Privacy Policy

1. Data Controller Information

MPLUS COSMETICS S.r.l. acts as the official Data Controller responsible for processing personal and corporate operational data gathered through our digital platforms and B2B communication channels.

Headquarters Address: Via Carlo Cattaneo 21/23, 20065 Inzago, Milan, Italy.
Legal Headquarters: Piazza della Conciliazione 1, 20123 Milan, Italy.
Contact Department: Compliance & Legal Operations ([email protected] / +39 02 8719 6950)

2. B2B Client Confidentiality & Proprietary Formula Security

As a leading OEM/ODM color cosmetics manufacturer, protecting our partners' proprietary formulas, custom applicator designs, and brand concepts is foundational to our operations:

• Non-Disclosure Compliance (NDA): All technical RFQ data, shade matching recipes, custom mascara brush blueprints, and bulk formula specifications shared by clients are strictly guarded under legally binding confidentiality agreements.
• IP Protection: Custom tooling, patent-pending brush designs, and innovative cosmetic textures produced in our Milan facility remain the protected property of the designated brand owner according to contractual terms.
• Restricted Access Protocols: Laboratory formula records and manufacturing processes are accessible solely by authorized R&D cosmetic chemists and project management personnel under strict access credentials.

3. Categories of Information Collected

A. Corporate Procurement & Inquiry Data

When international buyers initiate project requests, request technical samples, or contact our sales executives, we process necessary business contact details (name, corporate email address, phone number, company name, geographic market, and specific OEM product interests) to facilitate technical evaluations and commercial proposals.

B. Technical Navigation & Digital Analytics

To ensure optimal platform security and user experience for global partners, our web servers automatically log standard technical data (such as anonymized IP addresses, browser types, operational systems, regional access headers, and navigation timestamps). These records are held strictly for analytical and server stability monitoring.

4. Legal Basis for Processing under EU GDPR

MPlus Cosmetics processes commercial and technical information based on clear legal grounds in compliance with European Union regulations:

• Contractual Execution (Art. 6(1)(b) GDPR): Necessary for negotiating, drafting, and executing OEM manufacturing contracts, sample delivery, and commercial orders.
• Legitimate Business Interests (Art. 6(1)(f) GDPR): Maintaining robust cybersecurity, optimizing B2B website infrastructure, preventing commercial fraud, and upholding quality management systems (ISO 22716 / GMP).
• Legal Obligation (Art. 6(1)(c) GDPR): Compliance with Italian financial, export-import, and EU cosmetic safety regulatory frameworks.

5. International Data Transfers & Supply Chain Logistics

Operating across Europe, the Americas, Asia-Pacific, and the Middle East requires secure international data exchange. All transfers outside the European Economic Area (EEA) adhere strictly to Standard Contractual Clauses approved by the European Commission, ensuring your commercial data receives equivalent protection globally.

We do not sell, rent, or trade business contact information or confidential brand data to commercial third parties. Data access is restricted to verified logistical partners, customs declaration agencies, and IT infrastructure providers operating under strict data processor contracts.

6. Data Retention Period & Storage Protocols

Personal and commercial data connected with procurement inquiries, formulation developments, and manufacturing orders are retained for the duration of the commercial relationship plus mandatory statutory storage periods (10 years for financial records and technical safety files under EU Cosmetic Regulation 1223/2009).

7. Rights of International Business Partners

Authorized representatives of client companies maintain comprehensive data protection rights under the EU General Data Protection Regulation:

• Right of Access: Request confirmation of data held regarding your commercial entity.
• Right to Rectification: Correct inaccurate or outdated company contact or procurement details.
• Right to Erasure ('Right to be Forgotten'): Request deletion of non-statutory commercial data upon project termination.
• Right to Restriction & Objection: Restrict or object to data processing for marketing communications.
• Right to Data Portability: Receive structured technical datasets for system migration.

To exercise your statutory rights or submit data management inquiries, please contact our Compliance Office in writing at our Milan headquarters address or via email.