Consumer privacy notice

pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

1. Introduction

This notice provides a general overview of the main personal data processing activities carried out by Pizeta Pharma S.p.A. in relation to customers and consumers who interact with the website.

Separate privacy notices are provided for specific processing activities (for example, subscribing to the newsletter, sending enquiries to the Scientific Department, reporting adverse effects or using particular services available on the website). These notices are available in the relevant sections of the website and supplement this notice.

2. Definitions

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

3. Controller

Your personal data are processed by Pizeta Pharma S.p.A. (also referred to below as “Pizeta Pharma” or the “Company”), whose registered office is at Via Roma – Loc. Il Piano, 62039 Visso (MC), acting as controller pursuant to Regulation (EU) 2016/679.

If you have any questions or requests concerning the processing of your personal data, you may contact Pizeta Pharma S.p.A. at any time using the details below:

Controller

Company name: Pizeta Pharma S.p.A.

Administrative office address: Via Bruno Simonucci, 3, Ponte San Giovanni, 06135 Perugia (PG)

Telephone: +39 075 9474542

Email: info@pizetapharma.com

Certified email (PEC): greempharmsrl@legalmail.it

4. Categories of personal data processed

When you use the website and the services offered through it, the Controller may process different categories of personal data depending on the activity undertaken by the data subject and the service requested.

In particular, the Controller may process:

• identification data, such as first name, surname and other personal details;
• contact details, such as email address, telephone number and delivery or billing address;
• purchase data, such as information about orders placed, products purchased, delivery arrangements and purchase history;
• payment data, limited to the information needed to manage orders and related transactions; full payment instrument details are processed by payment service providers in accordance with their own privacy notices;
• browsing data, collected automatically when the website is used, such as IP address, device identifiers, browser information, access logs and other technical data required for the operation of the website and the security of systems;
• data included in enquiries submitted through the contact services made available by the Controller (for example requests for information, assistance, scientific support or other communications);
• any special categories of personal data, including data concerning health, solely where voluntarily provided by the data subject in connection with specific services (for example enquiries submitted to the Scientific Department or reports of suspected adverse effects), within the limits and for the purposes set out in the relevant specific privacy notices.

The specific categories of personal data processed, the purposes and legal bases of processing, retention periods and all other information required under Article 13 of Regulation (EU) 2016/679 are described in detail in the privacy notices for the individual services available on the website, to which this general notice refers.

5. Purposes of processing and legal basis

The Controller processes data subjects’ personal data for purposes connected with the services available on the website and with carrying out the activities requested by users.

The table below provides an overview of the main processing activities. A specific privacy notice is available for each service, setting out in detail the categories of personal data processed, the purposes and legal bases, retention periods, recipients and how to exercise the rights provided for under Regulation (EU) 2016/679.

6. Use of the WhatsApp Business channel

If a user chooses to contact the Controller via WhatsApp Business, communications will take place through the service provided by WhatsApp Ireland Limited (or another Meta group entity with responsibility under applicable law).

Use of the service also entails the processing of personal data by the platform provider, in accordance with its privacy notice and terms of use.

The Controller asks users not to send via WhatsApp any information beyond what is necessary to deal with their enquiry and, in particular, not to send special categories of personal data within the meaning of Article 9 GDPR unless strictly necessary.

7. Recipients of personal data

For the purposes described in this notice and in the specific notices for individual services, personal data may be processed by persons authorised by the Controller or disclosed to third parties only to the extent necessary to achieve the purposes for which they were collected.

In particular, personal data may be processed by or disclosed to the following categories of recipients:

• the Controller’s personnel expressly authorised to process personal data pursuant to Article 29 of Regulation (EU) 2016/679 and Article 2-quaterdecies of Italian Legislative Decree No. 196/2003, and duly instructed on the applicable processing arrangements;
• companies, advisers and suppliers providing hosting, maintenance, technical support, development and management services for the website, IT systems, digital platforms and electronic communications services;
• providers supporting order management, payments, deliveries, newsletters, customer service, contact channels and other services made available through the website;
• legal, tax, administrative and IT advisers and other professionals supporting the Controller within their respective areas of expertise;
• public authorities, judicial authorities and public bodies or agencies where disclosure is required by law, regulations or decisions of the competent authorities;
• any other parties identified in the specific privacy notices for individual services where disclosure is necessary for the relevant processing purpose.

