1. Data controller
The data controller is Cristiano Della Portella, VAT number 18474191006, operating office at Via Ippolito Nievo 61, 00153 Roma (RM).
For any request about data processing write to mednxs@gmail.com or use the Contact page.
2. What data we process
- Account data: first and last name, e-mail address, password (stored only in encrypted form), language, customer type (private or business) and, if provided, institution, VAT number and tax code.
- Order and delivery data: products, amounts, billing and delivery addresses, payment status. Payment card details are handled directly by Stripe and never pass through our servers.
- Data sent through the contact form or quote requests: name, e-mail, optional company and phone, message content.
- Technical data: IP address, browser type, date and time of access, recorded for security and to run the service.
- Browsing data for statistics (pages viewed, duration), only if you consent to analytics cookies.
3. Purposes and legal bases
- Creating and managing your account and letting you sign in (pre-contractual steps and performance of a contract, Art. 6(1)(b) GDPR).
- Handling orders, payments, shipping, invoicing and support (performance of a contract and legal tax and accounting obligations, Art. 6(1)(b) and 6(1)(c)).
- Replying to contact-form requests and preparing quotes (Art. 6(1)(b) and, for general enquiries, legitimate interest, Art. 6(1)(f)).
- Keeping the site secure and preventing abuse and fraud (legitimate interest, Art. 6(1)(f)).
- Usage statistics with Google Analytics (consent, Art. 6(1)(a)), which you can withdraw at any time.
4. Who we share data with
Data is processed by the controller and, on its behalf, by providers of services needed to run the site, appointed as processors where required:
- hosting and cloud infrastructure providers that host the site and database;
- Stripe, for payment processing;
- providers of the transactional e-mail service (order confirmations, password recovery);
- Google, for Google sign-in (if you use it) and Google Analytics (only with your consent);
- carriers and couriers for product delivery;
- tax, accounting and legal advisers, to the extent necessary.
5. Transfers outside the European Economic Area
Some providers (for example Google and Stripe) may also process data outside the EEA. Such transfers rely on European Commission adequacy decisions or standard contractual clauses.
6. How long we keep data
- Account data: while the account stays active; you can ask for deletion at any time.
- Order and invoicing data: 10 years, as required by tax and accounting law.
- Contact requests: as long as needed to reply and no longer than 24 months, unless a contract follows.
- Analytics data: according to the retention set in Google Analytics, only if you gave consent.
7. Your rights
You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. You can withdraw consent to analytics cookies from the Cookie page, without affecting processing already carried out.
To exercise your rights use the contact details in section 1. You also have the right to lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali (www.garanteprivacy.it).
8. Whether providing data is required
Providing the data marked as required in forms is necessary to create an account, place an order or answer a request. Without it we cannot supply the requested service. There is no automated decision-making or profiling.