Website privacy policy

(pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679)

1. Introduction

This Privacy Policy explains how Pizeta Pharma S.p.A. (also referred to below as the “Controller” or the “Company”) processes the personal data of users who visit and use the website www.pizetapharma.com (the “Website”).

The Company recognises the importance of protecting personal data and regards the protection of information relating to natural persons as one of the fundamental principles underpinning its business activities.

Personal data is processed in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality laid down in Regulation (EU) 2016/679 (the “GDPR”), Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101/2018, and all other applicable data protection legislation.

This Privacy Policy is intended to provide users with a general overview of how personal data is processed through the Website.

Specific privacy notices are provided for individual services made available through the Website (for example, information requests, registration, online purchases, newsletter subscriptions, speculative applications or applications submitted in response to job vacancies). These notices may be consulted before personal data is collected and supplement this document. Specific information on processing in connection with the WhatsApp Business channel made available by the Company is set out directly in the dedicated section of this Privacy Policy.

In the event of any conflict between this Privacy Policy and a specific notice relating to a particular service, the provisions of the specific notice shall prevail.

2. Data Controller

The Data Controller is:

Pizeta Pharma S.p.A.

VAT No.: 01956430431

Registered office: Via Roma, snc, Loc. Il Piano, 62039 Visso (MC), Italy

Administrative office: Via Bruno Simonucci, 3, 06135 Ponte San Giovanni, Perugia (PG), Italy

Telephone: +39 0759474542

E-mail: info@pizetapharma.com

Italian certified email address (PEC): greempharmsrl@legalmail.it

The Controller determines the purposes and means of processing the personal data collected through the Website and ensures that such processing is carried out in accordance with applicable law.

3. Scope of this Privacy Policy

This Privacy Policy applies exclusively to the processing of personal data carried out through this Website.

In particular, this document sets out the general principles applicable to processing carried out through the Website and provides information on the main categories of data processed, the purposes pursued by the Controller, the rights of data subjects and how those rights may be exercised.

This Privacy Policy does not replace the specific notices prepared for individual services available on the Website, which form an integral part of the information framework adopted by the Company. Where the technical features of a service make it impossible to provide a separate notice at the point of collection, as is currently the case for the WhatsApp Business channel, the relevant information is included in this Privacy Policy and made accessible through the Website.

Specific notices are therefore made available, among other things, for the following services:

  • information requests submitted through the contact form;
  • user account registration and management;
  • product purchases through the e-commerce website;
  • newsletter subscriptions;
  • commercial and promotional communications;
  • speculative applications or applications submitted in response to job vacancies;
  • contacts via WhatsApp Business, also governed by the specific provisions of this Privacy Policy;
  • exercise of rights under the GDPR;
  • any additional services involving the collection of personal data.

This Privacy Policy does not apply to third-party websites that may be accessed via hyperlinks on the Website. Those websites act as controllers in their own right, and users should consult their respective privacy notices before providing any personal data.

This Privacy Policy is permanently available to users through the Website.

4. Categories of personal data processed

When the Website is used, the Controller may process different categories of personal data depending on the functions used and the services requested by the user.

4.1 Browsing data

In the course of their normal operation, the IT systems and software procedures used to operate the Website acquire certain personal data whose transmission is inherent in the use of Internet communication protocols.

This category includes, by way of example:

  • the IP address or domain name of the device used;
  • the URI (Uniform Resource Identifier) addresses of the requested resources;
  • the date and time of the request;
  • the method used to submit the request to the server;
  • the size of the file received in response;
  • the numerical code indicating the status of the server response (for example, successful, error, etc.);
  • information on the operating system, browser and the user’s IT environment;
  • other technical parameters relating to the device used to connect.

This data is processed only to the extent necessary to ensure that the Website operates correctly, safeguard network and information-system security, prevent unlawful or fraudulent use and obtain aggregate statistical information on use of the Website.

Except as provided in the Cookie Policy or by specific legal provisions, this data is not used to identify users directly.

4.2 Data provided voluntarily by the user

The Controller processes personal data that the user voluntarily chooses to provide when using the services available on the Website.

The following may be collected by way of example:

  • personal details;
  • identification data;
  • contact details (email address, telephone number and postal address);
  • data relating to the organisation to which the user belongs;
  • data contained in messages sent through contact forms;
  • data required to manage orders and contractual relationships;
  • data contained in CVs submitted through the “Careers” section;
  • any other information that the data subject chooses to provide voluntarily.