Where required by applicable law, parties processing personal data on behalf of the Controller are appointed as processors pursuant to Article 28 of Regulation (EU) 2016/679 and act on the Controller’s documented instructions. Parties receiving personal data as separate controllers process them in accordance with applicable law and their own privacy notices.

An up-to-date list of these parties is available from the Controller’s offices and may be consulted by data subjects on request.

8. Transfers of personal data outside the EEA

As a rule, personal data are processed within the European Economic Area (EEA).

However, when particular IT services, digital platforms or technology providers are used, some personal data may be transferred to countries outside the EEA or accessed by parties established in such countries.

In such cases, the Controller ensures that transfers are carried out in compliance with Articles 44 et seq. of Regulation (EU) 2016/679 and, in particular, on the basis of:

• an adequacy decision adopted by the European Commission under Article 45 GDPR;
• the Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR; or
• any other safeguard or derogation provided for under applicable law.

Information on any transfers made in connection with individual services available on the website is provided in the relevant specific privacy notices. Data subjects may also request further information or obtain a copy of the safeguards used by contacting the Controller at the details set out in this notice.

9. Retention of personal data

Personal data are retained only for as long as strictly necessary for the purposes for which they are collected and processed. The retention periods applicable to each processing activity are set out in the relevant privacy notices for the services available on the website.

10. Data subject rights

You may exercise the following rights in relation to the personal data covered by this notice, as provided for and safeguarded by Regulation (EU) 2016/679 (GDPR):

• Right of access and rectification (Articles 15 and 16 GDPR): you have the right to access your personal data and request that they be corrected, amended or completed. On request, the Controller will provide you with a copy of the personal data it holds about you.
• Right to erasure (Article 17 GDPR): where the conditions laid down by applicable law are met, you may request the erasure of your personal data. Once the request has been received and assessed, the Controller will cease processing and erase your personal data where the request is well-founded.
• Right to restriction of processing (Article 18 GDPR): you may request that processing of your personal data be restricted, including where processing is unlawful or you contest the accuracy of the data.
• Right to data portability (Article 20 GDPR): subject to the conditions set out in that Article, you have the right to receive from the Controller, in a structured, commonly used and machine-readable format, personal data concerning you and to transmit those data to another controller without hindrance from the Controller to which they were provided.
• Right to object (Article 21 GDPR): you may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the Controller’s legitimate interests. Where you object to processing based on legitimate interests, the Controller will no longer process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
• Right to withdraw consent (Article 7(3) GDPR): where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right not to be subject to automated decision-making (Article 22 GDPR): where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions and safeguards provided for by applicable law.
• Right to lodge a complaint (Article 77 GDPR): you have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data infringes the GDPR. In Italy, the competent supervisory authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali).

You may exercise your rights at any time in relation to the processing of your personal data by the Controller. Requests should be sent by email to info@pizetapharma.com or by certified email (PEC) to greempharmsrl@legalmail.it.

Further information on data subject rights may be requested from the Controller using the contact details above. The full text of the Articles referred to above is available at https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

11. Security measures

The Controller implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk and to safeguard the confidentiality, integrity, availability and resilience of the personal data processed. These measures are designed to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

12. Changes to this notice

This notice may be amended or supplemented from time to time as a result of new developments in data protection law or changes to our services or organisational arrangements.

We therefore encourage you to review this notice periodically. Where possible, we will endeavour to inform you promptly of any changes and their implications.

The current version of this privacy notice will in all cases be published in the relevant section of the Company’s website, together with the date on which it was last updated.

13. Last updated

30 July 2026