Privacy policy
pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data
1. Introduction
At PIZETA Pharma S.p.A., your privacy and the security of your personal data are particularly important to us. We therefore collect and process your data with the utmost care and attention, while implementing specific technical and organisational measures to ensure that they are processed securely.
In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), we inform you that your personal data are processed in a manner designed to ensure their security and confidentiality, using paper-based, electronic or IT-based means, as further described in this Privacy Notice.
2. Definitions
Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Special categories of personal data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
3. Controller
Your personal data are processed by PIZETA Pharma S.p.A. (also referred to as “PIZETA Pharma” or the “Company”), with registered office at Via Roma – Loc. Il Piano, 62039 Visso (MC), acting as controller within the meaning of Regulation (EU) 2016/679.
For any questions or requests concerning the processing of your personal data, you may contact PIZETA Pharma S.p.A. at any time using the details below:
Controller
Company name: PIZETA Pharma S.p.A.
Administrative office address: Via Bruno Simonucci, 3, 06135 Ponte San Giovanni, Perugia (PG)
Telephone: +39 075 9474542
Email: info@pizetapharma.com
Certified email (PEC): greempharmsrl@legalmail.it
4. Categories of personal data processed
In connection with your use of the online shop and related services, the Controller processes the personal data required to manage its relationship with the Customer and provide the requested services.
In particular, the following categories of personal data may be processed:
- identification data, such as first name, surname, date of birth (where requested) and any other data needed to identify the Data Subject;
- contact details, such as email address, telephone number, home address, delivery address and billing address;
- account data, such as login credentials, order history, stated preferences and information relating to management of the customer account, where available;
- purchase data, such as selected products, orders placed, delivery methods, returns, replacements, support requests and transaction history;
- administrative, accounting and tax data, such as tax identification number, VAT number and any further data required to issue tax documents and comply with legal obligations;
- payment data, limited to the information required to manage transactions. Full payment instrument details (for example, credit card numbers) are processed directly by the payment service provider in accordance with its own privacy notice and are not stored by the Controller, except insofar as strictly necessary to manage the transaction;
- data included in communications sent by the Data Subject in connection with support requests, complaints, the exercise of warranty rights, the right of withdrawal or other purchase-related communications;
- browsing data collected automatically when the website is used, such as IP address, device identifiers, browser data, access logs and other technical information required for the operation, security and maintenance of the website;
- marketing preference data, such as information concerning the giving or withdrawal of consent to receive promotional communications and, where applicable, receipt of direct marketing communications to existing customers (so-called soft spam) under Article 130(4) of Italian Legislative Decree No. 196/2003.
In connection with the online shop, the Controller does not process special categories of personal data within the meaning of Article 9 GDPR, unless such information is provided voluntarily by the Data Subject in a support request or in connection with another specific service. In that event, the data will be processed only to the extent necessary to deal with the request and in accordance with the relevant dedicated privacy notice.
