PRIVACY POLICY

Last updated: 2026

1. Purpose and Legal Framework

This Privacy Policy explains how Mesosystem – Investimentos, LDA, operating under the commercial name MCCM Medical Cosmetics (“MCCM”, “we”, “us” or “our”), collects, uses, stores, discloses and protects personal data in connection with our website, e-commerce platform, products, services, customer relationships and professional communications.

MCCM is committed to protecting personal data and processing it in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Portuguese Law No. 58/2019, applicable e-commerce and consumer legislation, and any other applicable data protection legislation.

This Privacy Policy should be read together with our Terms and Conditions, Returns, Refunds and Delivery Policy, Cookie Policy and any other specific notices provided to customers or users at the time personal data is collected.

By using our website, creating an account, placing an order, contacting us or otherwise interacting with MCCM, you acknowledge that you have read this Privacy Policy.

2. Data Controller

The entity responsible for the processing of personal data is:

Mesosystem – Investimentos, LDA
Trading as: MCCM Medical Cosmetics
NIPC: 516445863
Registered address: Rua da Gandra, Lote 10, 4805-017 Caldas das Taipas, Guimarães, Portugal
Email: info@mccmmedicalcosmetics.com

For privacy-related enquiries, requests or complaints, please contact:

info@mccmmedicalcosmetics.com

3. Who This Policy Applies To

This Privacy Policy applies to individuals who:

• browse or use our website;

• create or maintain an account;

• purchase or enquire about our products;

• contact our customer service team;

• subscribe to newsletters or commercial communications;

• participate in promotions, loyalty programmes or the MCCM Club;

• interact with MCCM through social media;

• represent a company, clinic, distributor or other professional organisation that purchases or enquires about MCCM products; or

• otherwise provide personal data to MCCM.

Because MCCM supplies products intended primarily for professional use, we may, where reasonably necessary and proportionate, request information relating to a customer's professional status, business activity or eligibility to purchase or use certain products.

4. Categories of Personal Data We May Process

Depending on the nature of our relationship with you and the services you use, we may process the following categories of personal data:

4.1 Identification Data

• First and last name;

• Identification document details where legally required or reasonably necessary;

• Date and place of birth where required for a specific legitimate purpose;

• Country of residence;

• Billing and delivery address.

4.2 Contact Data

• Email address;

• Telephone or mobile number;

• Other contact information provided by you.

4.3 Professional and Business Information

Where relevant to the purchase or use of professional products:

• Profession;

• Professional qualifications or status;

• Professional registration or licence information;

• Company or clinic name;

• Position or professional role;

• Business address;

• Professional experience or other information reasonably necessary to establish eligibility for professional products.

4.4 Order, Transaction and Account Information

• Products ordered;

• Order history;

• Delivery information;

• Invoices and transaction records;

• Customer service communications;

• Returns, refunds and complaints;

• Account information.

4.5 Payment and Financial Information

Payments may be processed through third-party payment service providers.

MCCM may receive limited payment-related information necessary to confirm and manage transactions, such as payment status, transaction reference and payment method.

Where payment information is processed directly by a payment provider, the provider may process such information in accordance with its own privacy policy and applicable legal requirements.

4.6 Website and Technical Information

We may collect technical information such as:

• IP address;

• browser type;

• device information;

• operating system;

• language preferences;

• website interaction data;

• login information;

• cookies and similar technologies; and

• security and technical logs.

4.7 Information Provided Voluntarily

We may process any information you voluntarily provide when contacting us, including information submitted through forms, email, customer support, social media or other communication channels.

5. Information Relating to Professional Products

MCCM supplies products that are intended for professional use and that may be subject to specific professional, regulatory, import or use requirements depending on the destination country.

Where reasonably necessary to fulfil an order, comply with applicable law, prevent misuse or verify eligibility, MCCM may request and process information relating to the customer's professional status or ability to lawfully purchase, receive or use the relevant products.

