GDPR Privacy Policy
GDPR Privacy Policy
Last updated: 04 September 2026
At Medna.Shop, we respect your privacy and are committed to protecting your personal data.
This Privacy Policy explains how Lexa Limited, trading as Medna.Shop (“Medna.Shop”, “we”, “us” or “our”), collects, uses, stores and protects your personal data when you visit or use www.medna.shop (the “Website”), purchase our products, create an account, contact us, book a workshop or otherwise interact with us.
We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act (Chapter 586 of the Laws of Malta) and other applicable Maltese and European data-protection and electronic-communications legislation.
Please read this Privacy Policy carefully so that you understand how and why we use your personal data.
1. Who We Are
The Website www.medna.shop is operated by:
Lexa Limited
103 Strait Street
Valletta, VLT 1436
Malta
Company registration number: C 76762
Trading name / brand: Medna.Shop
Website: www.medna.shop
Email: info@medna.shop
For the purposes of the GDPR and applicable Maltese data-protection legislation, Lexa Limited is the data controller responsible for the processing of personal data described in this Privacy Policy.
Throughout this Privacy Policy, “Medna.Shop”, “we”, “us” and “our” refer to Lexa Limited, the company operating the Medna.Shop Website.
If you have any questions about how we collect or use your personal data, or if you wish to exercise any of your data-protection rights, you can contact us at info@medna.shop.
2. What Personal Data We Collect
We collect personal data that you provide to us directly, as well as certain information that may be collected automatically when you use our Website.
The information we collect depends on how you interact with Medna.Shop.
2.1 Information You Provide When Placing an Order
When you place an order through our Website, we may collect:
- your full name;
- billing address;
- delivery address;
- email address;
- telephone or mobile number, where provided;
- details of the products you purchase;
- order number and order history;
- delivery information;
- payment status;
- information relating to returns, refunds or exchanges; and
- communications relating to your order.
Where payment is processed by a third-party payment provider, such as a card or payment processor, we generally do not receive or store your complete payment-card number or security code.
Your payment information may instead be processed directly by the relevant payment provider in accordance with its own privacy policy and security requirements.
2.2 Customer Account Information
If you create an account with us, we may collect:
- your name;
- email address;
- telephone number, where provided;
- billing and delivery addresses;
- account login information;
- order history;
- account preferences; and
- other information you choose to provide.
2.3 Information You Provide When Contacting Us
If you contact us by email, telephone, contact form, social media or another communication channel, we may collect:
- your name;
- contact details;
- the contents of your communication;
- attachments or information you voluntarily provide; and
- information necessary to respond to and resolve your enquiry.
2.4 Marketing Information
If you subscribe to our newsletter or marketing communications, we may collect:
- your name;
- email address;
- marketing preferences;
- your subscription and consent status; and
- information about your interaction with our marketing communications, where legally permitted.
You can unsubscribe from marketing communications at any time.
2.5 Technical and Website Information
When you visit our Website, certain information may be collected automatically.
This may include:
- IP address;
- browser type and version;
- device type;
- operating system;
- language and regional settings;
- approximate location;
- date and time of your visit;
- pages and products viewed;
- referring website;
- Website interactions;
- technical logs; and
- information relating to Website security.
Some of this information may constitute personal data where it can be associated with you or your device.
3. How We Use Your Personal Data
We may use your personal data for the following purposes:
- to operate and maintain our Website;
- to process and fulfil your orders;
- to arrange delivery of your purchases;
- to process payments, refunds and returns;
- to manage customer accounts;
- to communicate with you about your orders;
- to respond to enquiries and provide customer support;
- to manage complaints and customer-service requests;
- to arrange and administer workshops;
- to provide quotations and manage business enquiries;
- to improve our products, services and Website;
- to maintain the security of our Website and systems;
- to detect and prevent fraud, abuse and other unlawful activity;
- to comply with our legal and regulatory obligations;
- to maintain accounting, tax and business records;
- to send marketing communications where legally permitted;
- to administer promotions or competitions, where applicable;
- to establish, exercise or defend legal claims; and
- to carry out other purposes explained to you when your personal data is collected.