5. Purposes and legal bases of the processing
Personal data will be processed for the following purposes:
|
Purpose (why we process your data) |
Legal basis (the legal ground on which we process your data) |
Consequences of failure to provide data (what happens if you do not provide your personal data) |
|
|---|---|---|---|
| A | Management of online-shop registration and the account (where applicable), including creation and management of the customer account. | Article 6(1)(b) GDPR (steps taken at the request of the Data Subject prior to entering into a contract or performance of a contract). | Provision of the data is necessary. If the data are not provided, it will not be possible to create an account or access restricted services. |
| B | Management of orders and the contractual relationship, including conclusion of the sale contract, payment processing, product delivery, invoicing, after-sales support, returns, the right of withdrawal and warranties. | Article 6(1)(b) GDPR (performance of a contract). | Provision of the data is necessary. Without them, it will not be possible to fulfil the order, enter into the contract or provide the requested services. |
| C | Compliance with obligations laid down by laws, regulations, EU legislation or provisions issued by competent authorities and supervisory bodies, and management of tax, accounting and administrative obligations. | Article 6(1)(c) GDPR (compliance with a legal obligation). | Provision of the data is necessary. Failure to provide them will prevent the Controller from complying with applicable legal obligations and, where relevant, from performing the contract. |
| D | Management of complaints, disputes, debt recovery, fraud prevention and protection of the Controller’s rights, including in judicial or out-of-court proceedings. | Article 6(1)(f) GDPR (the Controller’s legitimate interest in protecting its rights and business assets). | Provision of the data is instrumental to management of the contractual relationship. Any objection will be assessed by the Controller under Article 21 GDPR, without prejudice to its right to continue processing where compelling legitimate grounds exist. |
| E | Sending newsletters and commercial, promotional and information communications concerning the Controller’s products and services by email or other electronic communication channels. | Article 6(1)(a) GDPR (the Data Subject’s consent). | Provision of the data is optional. Refusal to consent does not affect the ability to purchase products or use the other services offered through the website. |
| F | Sending commercial communications by email concerning products or services similar to those already purchased (so-called soft spam), in accordance with Article 130(4) of Italian Legislative Decree No. 196/2003. | Article 6(1)(f) GDPR (the Controller’s legitimate interest), read in conjunction with Article 130(4) of Italian Legislative Decree No. 196/2003. | The Data Subject may object at any time, free of charge and without formalities, by using the link included in the communications received or by contacting the Controller. Objecting does not affect the ability to make purchases through the online shop. |
Data collected through the online shop are used solely to manage the contractual relationship and not to assess the customer’s state of health or make decisions based on the purchaser’s health characteristics.
6. Categories of recipients of personal data
For the purposes described in this Privacy Notice, personal data may be processed by personnel expressly authorised by the Controller pursuant to Article 29 GDPR and Article 2-quaterdecies of Italian Legislative Decree No. 196/2003, who have been duly instructed on how personal data are to be processed.
Personal data may also be disclosed, insofar as strictly necessary for the purposes set out above, to the following categories of recipients:
- providers of IT, hosting, cloud, maintenance, technical support, website development and management, and corporate information-system services;
- payment service providers, banks and other parties involved in processing financial transactions, which process data in accordance with their own privacy notices and applicable law;
- couriers, freight forwarders and logistics operators responsible for delivering purchased products;
- providers of administrative, accounting, tax, legal, audit or professional advisory services to the Controller;
- companies providing customer support, complaint handling, after-sales support and returns management services;
- providers of platforms and services used to send marketing communications and newsletters, where the Data Subject has given the relevant consent or the conditions for direct marketing to existing customers under Article 130(4) of Italian Legislative Decree No. 196/2003 are met;
- parties engaged in fraud prevention, debt recovery and protection of the Controller’s rights, within the limits permitted by applicable law;
- public authorities, judicial authorities, supervisory authorities, public bodies or other parties to which disclosure is required by law, regulation or an order of a competent authority.
Parties processing personal data on behalf of the Controller are appointed, where required by applicable law, as processors pursuant to Article 28 GDPR and act on the Controller’s documented instructions.
Where recipients receive data as controllers in their own right, they will process the personal data in accordance with applicable law and their own privacy notices.
An up-to-date list of processors may be requested from the Controller using the contact details set out in this Privacy Notice.
7. International transfers of personal data
As a rule, personal data are processed within the European Economic Area (EEA).
However, in providing services connected with the online shop, the Controller uses technology service providers, platforms and software applications that may involve transfers of personal data to countries outside the EEA or allow access to the data by parties established in those countries.
In such cases, the Controller ensures that personal data are transferred in accordance with Articles 44 et seq. GDPR by relying on one of the safeguards permitted by applicable law, including:
- an adequacy decision adopted by the European Commission under Article 45 GDPR;
- the Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 GDPR;
- Binding Corporate Rules (BCRs), where applicable;
- any other safeguard or derogation permitted by applicable law.
The Data Subject may request further information about any transfers of personal data to third countries and the safeguards adopted by the Controller by using the contact details set out in this Privacy Notice.
