Privacy policy

Data controller

The controller of the personal data processed through this website is MediciLuxe, registered office at Strada Privata delle Orobie, 3, 20873 Cavenago di Brianza MB.

For any matter concerning your personal data you can write to info@mediciluxe.com. We have not appointed a Data Protection Officer, as we are not required to; privacy requests are handled directly by the controller.

What data we collect

• Data you give us in the contact form: name, company, work email, and the content of your message.
• Data you give us when requesting a partner account: contact name, company name, work email, EU VAT number, country, telephone and a description of your sales channel.
• Data generated by your account: password (stored only as a cryptographic hash by our authentication provider, never in readable form), session records, the order requests you submit and the notes we attach to them.
• Technical data strictly necessary to run the site: session cookie, security token, IP address and browser user-agent recorded with the session and in our security logs.

Why we process it, and on which legal basis

• To answer your enquiries and send you the price lists and stock offer you ask for — legal basis: performance of pre-contractual measures taken at your request (art. 6(1)(b) GDPR).
• To verify your sales channel and your VAT position, open and manage your partner account, receive and process your order requests — legal basis: contract and pre-contractual measures (art. 6(1)(b)).
• To keep the platform secure: authentication, rate limiting, audit log of administrative actions — legal basis: our legitimate interest in preventing abuse (art. 6(1)(f)).
• To comply with accounting, tax and trade obligations connected to supply relationships — legal basis: legal obligation (art. 6(1)(c)).
• We do not carry out profiling and we take no automated decisions that produce legal effects concerning you. We do not send marketing emails unless you explicitly subscribe to the weekly stock offer, and you can unsubscribe at any time.

Who has access to it

Your data is accessible to our authorised staff (sales and administration) and to the service providers listed below, appointed as processors under art. 28 GDPR and bound by written agreements. We do not sell or rent personal data, and we do not disclose it to third parties for their own purposes.

Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses.

How long we keep it

• Enquiries and messages: 24 months from the last contact, unless a supply relationship begins.
• Partner accounts and order requests: for the duration of the relationship and for 10 years thereafter, as required by Italian accounting and tax law.
• Rejected account applications: 12 months, to document the assessment.
• Session records and security logs: 12 months.

Your rights

You may ask us at any time for access to your data, its rectification or erasure, the restriction of processing, portability, and you may object to processing based on our legitimate interest (arts. 15–22 GDPR). Write to info@mediciluxe.com: we reply within one month.

If you believe your data is processed unlawfully you may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country of residence.

Providing your data

Providing the data marked as required in our forms is necessary to answer you or to open an account: without it we cannot process the request. All other data is optional and only helps us serve you better.

Changes to this policy

We may update this policy to reflect changes in the service or in the law. The current version is dated July 2026; material changes affecting account holders are notified by email.

Processors we rely on