Users are asked to provide only the data strictly necessary for their request.

Users are asked not to provide special categories of personal data under Article 9 GDPR, personal data relating to criminal convictions and offences, or third-party personal data unless strictly necessary to handle the request. If such information is provided voluntarily, it will be processed only where an appropriate legal basis applies and within the limits permitted by applicable law; where it is not required, it will be deleted.

4.3 Data collected in connection with services offered through the Website

Depending on the functions used, the Controller may process personal data in connection with the following services:

  • information requests;
  • user account registration and management;
  • product purchases through the e-commerce website;
  • customer support;
  • newsletter subscriptions;
  • commercial communications;
  • speculative applications or applications submitted in response to job vacancies;
  • contacts via WhatsApp Business;
  • handling requests to exercise rights under the GDPR;
  • any additional services made available on the Website.

A specific privacy notice containing the information required by Articles 13 and 14 GDPR is provided for each service. As it is not currently technically possible to provide a separate notice within the WhatsApp Business channel, the relevant information is set out in section 4.4 below and in the other applicable provisions of this Privacy Policy.

4.4 Data processed through the WhatsApp Business channel

The Company provides users with a WhatsApp Business channel, accessible through the Website, which may be used to request information or assistance or to ask to be contacted about the Company’s products and services. The user chooses whether to open the WhatsApp link and send a message.

During the conversation, the Company may process the telephone number associated with the WhatsApp account, the name or alias and profile image where made visible by the user, the content of messages and subsequent communications, the date and time of communications, and any documents, images or other information provided voluntarily.

Users are asked to provide only the information strictly necessary to handle their request and not to send special categories of personal data under Article 9 GDPR, personal data relating to criminal convictions and offences, or third-party personal data via WhatsApp unless strictly necessary. If such information is provided voluntarily, it will be processed only where an appropriate legal basis applies and within the limits permitted by applicable law; where it is not required, it will be deleted.

Provision of the data is optional. Failure to provide it will only prevent the user from using the WhatsApp channel to obtain the requested response; the other contact details set out in this Privacy Policy will remain available.

The telephone number and other data obtained through WhatsApp will not be used to send promotional or marketing communications unless the data subject has given specific consent where required. Starting a conversation via WhatsApp does not, in itself, constitute consent to receive commercial communications.

Communications take place through the service provided by WhatsApp Ireland Limited or another Meta group entity responsible under applicable law. Use of the service also entails the processing of personal data by the platform provider in accordance with its privacy notice and terms of use. WhatsApp may process information relating to the account, device and use of the service for its own purposes and according to the role it assumes in relation to each processing activity. Users should therefore consult the privacy documentation made available by the provider before using the channel.

4.5 Cookies and similar technologies

The Website uses cookies and other similar technologies to ensure that it operates correctly, improve the browsing experience, analyse traffic and, where applicable, provide personalised content or marketing.

For detailed information on the cookies used, their purposes, the legal bases for processing and how users may manage their preferences, please refer to the Cookie Policy available on the Website.

Where required by applicable law, non-essential cookies or tracking technologies will be placed only after the user has given consent through the preference-management tools provided by the Controller. Users may change or withdraw their preferences at any time through the consent-management system available on the Website, without affecting processing already carried out on the basis of consent previously given.

4.6 Personal data relating to children

The Website is not intended for persons under the age of fourteen, unless specific services are expressly aimed at children in compliance with applicable law.

The Controller does not knowingly collect personal data relating to children except where permitted by law.

If the Controller becomes aware that personal data relating to children has been collected inadvertently without a lawful basis, it will delete that data without undue delay.

5. Purposes of processing and legal bases

Personal data is processed only for specified, explicit and legitimate purposes, in accordance with Article 5 GDPR.

Depending on the service used by the data subject, processing may be carried out for one or more of the purposes set out in the table below.

