Privacy notice – Contacting the Scientific Department

pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

1. Introduction

At Pizeta Pharma S.p.A., your privacy and the security of your personal data are particularly important to us. We therefore collect and process your data with the utmost care and attention, while implementing specific technical and organisational measures to ensure that they are processed securely.

Accordingly, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), we inform you that your personal data are processed in a manner designed to ensure their security and confidentiality, using paper-based, electronic and/or telematic means, as further described in this privacy notice.

2. Definitions

Personal data means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special categories of personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation.

Data Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.

3. Data Controller

Your personal data are processed by Pizeta Pharma S.p.A. (also referred to below as “Pizeta Pharma” or the “Company”), whose registered office is at Via Roma – Loc. Il Piano, 62039 Visso (MC), acting as Data Controller for the purposes of Regulation (EU) 2016/679.

If you have any questions or requests concerning the processing of your personal data, you may contact Pizeta Pharma S.p.A. at any time using the contact details below:

Data Controller

Company name: Pizeta Pharma S.p.A.

Administrative office address: Via Bruno Simonucci, 3, Ponte San Giovanni, 06135 Perugia (PG), Italy

Telephone: +39 075 9474542

Email: info@pizetapharma.com

Certified email (PEC): greempharmsrl@legalmail.it

4. Categories of personal data processed

The Data Controller processes the personal data you provide when submitting a request to the Scientific Department, including, by way of example:

• Identification and contact details (for example, first name, surname, email address and telephone number)
• The content of your request
• Any information you voluntarily provide concerning your health, physical condition, use of medicines, medical devices or food supplements, together with any other information falling within the special categories of personal data referred to in Article 9 GDPR.

Providing this information is entirely at the Data Subject’s discretion. The Data Controller asks you to provide only the data strictly necessary to enable the Scientific Department to respond to your request.

5. Purposes of processing and legal basis

Personal data will be processed for the following purposes:

6. Categories of recipients of personal data

Your personal data will be processed solely by persons authorised by the Data Controller and may be disclosed, to the extent strictly necessary for the purposes set out in this notice, to the following categories of recipients:

• personnel specifically authorised by the Data Controller pursuant to Article 29 GDPR and Article 2-quaterdecies of Italian Legislative Decree No. 196/2003, working within the Scientific Department or other business functions involved in handling the request, who have received appropriate instructions and are bound by duties of confidentiality;
• IT, hosting, maintenance, technical support and information systems service providers, appointed as Processors under Article 28 GDPR where required;
• consultants or professional advisers supporting the Data Controller where their involvement is necessary to handle the request, acting as Processors or independent Data Controllers depending on their role; and
• public authorities, bodies or organisations where disclosure is required by law or by an order of a competent authority.

Your personal data, including any health data voluntarily provided by the Data Subject, will be accessible only to persons who strictly need to know them in order to handle the request and will be processed in accordance with the GDPR principles of confidentiality, integrity, data minimisation and purpose limitation.

7. Transfers of personal data outside the EEA

As a rule, your personal data are processed within the European Economic Area (EEA) and are not transferred to third countries or international organisations.

Should it become necessary, in connection with the use of specific services or suppliers, to transfer personal data to countries outside the EEA, the transfer will be made in accordance with Articles 44 et seq. GDPR, in particular on the basis of a European Commission adequacy decision or by implementing appropriate safeguards under applicable law, such as the Standard Contractual Clauses adopted by the European Commission.

8. Retention of personal data

Your personal data will be retained for no longer than is strictly necessary to handle the Data Subject’s request and thereafter for a maximum of six months from closure of the request.

Where the request contains health data or other special categories of personal data, those data will be retained only for as long as necessary to provide the requested response and, in any event, no longer than the period stated above, unless longer retention is required to comply with a legal obligation or for the establishment, exercise or defence of the Data Controller’s legal claims in judicial, administrative or out-of-court proceedings.

At the end of the retention period, personal data will be erased or anonymised, where compatible with the purposes pursued.

9. Data Subject rights

You may exercise the following rights in relation to the personal data covered by this notice, as provided for and protected by the GDPR:

• Right of access and rectification (Articles 15 and 16 GDPR): you have the right to obtain confirmation as to whether personal data concerning you are being processed and, where that is the case, to access those data and the information specified in Article 15 GDPR. You may also request the rectification of inaccurate personal data and the completion of incomplete personal data. Where applicable, the Data Controller will provide a copy of the personal data undergoing processing.
• Right to erasure (Article 17 GDPR): you may request the erasure of personal data concerning you where one of the grounds set out in Article 17 GDPR applies, subject to the exceptions provided for in that Article.
• Right to restriction of processing (Article 18 GDPR): you may request restriction of processing where one of the conditions set out in Article 18 GDPR applies, including where you contest the accuracy of the personal data or where the processing is unlawful and you oppose erasure.
• Right to data portability (Article 20 GDPR): where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive the personal data concerning you which you have provided to the Data Controller in a structured, commonly used and machine-readable format and to transmit those data to another controller, where this does not adversely affect the rights and freedoms of others.
• Right to object (Article 21 GDPR): where processing is based on Article 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. The Data Controller will cease processing unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.
• Right to lodge a complaint (Article 77 GDPR): without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a competent supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR.

You may exercise your rights at any time in relation to the specific processing of your personal data by Pizeta Pharma. Requests should be sent to Pizeta Pharma by email at info@pizetapharma.com or by certified email (PEC) at greempharmsrl@legalmail.it.

Further information about Data Subject rights may be requested from the Data Controller using the contact details above. The full text of the relevant provisions is available at https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng

10. Security measures

Pizeta Pharma implements appropriate preventive security measures to protect the confidentiality, integrity, completeness and availability of Data Subjects’ personal data. Technical, physical and organisational safeguards are in place to prevent damage, accidental loss, alteration, misuse and unauthorised use of the data processed.

11. Changes to this privacy notice

This privacy notice may be amended or supplemented from time to time as a result of new legislation on personal data protection or developments or changes in our services and organisation.

We therefore encourage you to review this notice periodically. Where possible, we will endeavour to inform you promptly of any changes and their implications.

The current version of this privacy notice will in any event be published in the dedicated section of the Company’s website, together with the date on which it was last updated.

12. Last updated

30 July 2026