We will not use your personal data for purposes that are incompatible with those described in this Privacy Policy unless permitted or required by applicable law.
4. Our Legal Bases for Processing Your Personal Data
Under the GDPR, we must have a lawful basis for processing your personal data.
Depending on the circumstances, we may rely on the following legal bases.
4.1 Performance of a Contract
We may process your personal data when it is necessary to enter into or perform a contract with you.
This may apply when we:
- process your order;
- arrange delivery;
- process payments;
- manage your customer account;
- handle returns and refunds;
- provide customer support relating to your purchase; or
- arrange and provide a workshop you have booked.
4.2 Legal Obligations
We may process your personal data where necessary to comply with a legal obligation.
This may include obligations relating to:
- accounting;
- taxation;
- consumer protection;
- financial records;
- responding to lawful requests from authorities; and
- other legal or regulatory requirements.
4.3 Legitimate Interests
We may process your personal data where this is necessary for our legitimate interests, provided that your fundamental rights and freedoms do not override those interests.
Our legitimate interests may include:
- operating and improving our business;
- improving our Website;
- protecting our Website and systems;
- preventing fraud and misuse;
- maintaining business records;
- managing customer relationships;
- improving our services; and
- protecting our legal rights.
Where we rely on legitimate interests, we consider the potential impact on your privacy and apply appropriate safeguards.
4.4 Consent
Where required by law, we will ask for your consent before processing your personal data.
This may apply to certain:
- marketing communications;
- non-essential cookies;
- analytics technologies;
- advertising technologies; and
- personalised advertising.
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew your consent.
5. Orders, Payments and Deliveries
When you place an order with Medna.Shop, we need to process certain personal information in order to complete your purchase.
Depending on the payment method selected at checkout, payments may be processed through Shopify Payments, Revolut or other payment services made available through our Shopify checkout.
Payment service providers may process payment and transaction information in accordance with their own privacy policies and applicable legal requirements.
For delivery and fulfilment, we may share the personal information necessary to complete your order with postal operators, courier companies and logistics providers that we use from time to time.
Depending on the destination and delivery method selected, these providers may include local or national postal services, international postal operators, courier companies and other logistics providers.
The information shared may include:
- your name;
- delivery address;
- telephone number where required;
- email address where applicable;
- order reference; and
- other information reasonably necessary to complete the delivery.
We only share the information necessary for the relevant delivery or fulfilment service.
6. Marketing Communications
We may send you information about our products, services, promotions and special offers where permitted by applicable law.
Where consent is required, we will obtain your consent before sending marketing communications.
You can unsubscribe from marketing communications at any time by clicking the unsubscribe link in a marketing email or by contacting us at info@medna.shop.
Unsubscribing from marketing communications will not prevent us from sending important service-related communications.
For example, we may still contact you regarding:
- an order you have placed;
- payment;
- delivery;
- returns or refunds;
- your customer account; or
- important changes affecting a service you use.
7. Cookies and Similar Technologies
Our Website uses cookies and similar technologies.
Cookies are small text files that may be stored on your device when you visit a website.
We may use cookies to:
- operate essential Website functions;
- keep your shopping basket working;
- remember your preferences;
- keep our Website secure;
- understand how visitors use our Website;
- improve Website performance;
- measure advertising effectiveness; and
- provide personalised advertising, where permitted.
Some cookies are essential for the Website to function and may be used without consent where permitted by law.
Other cookies, including certain analytics and advertising cookies, may require your consent before they are activated.
Where required, you can manage your cookie preferences through the cookie-consent banner or settings available on our Website.
For more information, please see our Cookie Policy.
8. Who We Share Your Personal Data With
We do not sell your personal data.
However, we may share personal data with trusted third parties where this is necessary to operate our business and provide our services.
These may include:
Payment Service Providers
Payment service providers may process payment information so that we can receive payment for your order, prevent fraud and, where necessary, process refunds.
These may include Shopify Payments, Revolut and other payment services made available through our Shopify checkout.