Purpose of processing Legal basis
To enable browsing of the Website and ensure its correct technical operation Article 6(1)(f) GDPR (the Controller’s legitimate interest in the security and correct operation of the Website)
To safeguard network and information-system security and prevent unauthorised access or fraudulent activities Article 6(1)(f) GDPR (the Controller’s legitimate interest in the security and correct operation of the Website)
To handle requests submitted through the contact form or other communication channels Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or performance of a contract to which the data subject is party)
To provide information requested by the user about the Company’s products or services Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or performance of a contract to which the data subject is party)
To register and manage user accounts Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or performance of a contract to which the data subject is party)
To manage orders, online purchases, deliveries, returns and after-sales support Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or performance of a contract to which the data subject is party)
To comply with civil, tax, accounting or administrative legal obligations Article 6(1)(c) GDPR (compliance with a legal obligation)
To handle requests to exercise rights under the GDPR Article 6(1)(c) GDPR (compliance with a legal obligation)
To manage disputes and protect the Controller’s rights Article 6(1)(f) GDPR (the Controller’s legitimate interest in protecting its rights)
To send newsletters and promotional communications The data subject’s consent (Article 6(1)(a) GDPR), except where the soft opt-in exemption under Article 130(4) of the Italian Privacy Code applies
To manage speculative applications and recruitment processes Article 6(1)(b) GDPR (taking steps prior to entering into a contract)
To manage communications via WhatsApp Business Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or performance of a contract to which the data subject is party)

Where the data subject voluntarily provides special categories of personal data under Article 9 GDPR, that data will be processed only if one of the conditions in Article 9(2) GDPR or another appropriate ground under applicable law applies, and only to the extent strictly necessary to handle the request; where it is not required, it will be deleted.

Detailed information on each processing activity carried out through the Website is set out in the specific notices provided for the relevant service. For processing through WhatsApp Business, that information is contained in this Privacy Policy, in particular in sections 4.4, 5, 7, 8 and 9.

6. Processing methods and security measures

Personal data is processed using paper-based, electronic and telematic means in accordance with the principles of lawfulness, fairness, transparency, data minimisation and confidentiality laid down in Regulation (EU) 2016/679.

Processing is carried out using procedures designed to ensure the security, integrity, availability and confidentiality of personal data and to prevent unauthorised access, loss, alteration, disclosure or unlawful use.

The Controller implements appropriate technical and organisational measures under Articles 24, 25 and 32 GDPR, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as the likelihood and severity of risks to the rights and freedoms of natural persons. The Controller regularly monitors the effectiveness of those measures and progressively improves them.

Personal data is processed only by authorised personnel, persons acting under the authority of the Controller or, where required by law, processors duly appointed under Article 28 GDPR.

No solely automated decision-making is carried out that produces legal effects concerning the data subject or similarly significantly affects them, unless otherwise stated in the specific notices for individual services.

7. Recipients of personal data

For the purposes set out in this Privacy Policy and the specific notices, personal data may be disclosed, within the scope of their respective responsibilities and in accordance with applicable law, to the following categories of recipients:

  • employees and contractors of the Controller who are authorised to process the data;
  • parent companies, subsidiaries or affiliates, where necessary for administrative or organisational purposes;
  • professionals, advisers and professional firms assisting the Controller;
  • IT, cloud, hosting, software maintenance and technical-support providers;
  • payment, logistics and delivery service providers;
  • providers engaged to send electronic communications and newsletters;
  • providers operating customer-support platforms or ticketing systems;
  • digital messaging and communication service providers, including the WhatsApp platform provider, which may act as processors or controllers in their own right depending on the activities performed and the relevant contractual terms;
  • public authorities, public bodies or judicial authorities where required by law;
  • other parties where disclosure is necessary to comply with legal obligations or perform the relationship requested by the data subject.

Where such parties process personal data on behalf of the Controller, they act as processors under Article 28 GDPR; where they determine the purposes and means of processing independently, they act as controllers in their own right.

An up-to-date list of processors may be requested from the Controller using the contact details set out in section 2 of this Privacy Policy.

8. Transfers of data to third countries

As a rule, personal data is processed within the European Economic Area (EEA).

Where organisational or technical requirements entail the transfer of personal data to countries outside the EEA, the transfer will be carried out only in accordance with Articles 44 et seq. GDPR.

In particular, a transfer may take place:

  • to countries covered by an adequacy decision adopted by the European Commission;
  • under the Standard Contractual Clauses (SCCs) approved by the European Commission;
  • on the basis of another safeguard or derogation provided for in Chapter V GDPR.

The use of digital and messaging service providers, including the WhatsApp service provider, may involve processing of or access to data from countries outside the EEA. In such cases, processing is carried out in accordance with Chapter V GDPR, on the basis of an adequacy decision of the European Commission or the other safeguards provided for by Articles 46 et seq. GDPR, as applicable.

Further information on any transfers may be requested from the Controller.