Customers are responsible for ensuring that the information provided to MCCM is accurate and sufficient for the purposes of the transaction.

The customer is also responsible for ensuring that:

• the delivery details supplied to MCCM are accurate and complete;

• the customer is legally entitled to receive the products;

• any applicable import, customs, regulatory or professional requirements in the destination country are satisfied; and

• any required professional qualifications, licences, registrations or authorisations are in place.

MCCM may request additional information where reasonably necessary to process an order or comply with applicable legal, regulatory, customs or professional requirements.

Nothing in this Privacy Policy limits any mandatory legal rights or obligations applicable to the parties.

6. Purpose of Personal Data Processing

Personal data may be processed for the following purposes:

6.1 Account and Customer Management

• Creating and managing customer accounts;

• Maintaining customer records;

• Providing customer support;

• Responding to questions, requests and complaints;

• Communicating with customers regarding their account or orders.

6.2 Order Fulfilment

• Processing and confirming orders;

• Processing payments;

• Preparing invoices;

• Organising delivery;

• Communicating delivery information;

• Managing returns, refunds and exchanges;

• Handling product-related enquiries.

6.3 Legal and Regulatory Compliance

Personal data may be processed where necessary to:

• comply with legal and regulatory obligations;

• comply with accounting and tax requirements;

• respond to lawful requests from competent authorities;

• meet customs or import-related requirements;

• establish, exercise or defend legal claims;

• prevent fraud, abuse or unlawful activity; or

• protect the rights, property and security of MCCM, its customers and third parties.

6.4 Professional Eligibility and Product Compliance

Where appropriate, personal data may be used to verify professional status or eligibility for products intended for professional use and to ensure that MCCM can comply with applicable safety, regulatory or distribution requirements.

6.5 Customer Communications

We may contact customers regarding:

• orders;

• payments;

• deliveries;

• returns;

• product information;

• account matters;

• safety or regulatory notices; and

• other communications necessary for the performance or management of the customer relationship.

6.6 Marketing and Commercial Communications

Where required by applicable law, MCCM will send marketing communications only where an appropriate legal basis exists, including consent where required.

Marketing communications may include information about:

• MCCM products;

• new product launches;

• promotions;

• professional education;

• events;

• newsletters;

• special offers; and

• other products or services that may be relevant to the recipient.

Recipients may withdraw consent or opt out of marketing communications at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting:

info@mccmmedicalcosmetics.com

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Commercial Profiling

Where legally permitted, MCCM may create customer segments or commercial profiles based on information such as purchasing history, professional information, preferences, interactions with our communications and website activity.

This may be used to:

• improve our products and services;

• personalise communications;

• identify relevant products or educational content;

• understand customer preferences; and

• improve our commercial and marketing activities.

MCCM does not intend to make decisions producing legal or similarly significant effects solely through automated processing.

Where applicable law requires additional safeguards or consent for profiling or direct marketing, MCCM will comply with those requirements.

8. Legal Bases for Processing

Depending on the circumstances, MCCM may rely on one or more of the following legal bases under the GDPR:

• Performance of a contract: where processing is necessary to process an order, provide products or services, manage an account or fulfil contractual obligations;

• Legal obligation: where processing is necessary to comply with applicable legal, tax, accounting, regulatory, customs or other obligations;

• Legitimate interests: where processing is necessary for legitimate business purposes, such as customer relationship management, fraud prevention, network and information security, service improvement, business administration or direct marketing where legally permitted;

• Consent: where consent is required by law, including for certain marketing activities or processing of specific categories of personal data;

• Establishment, exercise or defence of legal claims: where necessary to protect or enforce MCCM's legal rights.

Where processing is based on consent, consent may be withdrawn at any time, without affecting the lawfulness of processing performed before withdrawal.

9. Special Categories of Personal Data

MCCM does not generally require health data or other special categories of personal data to place an ordinary order.

