Your information.
Handled with purpose.

Who is responsible

The data controller

THEDERMALFILLER S.R.L., trading as MaxMed Systems, Str. Basel nr. 4, ap. 2, 300127 Timisoara, Romania, is the controller of the data described here. I am Catalin Calinoiu, and I handle every request myself. Write to contact@maxmedsystems.eu.

What data I process

• Enquiries: your name, professional title, clinic or company, country, email, telephone number, message and documents you choose to send.
• Orders: invoicing, payment and delivery details, correspondence and supply records.
• Professional contact: business contact details published by clinics on their own websites.
• Website access: technical connection data processed by the hosting and security provider, such as IP addresses and request information.

I do not ask for patient records, health information or other sensitive personal data. Please do not include them in your enquiry or attachments; they are not needed to arrange an order.

Why, and on what legal basis

• Enquiries and orders from individual clients: necessary steps you request before a contract, and performance of that contract — Article 6(1)(b).
• Contacts representing a clinic or company: my legitimate interest in answering professional enquiries and managing the business relationship — Article 6(1)(f).
• Professional verification and website security: my legitimate interests in checking eligibility and protecting the service — Article 6(1)(f), or Article 6(1)(c) where a specific legal requirement applies.
• Accounting and required supply records: applicable legal obligations, including medical-device traceability where relevant — Article 6(1)(c).
• Business email: where permitted, my legitimate interest in contacting practices about relevant professional products — Article 6(1)(f), subject to balancing that interest against your rights.

Legitimate interest does not replace any consent or other permission required by national electronic-marketing law. A publicly listed email address is not, by itself, permission to send marketing. You may object to direct marketing at any time, without giving a reason. A reply asking me to stop is enough; I retain only what is needed to respect that request.

Who receives the data

• Microsoft, which provides my Microsoft 365 email service.
• Cloudflare, which hosts and protects the website.
• The supply partner and courier, limited to information needed for the order and delivery.
• My accountant and public authorities where disclosure is required by law.

I do not sell or rent personal data. Some providers may process data outside the European Economic Area. Such transfers require a lawful transfer mechanism under the GDPR, such as an adequacy decision or appropriate safeguards. You can ask me for information about any transfers and safeguards relevant to your data.

How long I keep it

• Enquiries without an order: up to 24 months after our last contact.
• Supply and traceability records: for the period required by the applicable medical-device rules.
• Accounting documents: for the periods required by Romanian accounting and tax law.
• Do-not-contact records: for as long as needed to ensure that an objection to business email is respected.

Records may also need to be kept where necessary to establish, exercise or defend a legal claim.

This website

The website’s own code does not add advertising or analytics cookies. It stores one setting in your browser for the current session, to remember that you have confirmed the professional access notice.

Cloudflare’s hosting and security services may process technical connection data to serve and protect the site. The enquiry page prepares an email in your own email program; nothing is sent until you send it.

Your rights

You may request access to your personal data and correction of inaccurate information. Erasure, restriction and portability are available where the GDPR’s conditions are met. For example, records may need to be retained to meet a legal obligation or deal with a legal claim. Portability applies to data you provided that is processed automatically on the basis of consent or a contract.

You may object to processing based on legitimate interests, and to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Write to contact@maxmedsystems.eu. I respond without undue delay and within one month. If the complexity or number of requests makes an extension necessary, the GDPR allows up to two further months; I will tell you within the first month and explain why. I may ask for proportionate identity information if there is reasonable doubt about who is making the request.

You can complain directly to the supervisory authority where you live or work, or where an alleged infringement occurred. In Romania, this is the National Supervisory Authority for Personal Data Processing — ANSPDCP.

Last updated: 23 October 2026