Delivery and Logistics Providers
We may provide postal operators, courier companies and logistics providers with information necessary to deliver your order.
Website and Technology Providers
We may use third-party providers for:
- Website hosting;
- cloud services;
- Website security;
- software;
- technical support;
- data storage;
- customer support; and
- Website maintenance.
Marketing and Email Providers
Where applicable, we may use third-party providers to send newsletters, promotional communications and other customer communications.
Analytics and Advertising Providers
Where legally permitted, and where required with your consent, we may use third-party analytics and advertising services to understand Website usage and measure or provide advertising.
Professional Advisers
We may share information with professional advisers such as accountants, auditors, lawyers, insurers and other professional service providers where necessary.
Authorities and Legal Purposes
We may disclose personal data where required or permitted by law, including to courts, government authorities, regulators, law-enforcement authorities or other competent authorities.
We may also disclose information where necessary to establish, exercise or defend our legal rights.
9. Service Providers and Data Processors
Some companies provide services to us while processing personal data on our behalf.
These companies may include Website hosting providers, payment providers, postal and courier companies, email providers, analytics providers, customer-support providers and other technology providers.
Where applicable, we take appropriate steps to ensure that such providers process personal data in accordance with applicable data-protection law and provide appropriate security safeguards.
We only permit service providers to process personal data for appropriate purposes and in accordance with our contractual arrangements and applicable law.
10. International Transfers of Personal Data
Some of the service providers we use may process personal data outside Malta or outside the European Economic Area (“EEA”).
This may occur because certain technology, payment, hosting, analytics, ecommerce, logistics or other service providers operate internationally.
Where personal data is transferred outside the EEA, we will ensure that the transfer is carried out in accordance with the requirements of the GDPR.
Depending on the circumstances, we may rely on:
- an adequacy decision of the European Commission;
- Standard Contractual Clauses approved by the European Commission;
- another lawful transfer mechanism recognised under applicable law; or
- an applicable legal derogation.
Where appropriate, additional safeguards may be implemented to protect personal data transferred internationally.
The countries and service providers involved in international transfers depend on the technology and services used by Medna.Shop.
Further information about specific international transfers and the safeguards used can be requested by contacting us at info@medna.shop.
11. How Long We Keep Your Personal Data
We do not keep personal data for longer than reasonably necessary for the purposes for which it was collected, unless we are required or permitted by law to retain it for longer.
The length of time we keep information depends on the type of information and the reason we need it.
Order and Customer Information
We retain information relating to purchases for as long as necessary to manage the customer relationship and fulfil our legal, accounting, tax and business obligations.
Payment and Transaction Information
Certain transaction records may be retained for periods required by applicable accounting and tax laws.
Customer-Service Communications
We generally retain communications for as long as reasonably necessary to resolve your enquiry and maintain appropriate business records.
Marketing Information
Where marketing is based on consent, we will retain your marketing preferences and consent records as necessary to manage your subscription and demonstrate compliance.
Customer Accounts
We retain account information while your account remains active, subject to information that we may be required to retain after account closure.
Technical and Security Information
Technical logs and security information may be retained for a limited period appropriate to security, troubleshooting and legal requirements.
Legal Claims
Information may be retained for as long as necessary to establish, exercise or defend legal claims.
When personal data is no longer required, we will securely delete it, anonymise it, or otherwise dispose of it in accordance with our applicable retention procedures.
12. How We Protect Your Personal Data
We take reasonable and appropriate technical and organisational measures to protect your personal data against:
- unauthorised access;
- unauthorised disclosure;
- accidental loss;
- destruction;
- alteration; and
- other unlawful or unauthorised processing.
Depending on the circumstances, these measures may include secure connections, access controls, authentication systems, restricted access to personal data, secure hosting, security monitoring, backups, confidentiality obligations, contractual safeguards and procedures for responding to security incidents.
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
13. Personal Data Breaches
If we become aware of a personal data breach, we will assess the incident and take the appropriate steps required under applicable data-protection law.
Where required by the GDPR, we will notify the relevant supervisory authority within the applicable legal timeframe.
