1. Who we are and how to reach us
This privacy policy explains how personal data is processed when you visit medlabdia.com, use our online shop, request a quote, subscribe to our newsletter or otherwise contact us. It applies to all medlabdia group companies named below.
| Controller (website operator) | medlabdia AG, Firststrasse 8, 8835 Feusisberg, Switzerland – sales@medlabdia.com |
|---|---|
| Seller and controller for orders from the EU / rest of world | medlabdia GmbH, Kurt-Schumacher-Ring 42a, 64572 Büttelborn, Germany |
| Seller and controller for orders from the USA | medlabdia Inc., 12801 N Stemmons Fwy, Suite 710, Farmers Branch, TX 75234, USA |
| Representative in the EU (Art. 27 GDPR) | medlabdia GmbH, address above |
| Representative in the UK (Art. 27 UK GDPR) | medlabdia UK & Ireland, Units 5 and 6, Stiltz Building, 6 Ledson Road, Roundthorn Industrial Estate, Manchester M23 9GP, United Kingdom |
| Privacy contact | sales@medlabdia.com (subject “Data protection”) |
Where an order or quotation is handled by medlabdia GmbH or medlabdia Inc., that company is responsible for the processing needed to perform the contract. medlabdia AG remains responsible for the website itself. The companies share customer and enquiry data within the group where this is needed to answer your request or to deliver and service products (see section 9).
2. Legal framework
We process personal data in line with the Swiss Federal Act on Data Protection (FADP/revDSG), the EU General Data Protection Regulation (GDPR), the UK GDPR and the German Telecommunications Digital Services Data Protection Act (TDDDG). For visitors and customers in the United States we also follow the applicable state privacy laws (see section 13).
Depending on the purpose, we rely on these legal bases (GDPR / UK GDPR):
- Contract and pre-contractual steps – Art. 6(1)(b): orders, quotes, customer accounts, delivery, invoicing, service.
- Legal obligation – Art. 6(1)(c): retention under commercial and tax law, export control and sanctions screening.
- Legitimate interests – Art. 6(1)(f): operating a secure and stable website, preventing fraud and abuse, answering business enquiries, B2B relationship management.
- Consent – Art. 6(1)(a) and § 25(1) TDDDG: newsletter, loading the Google Maps map. You can withdraw consent at any time with effect for the future.
3. Visiting the website – hosting and server logs
When you open our pages, your browser automatically sends technical data to our web server: IP address, date and time, page requested, referrer URL, browser type and version, operating system and the amount of data transferred. We need this data to deliver the website, to keep it secure and to analyse faults.
- Legal basis: Art. 6(1)(f) GDPR (secure and error-free operation).
- Storage: log files are deleted or anonymised after 14 days at the latest, unless they are needed to investigate a specific security incident.
- Hosting: the website is hosted by an external hosting provider that processes the data on our behalf under a data processing agreement (Art. 28 GDPR).
4. Security services
Website firewall (SiteGuarding)
All requests to our website pass through the cloud web application firewall of SiteGuarding. It filters attacks, spam and malicious bots. To do this it processes your IP address, request data and browser information. Legal basis: Art. 6(1)(f) GDPR – protecting our website and our customers' data.
Cloudflare Turnstile
Our forms (contact, quote request, newsletter, login) are protected by Cloudflare Turnstile, a privacy-friendly alternative to CAPTCHAs, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile checks in the background whether a human or a bot is submitting the form. It processes your IP address, browser and device characteristics and interaction signals; it does not set advertising cookies. Legal basis: Art. 6(1)(f) GDPR – spam and abuse prevention. Cloudflare is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions). More: cloudflare.com/privacypolicy.
