases of data portability;
• object to processing based on legitimate interests, for reasons related to one’s particular situation;
• opt out of direct marketing at any time;
• withdraw consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal;
• not to be subject to decisions based solely on automated processing that produce legal effects or effects of comparable significance, except as provided by law.

To exercise your rights, you may write to the email address hello@meoro.luxury or, for formal communications, to

. The Data Controller may request the information necessary to verify the identity of the requester and will respond within the timeframes provided for by applicable law, typically within one month.

Any data subject who believes that the processing of their personal data violates applicable law may file a complaint with the Italian Data Protection Authority, in accordance with the instructions available at https://www.garanteprivacy.it, or contact the competent supervisory authority in the country where they reside or work.

The Website and the products are not specifically intended for minors. The Data Controller does not knowingly collect personal data from minors in violation of applicable law. If a parent or guardian believes that a minor has provided personal data without valid authorization, they may contact the Data Controller to request its deletion.

The Site may contain links to websites or services operated by third parties. The Data Controller does not control these third parties and encourages users to review their privacy policies before providing personal data.

This privacy policy may be updated to reflect regulatory, technical, or organizational changes; the introduction of new features; or changes in the service providers we use. The updated version will be posted on the Website, along with the date of the last update. When required by law, additional notices will be provided or consent will be obtained again.

For questions about this privacy policy or the processing of personal data:

MEORO COSMETICS S.R.L.
Corso Magenta 46, 20123 Milan (MI), Italy
Email: hello@meoro.luxury