Privacy Policy

This privacy policy applies to the mdrep.eu website and was last updated on 6 November 2026.

Data controller

The data controller is mdrep.eu S.r.l.s., with registered office at Via Roma, 28, 23900 Lecco (LC), Italy.

Collection and use of personal data

The personal data provided is processed using both automated and non-automated means, in accordance with the provisions of Regulation (EU) 2016/679, including those relating to data security, for the purpose of providing the requested information, carrying out the activities entrusted to the data controller and/or complying with specific legal obligations incumbent upon the data controller.

The data relates to EU Authorised Representative and related regulatory services for medical devices and concerns normal dealings with clients or prospective clients; no marketing activities are envisaged, unless specific consent has been given.

Data collected via the contact form

Via the contact form, we collect your full name, company name, email address, telephone number (optional), the manufacturer's country, the device class and the content of your message. This data is used exclusively to respond to your enquiry and to determine whether to initiate the service. The legal basis is the implementation of pre-contractual measures taken at the data subject's request (Article 6(1)(b) of the Regulation). The provision of data marked as mandatory is necessary in order to receive a reply.

Browsing data

The website is hosted on Cloudflare, which processes technical data such as IP addresses, browser types and pages requested in order to ensure the website's functionality, security and protection against misuse. Visitor statistics are collected using Cloudflare Web Analytics, in aggregated form and without the use of cookies or persistent identifiers. The contact form is protected by Cloudflare Turnstile, which verifies that the request originates from a person without using profiling cookies. The legal basis is the data controller's legitimate interest in the security and proper functioning of the website (Article 6(1)(f) of the Regulation).

Recipients of the data

The data may be processed, in their capacity as processors, by: Cloudflare, Inc. (hosting, security and website statistics) and Sendinblue SAS – Brevo (technical transmission of messages sent via the contact form). The data is also disclosed to persons authorised by the data controller and, where applicable, to public institutions or bodies, exclusively in relation to the requested activities and/or legal obligations.

Transfer of data outside the EU

Cloudflare, Inc. is based in the United States and is certified under the EU-US Data Privacy Framework; data transfers are also carried out on the basis of the standard contractual clauses approved by the European Commission.

Data retention

Data submitted via the contact form is retained for as long as is necessary to process the enquiry and, should a business relationship be established, for the duration of that relationship and any associated legal obligations; in no case for longer than 10 years from the date of the last processing operation. Technical browsing data is retained by Cloudflare for limited periods, in accordance with its own policies.

Rights of the data subject

The data subject has the right to obtain from the data controller access to, rectification, erasure, restriction and portability of their personal data, and to object to the processing of such data, as well as, in general, the rights set out in Articles 15 to 22 of Regulation (EU) 2016/679, by writing to the data controller at its registered office. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

Changes to this privacy policy

mdrep.eu S.r.l.s. may update this privacy policy from time to time; the current version is always published on this page, along with the date of the last update.