Website contact privacy notice

pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

1. Introduction

At Pizeta Pharma S.p.A., we take your privacy and the security of your personal data seriously. We handle your personal data with care and have put in place appropriate technical and organisational measures to keep it secure.

This privacy notice explains, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), how and why we process your personal data, the safeguards we apply and the rights available to you.

2. Definitions

Personal data: any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation.

Data Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Data Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.

3. Data Controller

Pizeta Pharma S.p.A. (“Pizeta Pharma”, the “Company”, “we”, “us” or “our”), with registered office at Via Roma – Loc. Il Piano, 62039 Visso (MC), is the Data Controller for the purposes of the GDPR.

If you have any questions about how we process your personal data, or wish to make a request, you can contact us at any time using the details below:

Data Controller

Company name: Pizeta Pharma S.p.A.

Administrative office address: Via Bruno Simonucci, 3, Ponte San Giovanni, 06135 Perugia (PG)

Telephone: +39 075 9474542

Email: info@pizetapharma.com

Certified email (PEC): greempharmsrl@legalmail.it

4. Categories of data processed

The Data Controller processes the personal data you provide, including, by way of example:

First name and surname
Email address
Telephone number
The content of your enquiry and any subsequent communications
Any attached documents

If you use the WhatsApp Business channel, we will also process the telephone number associated with your WhatsApp account, your profile name and any additional data contained in the messages you send.

Data Subjects are requested not to disclose data belonging to the special categories referred to in Article 9 GDPR (for example, data concerning health, racial or ethnic origin, religious beliefs, political opinions or trade union membership), unless this is strictly necessary for the handling of the enquiry.

Where such data are provided voluntarily, they will be processed only to the extent necessary to respond to your enquiry, comply with legal obligations, or establish, exercise or defend a legal claim of the Data Controller.

When contacting us or reporting an accessibility issue, please provide only the information needed to explain your request or the barrier you have encountered. Please do not include unnecessary personal data or personal data relating to anyone else unless it is essential for us to deal with the report.

5. Purposes of processing and legal basis

We process your personal data for the purposes set out below:

	Purpose (why we process your data)	Legal basis (the legal provision on which processing is based)	Consequences of refusing processing (what happens if you refuse to provide personal data and/or authorise processing)
A	To handle your requests for information, assistance or contact submitted through the website, by email or via WhatsApp Business	Article 6(1)(b) GDPR (taking steps at the Data Subject’s request prior to entering into a contract; performance of a contract to which the Data Subject is party)	Your consent is not required. However, if you do not provide the personal data we need, we may be unable to respond to your request or perform any contract we have with you.
B	To handle reports concerning website accessibility, including the activities required to respond to the Data Subject, request any additional information and, where necessary, implement appropriate corrective measures.	Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Data Controller is subject), with reference to reports submitted under digital accessibility legislation	Your consent is not required. However, if you do not provide the personal data we need, we may be unable to investigate your accessibility report or take any follow-up action.
C	To send you commercial, promotional and informational communications, newsletters and updates concerning products, services, initiatives and events organised or promoted by the Data Controller, by email, SMS, telephone, WhatsApp or other electronic communication channels.	Article 6(1)(a) GDPR (the Data Subject’s consent). Where the conditions under Article 130(4) of Italian Legislative Decree No. 196/2003 are met, the Data Controller may use email contact details provided in connection with the sale of its own product or service to send commercial communications concerning similar products or services (so-called soft spam), without prejudice to the Data Subject’s right to object to such processing free of charge and at any time.	Without your consent, we will not process your data for the stated purpose. The Data Controller may nevertheless send promotional communications by email in the circumstances and within the limits permitted by Article 130(4) of Italian Legislative Decree No. 196/2003 (so-called soft spam), without prejudice to your right to object free of charge and at any time. Providing data for these purposes is optional. Failure to give consent, or its subsequent withdrawal, will not affect your ability to submit requests for information, use the “Contact Us” form or access the other services made available by the Data Controller.

Purpose

(why we process your data)

Legal basis

(the legal provision on which processing is based)

Consequences of refusing processing

(what happens if you refuse to provide personal data and/or authorise processing)

To handle your requests for information, assistance or contact submitted through the website, by email or via WhatsApp Business

Article 6(1)(b) GDPR (taking steps at the Data Subject’s request prior to entering into a contract; performance of a contract to which the Data Subject is party)

Your consent is not required. However, if you do not provide the personal data we need, we may be unable to respond to your request or perform any contract we have with you.

To handle reports concerning website accessibility, including the activities required to respond to the Data Subject, request any additional information and, where necessary, implement appropriate corrective measures.

Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Data Controller is subject), with reference to reports submitted under digital accessibility legislation

Your consent is not required. However, if you do not provide the personal data we need, we may be unable to investigate your accessibility report or take any follow-up action.

To send you commercial, promotional and informational communications, newsletters and updates concerning products, services, initiatives and events organised or promoted by the Data Controller, by email, SMS, telephone, WhatsApp or other electronic communication channels.

Article 6(1)(a) GDPR (the Data Subject’s consent). Where the conditions under Article 130(4) of Italian Legislative Decree No. 196/2003 are met, the Data Controller may use email contact details provided in connection with the sale of its own product or service to send commercial communications concerning similar products or services (so-called soft spam), without prejudice to the Data Subject’s right to object to such processing free of charge and at any time.