5. Cookies and similar technologies
We only use cookies and local storage that are strictly necessary for the website and shop to work. They do not require consent (§ 25(2) TDDDG). We do not currently use web analytics, advertising or social-media tracking cookies.
| Name | Purpose | Duration |
|---|---|---|
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Shopping cart and checkout | Session / up to 48 hours |
| wordpress_logged_in_*, wordpress_sec_* | Customer account login | Session / up to 14 days with “remember me” |
| woocs_current_currency | Remembers the currency you selected (EUR / USD) | 30 days |
| sbjs_* (WooCommerce order attribution) | Records how an order reached the shop (e.g. direct, search, referral). Stored in your browser and only transmitted with an order; not used for cross-site tracking. | Session / up to 6 months |
| Wishlist / compare (wcboost_*) | Stores products you add to the wishlist or comparison | Up to 30 days |
| Cloudflare Turnstile (cf_*) | Bot protection on forms | Session |
You can delete cookies or block them in your browser settings at any time. If you block necessary cookies, the shop may not work properly.
If we introduce analytics or marketing tools in the future, we will only activate them after you have given consent via a consent banner, and we will update this policy beforehand.
6. Online shop, customer account and orders
When you register or place an order we process: company name, contact person, business address, delivery and invoice address, e-mail, phone number, VAT / tax ID, order details, payment status and correspondence.
- Purpose: concluding and performing the contract, delivery, invoicing, warranty and service, customer account management.
- Legal basis: Art. 6(1)(b) and (c) GDPR.
- Recipients: the medlabdia company that sells to you (GmbH or Inc.), carriers and forwarders (name, delivery address, phone for delivery notification), our tax advisers and auditors, and – for service – our service partner oneservice (see section 9).
- Storage: for the duration of the customer relationship; accounting records for 10 years and business letters for 6 years (Germany: § 147 AO, § 257 HGB; Switzerland: Art. 958f CO; USA: applicable IRS rules). You can delete your customer account at any time; records we must keep by law are then blocked.
Payment
If you pay with PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal receives the order amount, currency, order number and your billing details and is an independent controller for the payment. PayPal may perform a credit check. More: paypal.com/privacy. For payment by bank transfer or on account, we process your payment and bank details to reconcile payments.
Credit and sanctions checks
For purchases on account and for export shipments we may check your company against credit information and against EU, Swiss, UK and US sanctions and denied-party lists. Legal basis: Art. 6(1)(c) and (f) GDPR.
7. Contact, quote and service requests
When you contact us by e-mail, phone, the contact form or the “Request a quote” form, we process the data you provide (name, company, e-mail, phone, country, type of request, products of interest, message, the page you sent the request from) to answer your request and, where applicable, to prepare a quotation.
- Legal basis: Art. 6(1)(b) GDPR (pre-contractual) or Art. 6(1)(f) GDPR (answering business enquiries).
- Storage: form submissions are stored in our website database and our e-mail system. We delete enquiries that did not lead to a contract after 24 months, unless retention obligations apply.
- Recipients: the responsible medlabdia company and, for service requests, our authorised service partner oneservice.
8. Newsletter
If you subscribe to our newsletter, we process your e-mail address and – if provided – your name to send you news about products, pre-owned systems, events and offers. We use the double opt-in procedure: you will receive an e-mail and need to confirm your subscription. We log the time of subscription and confirmation and your IP address to be able to prove your consent.
- Legal basis: consent, Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every newsletter or by e-mail.
- Technology: the newsletter is managed with the self-hosted “Newsletter” plugin on our own website. E-mails are delivered via SMTP2GO (SMTP2GO Ltd., New Zealand). New Zealand has an EU and Swiss adequacy decision.
- Statistics: our newsletters may contain a tracking pixel and tracked links to measure openings and clicks per recipient. You can object by unsubscribing or disabling image loading in your e-mail program.
- Storage: until you unsubscribe; afterwards we keep your e-mail address on a block list for up to 3 years to prove the consent history and to respect your opt-out.
9. Group companies and service partner
medlabdia AG, medlabdia GmbH, medlabdia Inc. and medlabdia UK & Ireland share customer, order and enquiry data where this is necessary to answer your request, deliver products or provide service in your region. Service and maintenance of installed systems is performed by our partner oneservice (oneservice AG and its subsidiaries in Germany, the UK and the USA). For service requests we pass on your contact details, system data and the service request. Legal basis: Art. 6(1)(b) and (f) GDPR. Transfers between group companies and oneservice are governed by data transfer agreements including the EU Standard Contractual Clauses where required.
10. Other services used on the website
Google Maps
Our contact page can display a map of our Büttelborn office from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). The map is only loaded after you click “Load map”. When it loads, Google receives your IP address and may set cookies. Legal basis: consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. Google LLC is certified under the EU-U.S. Data Privacy Framework. More: policies.google.com/privacy.
Fonts and icons
All fonts (Oswald, Roboto) and icon sets are hosted on our own server. No connection to Google Fonts or other font services is made.
We link to our LinkedIn page with a simple link. No LinkedIn plugin or tracking code is embedded. LinkedIn only receives data when you click the link and visit LinkedIn.
Marketplaces and product data (Eselt, Google Merchant Center)
We publish our product catalogue on online marketplaces via Eselt (eselt.de, Germany) and provide a product feed to Google Merchant Center. Only product data is transmitted. If you buy through a marketplace (e.g. eBay, Amazon, Kaufland), the marketplace's privacy policy applies; order data is transferred to us via Eselt to fulfil the order (Art. 6(1)(b) GDPR).
E-mail delivery
Transactional e-mails from the website (order confirmations, form notifications, password resets) are sent via an authenticated SMTP service (WP Mail SMTP) that processes the e-mail content and recipient address on our behalf.
11. International data transfers
medlabdia operates in Switzerland, the EU, the UK and the USA. Personal data may therefore be transferred to these countries. Switzerland, the EU/EEA and the UK recognise each other as providing adequate protection. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework (including its UK and Swiss extensions) where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (with the UK Addendum and Swiss amendments) together with additional safeguards. You can request a copy of the safeguards using the contact details in section 1.
12. Your rights (Switzerland, EU, UK)
You have the right to:
- access your personal data (Art. 15 GDPR, Art. 25 FADP);
- rectification of inaccurate data (Art. 16 GDPR);
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR, Art. 28 FADP);
- object to processing based on legitimate interests, and at any time to direct marketing (Art. 21 GDPR);
- withdraw consent at any time with effect for the future (Art. 7(3) GDPR);
- lodge a complaint with a supervisory authority, e.g. the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), the Hessian Commissioner for Data Protection and Freedom of Information (HBDI, datenschutz.hessen.de – competent for medlabdia GmbH) or the UK Information Commissioner's Office (ico.org.uk).
We do not use automated decision-making or profiling that produces legal effects for you (Art. 22 GDPR).
13. Notice for visitors in the United States
Our website and shop are directed at businesses. In the last 12 months we have collected the categories of personal information described above: identifiers and contact details, commercial information (orders and enquiries), internet and network activity (server logs, security signals) and professional information (company and job role). We use this information only for the business purposes described in this policy.
- We do not sell personal information and do not share it for cross-context behavioural advertising.
- We do not knowingly collect personal information of children under 16.
- Depending on your state of residence (e.g. California, Colorado, Connecticut, Virginia, Texas), you may have the right to know, access, correct, delete and port your personal information, and the right not to be discriminated against for exercising these rights. Send your request to the contact in section 1; we will verify your identity before responding. You may use an authorised agent.
- We honour Global Privacy Control (GPC) signals as an opt-out of sale/sharing, even though we do not sell or share personal information.
14. Data security
We use TLS encryption for all pages, a web application firewall, bot protection, access controls and regular updates to protect your data. Please note that data transmission over the internet can never be completely secure.
15. Changes to this policy
We will update this privacy policy when our services or the legal requirements change. The current version is always available on this page.
Version: October 2026