Where a breach is likely to result in a high risk to affected individuals, we will also notify those individuals where required by law.
14. Your Privacy Rights
Depending on the circumstances and subject to the conditions and exceptions provided by applicable law, you may have the following rights:
Right of Access
You may ask us whether we process personal data about you and request a copy of your personal data.
Right to Rectification
You may ask us to correct inaccurate or incomplete personal data.
Right to Erasure
In certain circumstances, you may ask us to delete your personal data.
This right is not absolute. For example, we may need to retain certain information where required by law or necessary for legal claims.
Right to Restriction
In certain circumstances, you may ask us to restrict how we process your personal data.
Right to Object
You may object to certain types of processing, including processing based on legitimate interests.
You have an unconditional right to object to the processing of your personal data for direct marketing purposes.
Right to Data Portability
Where the applicable GDPR requirements are satisfied, you may request certain personal data in a structured, commonly used and machine-readable format and, where technically feasible, request that it be transferred to another controller.
Right to Withdraw Consent
Where we process your personal data based on consent, you may withdraw that consent at any time.
Rights Relating to Automated Decision-Making
You may have rights relating to decisions based solely on automated processing, including profiling, where such processing produces legal or similarly significant effects and the applicable GDPR requirements are met.
15. How to Exercise Your Rights
If you wish to exercise any of your privacy rights, please contact us at:
Email: info@medna.shop
Please provide sufficient information to allow us to understand your request.
For security reasons, we may need to verify your identity before providing personal information or completing certain requests.
We will normally respond to a valid request without undue delay and, in principle, within one month of receiving your request.
Where permitted by the GDPR, this period may be extended by up to two additional months if the request is complex or numerous. If an extension is necessary, we will inform you within the applicable timeframe.
Requests are generally handled free of charge. However, where permitted by applicable law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.
16. Your Right to Complain
If you have concerns about how we process your personal data, we encourage you to contact us first so that we can try to resolve your concern.
You also have the right to lodge a complaint with the Maltese supervisory authority responsible for data protection:
Information and Data Protection Commissioner (IDPC)
Malta
Further information is available on the official IDPC website.
The IDPC is Malta's independent supervisory authority responsible for monitoring and enforcing data-protection legislation.
17. Children's Privacy
Our Website is not intentionally directed at children.
We do not knowingly collect personal data from children where doing so would be unlawful.
If you believe that a child has provided personal data to us without appropriate authorisation, please contact us so that we can investigate and take appropriate action.
18. Third-Party Websites
Our Website may contain links to third-party websites, applications or services.
If you follow a link to another website, that website will operate under its own privacy policy and terms.
We are not responsible for the privacy practices, security or content of third-party websites.
We recommend reviewing the privacy policy of any third-party website before providing personal information.
19. Social Media
Medna.Shop may use social-media platforms to communicate with customers and promote our products.
When you interact with us through a social-media platform, that platform may collect and process personal data in accordance with its own privacy policy.
The relevant social-media provider may also use cookies, pixels or similar technologies.
You should review the privacy and advertising settings of the relevant social-media platform for more information about how it processes your personal data.
20. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
Changes may be necessary because of:
- changes to our Website;
- changes to our products or services;
- changes to our service providers;
- changes to applicable laws;
- regulatory guidance;
- changes to our privacy practices; or
- technological developments.
When we make significant changes, we will take reasonable steps to bring those changes to your attention.
The “Last updated” date at the beginning of this Privacy Policy indicates when the policy was most recently updated.
We recommend checking this page periodically for the latest version.
21. Contact Us
If you have any questions about this Privacy Policy, your personal data, or how we process personal data, please contact us.
Lexa Limited
Trading as Medna.Shop
Registered address:
103 Strait Street
Valletta, VLT 1436
Malta
Company registration number: C 76762
Email:
info@medna.shop
Website:
www.medna.shop
Related Policies
Cookie Policy
Terms & Conditions
Shipping Policy
Returns & Refund Policy
This GDPR Privacy Policy was last updated on 04 September 2026.