Without your consent, we will not process your data for the stated purpose.

The Data Controller may nevertheless send promotional communications by email in the circumstances and within the limits permitted by Article 130(4) of Italian Legislative Decree No. 196/2003 (so-called soft spam), without prejudice to your right to object free of charge and at any time.

Providing data for these purposes is optional. Failure to give consent, or its subsequent withdrawal, will not affect your ability to submit requests for information, use the “Contact Us” form or access the other services made available by the Data Controller.

6. Use of the WhatsApp Business channel

If you contact us through WhatsApp Business, your communications will be handled using the service provided by WhatsApp Ireland Limited (or another Meta group entity responsible under applicable law).

Use of the service also entails the processing of personal data by the platform provider, in accordance with its privacy notice and terms of service.

Please do not send us more information through WhatsApp than we need to deal with your enquiry. In particular, please do not send any special category data within the meaning of Article 9 GDPR unless it is strictly necessary.

7. Categories of recipients of personal data

Your personal data may be processed by members of staff authorised by the Data Controller. We may also share it with service providers acting on our behalf as Data Processors under Article 28 GDPR, including:

IT service providers;
website hosting and maintenance service providers;
consultants and professionals assisting the Data Controller;
other service providers strictly connected with the handling of enquiries.

Accessibility reports may be shared, strictly on a need-to-know basis, with providers engaged to develop, maintain and adapt the website and appointed as Data Processors pursuant to Article 28 GDPR, solely to investigate the reported issue and implement the necessary corrective measures.

An up-to-date list of these parties is available at the Data Controller’s registered office and may be consulted upon request by the Data Subject.

8. Transfers of data outside the EU

As a general rule, we do not transfer your personal data to countries outside the European Economic Area or to international organisations. If a transfer outside the European Economic Area is required, it will be made in accordance with Articles 44 et seq. GDPR and subject to the safeguards required by applicable law.

9. Personal data retention period (Data Retention)

Your data will be retained for a limited period, which varies according to the type of processing activity and its specific purposes, as illustrated below:

Personal data	Retention period
Personal data collected in connection with contact, assistance and information enquiries and reports concerning website accessibility	For the time required to handle the enquiry and thereafter for no more than 12 months from its closure, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend a legal claim of the Data Controller
Personal data collected and processed for newsletters and commercial and promotional communications	Until consent is withdrawn and, in any event, for no more than 24 months from the date on which it was given, unless renewed or a different period is prescribed by applicable law. For soft spam, until the right to object is exercised or the customer relationship ends, in accordance with the principles of proportionality and storage limitation.

Personal data

Retention period

Personal data collected in connection with contact, assistance and information enquiries and reports concerning website accessibility

For the time required to handle the enquiry and thereafter for no more than 12 months from its closure, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend a legal claim of the Data Controller

Personal data collected and processed for newsletters and commercial and promotional communications

Until consent is withdrawn and, in any event, for no more than 24 months from the date on which it was given, unless renewed or a different period is prescribed by applicable law.

For soft spam, until the right to object is exercised or the customer relationship ends, in accordance with the principles of proportionality and storage limitation.

At the end of these periods, your data will be permanently erased or irreversibly anonymised by Pizeta Pharma S.p.A.

10. Data Subject rights

You have the following rights in relation to the personal data covered by this privacy notice:

Right of access and rectification (Articles 15 and 16 GDPR): you have the right to access your personal data and request that they be corrected, amended or supplemented. If you wish, we will provide you with a copy of the data we hold about you.
Right to erasure (Article 17 GDPR): in the circumstances provided for by applicable law, you may request the erasure of your personal data. Once we have received and assessed your request, we will cease processing and erase your personal data where the request is well founded.
Right to restriction of processing (Article 18 GDPR): you have the right to request restriction of the processing of your personal data where processing is unlawful or the accuracy of the personal data is contested.
Right to data portability (Article 20 GDPR): you have the right to receive from the Data Controller, in a structured, commonly used and machine-readable format, the personal data concerning you, and to transmit those data to another Data Controller without hindrance from the Data Controller to which they were provided, subject to the conditions laid down in that Article.
Right to object (Article 21 GDPR): where we rely on legitimate interests as the legal basis for processing, you may object at any time on grounds relating to your particular situation. We will consider your objection in accordance with the GDPR.
Right to lodge a complaint (Article 77 GDPR): you have the right to lodge a complaint with the competent Data Protection Authority if you consider that your rights in relation to the processing of your personal data have been, or are being, infringed.

You may exercise your rights at any time by contacting Pizeta Pharma at info@pizetapharma.com or by certified email (PEC) at greempharmsrl@legalmail.it.

Further information about Data Subjects’ rights may be requested from the Data Controller using the contact details above. The full text of the Articles referred to above is available at the following link: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

11. Security measures

Pizeta Pharma has implemented appropriate technical and organisational measures to protect the confidentiality, integrity and availability of your personal data and to guard against accidental loss, alteration, misuse, unauthorised access or disclosure.

12. Changes to this privacy notice

We may update or supplement this privacy notice from time to time, for example to reflect changes in data protection law, our services or our organisation.

We recommend that you review this notice from time to time. Where practicable, we will notify you promptly of any material changes and explain how they may affect you.

In any event, an updated version of this privacy notice will be published in the relevant section of the Company’s website, stating the date on which it was last updated.

13. Date last updated

30 July 2026