8. Retention of personal data
The Controller retains personal data for no longer than is necessary for the purposes for which they were collected and processed, in accordance with the principles of storage limitation and data minimisation under Article 5 GDPR.
In particular, personal data will be retained for the following periods:
| Purpose of processing | Retention period |
|---|---|
| User account management (where applicable) | For as long as the account remains active. If the account is deleted at the user’s request, the data will be erased or anonymised, subject to any further retention required to comply with legal obligations or protect the Controller’s rights. |
| Order management, performance of the sale contract, after-sales support, returns and warranties | For the duration of the contractual relationship and for 10 years after its termination, for compliance with civil, tax and accounting obligations, without prejudice to any longer limitation period prescribed by law or required to protect the Controller’s rights. |
| Compliance with legal obligations | For the period prescribed by applicable law or until expiry of the applicable statutory limitation periods. |
| Management of complaints, disputes, debt recovery, fraud prevention and protection of the Controller’s rights | For as long as necessary to manage the matter and thereafter until expiry of the limitation periods applicable to rights that may be asserted or defended in judicial or out-of-court proceedings. |
| Sending newsletters and promotional communications based on consent | Until consent is withdrawn and, in any event, for no longer than 24 months from the date on which consent was given or the most recent meaningful interaction with the Data Subject, unless consent is renewed. |
| Sending direct marketing communications to existing customers | Until the Data Subject objects or, in any event, for as long as a commercial relationship remains in place that can justify such processing, in accordance with Article 130(4) of Italian Legislative Decree No. 196/2003. |
At the end of those periods, your data will be permanently erased or irreversibly anonymised by PIZETA Pharma S.p.A.
9. Your rights
You may exercise the following rights in relation to the personal data covered by this Privacy Notice, as provided for and guaranteed by the GDPR:
- Right of access and rectification (Articles 15 and 16 GDPR): you have the right to access your personal data and request that they be rectified, amended or completed. If you wish, we will provide you with a copy of the data we hold about you.
- Right to erasure (Article 17 GDPR): in the circumstances provided for by applicable law, you may request the erasure of your personal data. Once we have received and assessed your request, we will cease processing and erase your personal data where the request is well founded.
- Right to restriction of processing (Article 18 GDPR): you have the right to request restriction of the processing of your personal data where the processing is unlawful or where you contest the accuracy of the personal data.
- Right to data portability (Article 20 GDPR): in the circumstances set out in that Article, you have the right to receive your personal data from the Controller so that you may transmit them to another controller.
- Right to object (Article 21 GDPR): you have the right to object at any time to the processing of your personal data based on our legitimate interests, on grounds relating to your particular situation. Before granting your request, PIZETA Pharma will assess the grounds on which it is based. Where personal data are processed for direct marketing purposes, you have the right to object at any time, without giving reasons, to processing for such purposes, including profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be processed for direct marketing purposes.
- Right to lodge a complaint (Article 77 GDPR): you have the right to lodge a complaint with the competent data protection supervisory authority if you consider that your rights in relation to the processing of your personal data have been or are being infringed.
The full text of the GDPR is available at https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
You may exercise your rights at any time in relation to the specific processing of your personal data by PIZETA Pharma. Requests may be submitted using the Controller’s contact details set out above.
10. Security measures
PIZETA Pharma S.p.A. is committed to protecting your personal data through specific technical and organisational security measures designed to prevent your personal data from being used unlawfully or fraudulently.
We regularly test, assess and evaluate the effectiveness of those security measures to ensure continuous improvement in the security of processing.
11. Changes to this Privacy Notice
This Privacy Notice may be amended or supplemented over time where necessary as a result of new legislation on personal data protection or changes to our services or organisation.
We therefore encourage you to review this Privacy Notice periodically. Where possible, we will endeavour to inform you promptly of any changes and their implications.
The updated version of this Privacy Notice will in any event be published in the dedicated section of the Company’s website, together with the date on which it was last updated.
12. Last updated
30 July 2026