9. Retention of personal data

Personal data is retained for no longer than is necessary for the purposes for which it was collected and subsequently processed, unless applicable law requires or permits a longer retention period.

The criteria used to determine the retention period take account of:

  • the nature of the relationship with the data subject;
  • the purposes of processing;
  • the Controller’s legal obligations;
  • the applicable limitation periods;
  • any need to protect the Controller’s rights in legal proceedings.

The specific notices for individual services available on the Website state, where possible, the retention periods applicable to data processed in connection with each service.

Personal data collected in connection with contact, support or information requests submitted through WhatsApp Business is retained for as long as necessary to handle the request and thereafter for no more than 12 months from its closure, unless longer retention is required to comply with legal obligations, perform or document a contractual relationship, or establish, exercise or defend the Controller’s legal claims. Data processed to send promotional communications via WhatsApp is retained until consent is withdrawn and, in any event, for no more than 24 months from the date consent is given, unless renewed or a different period is prescribed by applicable law.

At the end of the applicable retention period, personal data will be deleted or irreversibly anonymised, unless further retention is necessary to establish, exercise or defend legal claims or to comply with legal obligations.

10. Rights of data subjects

Data subjects may exercise the rights granted by Articles 15 et seq. GDPR in the cases and within the limits provided for therein.

In particular, they have the right to:

  • obtain confirmation as to whether or not personal data concerning them is being processed and access that data;
  • obtain rectification of inaccurate data and completion of incomplete data;
  • obtain erasure of personal data in the circumstances set out in Article 17 GDPR;
  • obtain restriction of processing in the circumstances set out in Article 18 GDPR;
  • receive personal data provided to the Controller in a structured, commonly used and machine-readable format and transmit it to another controller, where the relevant conditions are met;
  • object to processing based on the Controller’s legitimate interests, unless compelling legitimate grounds prevail;
  • withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
  • not be subject to a decision based solely on automated processing, including profiling, in the circumstances set out in Article 22 GDPR.

Exercising these rights is free of charge, except in the circumstances provided for by Article 12 GDPR.

Data subjects may exercise their rights under Regulation (EU) 2016/679 at any time by sending a request to the Controller using the contact details set out in this Privacy Policy.

Requests may be sent by email, certified email (PEC) or any other contact channel made available by the Controller.

Where there are reasonable doubts concerning the requester’s identity, the Controller may request only the information strictly necessary to verify it and ensure that personal data is not disclosed to unauthorised persons.

Requests will be handled without undue delay and, in any event, within one month of receipt, unless the period may be extended within the limits permitted by Article 12 GDPR because of the complexity or number of requests.

11. Right to lodge a complaint with the supervisory authority

Where a data subject considers that the processing of their personal data infringes applicable data protection law, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) under Article 77 GDPR, or to seek a judicial remedy before the competent courts in the circumstances provided for by Articles 78 and 79 GDPR.

This is without prejudice to the possibility of first contacting the Controller, who will be pleased to provide any clarification and seek a solution to any issues raised.

12. Changes to this Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy at any time, including as a result of changes to applicable law, developments in the technologies used, the introduction of new services or changes in the organisation of processing activities.

Any changes will be published on the Website and will take effect from the date of publication, unless otherwise stated.

Where changes materially affect data subjects’ rights or the manner in which personal data is processed, the Controller will, where required by applicable law, take appropriate steps to inform users.

13. Document version

Document: Website Privacy Policy

Last updated: 30 July 2026

Data Controller: Pizeta Pharma S.p.A.

This Privacy Policy is published pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 and is permanently accessible through the Controller’s Website.

In addition to the notices relating to the services available on the Website and referred to in the Privacy Policy above, the Controller makes available in this section the notices prepared pursuant to Articles 13 and 14 GDPR for specific categories of data subjects (including, by way of example, customers, suppliers, consultants, job applicants, business partners and other parties having dealings with the Controller).

For reasons of administrative efficiency and to ensure that the documentation is kept up to date, the notices are made available by publication on this Website and may be incorporated by reference to this web address in contracts, orders, commercial communications or other documentation exchanged with data subjects.

Publication of the notices on the Website is intended to ensure transparency and compliance with the information requirements laid down by the GDPR and does not alter the substance of any contractual relationships between the parties.

Each notice should be consulted in relation to the specific relationship to which it applies and, solely in respect of the processing activity it governs, supplements this Website Privacy Policy.

Available privacy notices: