Privacy policy

Last updated: May 11, 2026

1. Data Controller
   Your personal data is processed by Mesosystem Investimentos (MI), operator of the website mccosmetics.ny, acting as the data controller in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese data protection laws.

Contact details:
Mesosystem Investimentos (MI)
Rua Gandra, Lote 10 – Zona Industrial da Gandra, Spinpark
4050-371 Porto, Portugal
Email: info@mccosmetic.com

1. Personal Data We Collect
   We may collect and process the following categories of personal data when you use our website, place an order, create an account, or contact us:

• Name

• Billing and shipping address

• Email address

• Phone number

• Payment and transaction information

• Account credentials and preferences

• Purchase history and shopping activity

• Communications with customer support

• Device, browser, IP address, and usage data

• Information collected through cookies and similar technologies

Payment information is processed securely through our payment service providers and is not stored directly by us beyond what is necessary for legal and operational purposes.

1. How We Collect Your Data
   We collect personal information:

• Directly from you when you place an order, create an account, subscribe to marketing communications, or contact us

• Automatically through cookies, analytics tools, and similar technologies when you browse our website

• From service providers and partners who support payment processing, shipping, analytics, marketing, and website functionality

1. Purpose and Legal Basis for Processing
   We process your personal data for the following purposes:

• To process and fulfil your orders

• To manage payments, shipping, returns, and exchanges

• To provide customer support and communicate with you

• To improve and personalize your shopping experience

• To maintain website security and prevent fraud

• To comply with legal and tax obligations

• To send marketing communications where you have provided consent

The legal bases for processing include contractual necessity, compliance with legal obligations, legitimate business interests, and your consent where required.

1. Sharing of Personal Data
   We may share your personal data with trusted third parties only where necessary to operate our business and provide our services, including:

• Shopify, which powers our online store and infrastructure

• Payment processors

• Shipping and logistics providers

• IT, hosting, analytics, and customer support providers

• Marketing and advertising partners

• Public authorities or legal entities where required by law

These third parties are contractually required to process your information securely and in accordance with applicable data protection laws.

1. Shopify Services
   Our online store is hosted by Shopify, which may process personal data to provide and improve the platform services. Information submitted through the website may be transferred to Shopify and its service providers, including outside the European Economic Area.

For more information about how Shopify processes personal data, please consult Shopify’s Privacy Policy.

1. International Data Transfers
   Your personal data may be transferred and processed outside the European Economic Area (EEA) when necessary for the operation of our services. In such cases, we ensure appropriate safeguards are in place, including the use of Standard Contractual Clauses approved by the European Commission or equivalent legal mechanisms.

2. Data Retention
   We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy and to comply with legal obligations.

Accounting, invoicing, and tax-related records may be retained for a minimum period required under Portuguese law, generally up to 10 years.

1. Your Rights Under GDPR
   Under the GDPR, you have the right to:

• Access your personal data

• Correct inaccurate or incomplete data

• Request deletion of your data

• Restrict or object to certain processing activities

• Withdraw consent at any time where processing is based on consent

• Request data portability

• Lodge a complaint with the Portuguese Data Protection Authority (CNPD)

To exercise your rights, please contact us at info@mccosmetic.com.

You may also submit a complaint to the Portuguese supervisory authority:
Comissão Nacional de Proteção de Dados (CNPD)
Website: https://www.cnpd.pt

1. Cookies and Tracking Technologies
   We use cookies and similar technologies to:

• Ensure website functionality

• Remember your preferences

• Analyze website traffic and performance

• Improve user experience

• Deliver personalized advertising and marketing

You can manage or withdraw your cookie preferences at any time through our cookie consent settings.

1. Security Measures
   We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, misuse, or disclosure. However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

2. Children’s Privacy
   Our services are not directed to children, and we do not knowingly collect personal data from individuals under the age of 16. If we become aware that a child has provided personal data, we will take steps to delete it promptly.

3. Third-Party Websites
   Our website may contain links to third-party websites or services. We are not responsible for the privacy practices, policies, or content of external websites.

4. Changes to This Privacy Policy
   We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Any updates will be posted on this page together with the revised “Last updated” date.

5. Contact
   If you have questions regarding this Privacy Policy or wish to exercise your rights, please contact:

Mesosystem Investimentos (MI)
Email: info@mccosmetic.com
Address: Rua Gandra, Lote 10 – Zona Industrial da Gandra, Spinpark, 4050-371 Porto, Portugal