Information concerning matters such as skin type, treatment history or other potentially health-related information should only be provided where specifically requested or necessary for a particular service or professional purpose.

Where MCCM processes special categories of personal data within the meaning of Article 9 GDPR, it will do so only where a valid legal condition under applicable law permits such processing.

Customers should therefore avoid providing unnecessary health or other sensitive information through ordinary contact forms, emails or other communication channels.

10. Data Sharing

MCCM does not sell personal data.

Personal data may, where necessary and legally permitted, be disclosed to selected third parties that provide services to MCCM, including:

• payment service providers;

• logistics and delivery companies;

• IT and hosting providers;

• website and e-commerce service providers;

• customer support providers;

• accounting, legal and professional advisers;

• marketing and communication service providers;

• fraud prevention and security providers;

• distributors or commercial partners where necessary to fulfil an order or provide a requested service; and

• public authorities or other entities where disclosure is required by law.

Third-party service providers will only receive the information reasonably necessary to perform their services and, where required, will be subject to appropriate contractual and legal safeguards.

11. International Data Transfers

Some service providers, distributors or business partners may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, MCCM will implement the safeguards required under applicable data protection law.

Depending on the circumstances, these safeguards may include:

• an adequacy decision adopted by the European Commission;

• the European Commission's Standard Contractual Clauses;

• other legally recognised transfer mechanisms; or

• another lawful basis for international data transfer.

Where necessary, MCCM may take additional measures to ensure an appropriate level of protection for personal data.

12. Data Retention

MCCM retains personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account:

• the nature and purpose of the processing;

• the ongoing customer relationship;

• applicable legal and regulatory obligations;

• accounting and tax requirements;

• warranty, product safety and regulatory obligations;

• limitation periods for potential claims; and

• the need to establish, exercise or defend legal rights.

After the applicable retention period, personal data will be securely deleted, anonymised or otherwise handled in accordance with applicable law.

Where deletion is temporarily prevented by a legal obligation or legitimate need to preserve evidence, the data may be securely retained or restricted until the relevant obligation or need expires.

13. Confidentiality and Security

MCCM implements appropriate technical and organisational measures designed to protect personal data against:

• accidental or unlawful destruction;

• loss;

• alteration;

• unauthorised disclosure;

• unauthorised access; and

• other unlawful forms of processing.

Access to personal data is limited to individuals and service providers who reasonably require such access for legitimate business or legal purposes.

Nevertheless, no electronic transmission or storage system can be guaranteed to be completely secure. MCCM therefore cannot guarantee absolute security of information transmitted through the internet.

14. Customer Responsibility for Information and Delivery Details

Customers are responsible for ensuring that the personal information supplied to MCCM is accurate, complete and up to date.

In particular, customers are responsible for providing accurate:

• name and contact details;

• billing information;

• delivery address;

• telephone number;

• email address; and

• professional or regulatory information where required.

Where a customer provides inaccurate or incomplete information that results in a failed delivery, delay, customs issue, inability to contact the recipient or other operational problem, MCCM may be unable to fulfil the relevant order as expected.

For international orders, the customer remains responsible for providing the information reasonably required for customs clearance and for complying with the applicable import requirements of the destination country.

Further provisions concerning delivery, importation, customs and receipt of products are set out in MCCM's Terms and Conditions and Returns, Refunds and Delivery Policy.

15. Data Subject Rights

Subject to applicable legal conditions and limitations, individuals have the right to:

Right of Access

To request confirmation as to whether MCCM processes their personal data and, where applicable, obtain access to that data and relevant information concerning its processing.

Right to Rectification

To request correction of inaccurate personal data or completion of incomplete information.

Right to Erasure

To request deletion of personal data where the applicable legal conditions are met.

Right to Restriction

To request restriction of processing where the conditions established by applicable law are satisfied.

Right to Object

To object to certain processing activities, including processing based on legitimate interests and, where applicable, direct marketing.

Right to Data Portability

Where applicable, to receive personal data provided to MCCM in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right to Withdraw Consent

Where processing is based on consent, to withdraw that consent at any time.

Right Not to Be Subject to Certain Automated Decisions

To benefit from the protections applicable to decisions based solely on automated processing where such decisions produce legal or similarly significant effects.

These rights are subject to the conditions, exceptions and limitations established by applicable law. MCCM may request reasonable information necessary to verify the identity of the person making a request.

16. How to Exercise Your Rights

Requests concerning data protection rights should be sent to:

info@mccmmedicalcosmetics.com

Please use the subject/reference:

“GDPR Rights”

Written requests may also be sent to:

Mesosystem – Investimentos, LDA
Rua da Gandra, Lote 10
4805-017 Caldas das Taipas
Guimarães, Portugal

MCCM will respond within the period required by applicable data protection legislation.

Where permitted by law, MCCM may refuse or limit a request where the applicable legal requirements for exercising the relevant right have not been satisfied.

17. Supervisory Authority

Individuals have the right to lodge a complaint with the competent data protection supervisory authority.

In Portugal, the competent supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)

The right to lodge a complaint is without prejudice to any other administrative or judicial remedy available under applicable law.

18. Social Media and Third-Party Platforms

MCCM may maintain profiles or pages on social media and other third-party platforms, including Facebook, Instagram and LinkedIn.

Interactions with those platforms may involve the processing of personal data by the relevant platform operator.

Such processing is governed by the respective platform's privacy policies and terms. MCCM does not control the independent processing activities carried out by those third parties.

Where you interact with MCCM through a third-party platform, certain information may be made available to us depending on your privacy settings and the platform's functionality.

19. Cookies and Similar Technologies

MCCM uses cookies and similar technologies to operate, secure and improve its website and, where applicable, to analyse usage and support marketing activities.

The use of cookies is governed by our separate Cookie Policy, which explains the categories of cookies used, their purposes and, where applicable, how users can manage their preferences.

20. E-Commerce

MCCM operates an e-commerce platform through which customers may purchase products.

Personal data collected during registration, checkout and order fulfilment may be processed for the purposes of:

• creating and managing customer accounts;

• processing orders;

• verifying transactions;

• processing payments;

• issuing invoices;

• arranging delivery;

• managing customer support;

• handling returns and refunds;

• meeting legal and regulatory obligations; and

• preventing fraud or misuse.

Where products are intended for professional use, MCCM may request additional information reasonably necessary to verify eligibility or fulfil legal, regulatory or commercial requirements.

Customers are responsible for ensuring that the products they order may lawfully be purchased, imported, received and used in the destination country.

21. Third-Party Websites and Services

Our website may contain links to third-party websites, platforms or services.

MCCM is not responsible for the privacy practices, content or security of third-party websites.

Users should review the privacy policies of such third parties before providing personal information.

22. Children's Privacy

Our products and services are intended primarily for adults and professional customers.

MCCM does not knowingly seek to collect personal data from children where such collection is not legally permitted.

If we become aware that personal data has been collected from a child in circumstances where collection was not permitted, we will take appropriate steps in accordance with applicable law.

23. Changes to This Privacy Policy

MCCM may update this Privacy Policy from time to time to reflect:

• changes in applicable legislation;

• regulatory requirements;

• changes to our business or services;

• changes to our data processing activities; or

• improvements to our privacy practices.

The updated version will be published on our website with an updated revision date.

Where required by law, MCCM will provide additional notice or seek consent for material changes.

We encourage users and customers to review this Privacy Policy periodically.

24. Contact

For any question regarding this Privacy Policy, personal data or the processing of personal information, please contact:

info@mccmmedicalcosmetics.com

Mesosystem – Investimentos, LDA
Trading as MCCM Medical Cosmetics
NIPC 516445863
Rua da Gandra, Lote 10
4805-017 Caldas das Taipas
Guimarães, Portugal

© 2026 MCCM Medical Cosmetics. All rights reserved.