Last updated: 14 August 2026
1. Data Controller
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), we hereby inform you that the Data Controller of your personal data is:
Company name: Pharma Integratori S.r.l.
Registered office: Via Andrea Bernardini, 50 – 56032 – Buti (PI), Italy
VAT No. / Tax Code: IT 02433100506
Companies Register: Pisa, REA No. 206730
Email: ali@pharmaintegratori.it
Telephone: +39 320 176 6262
Website: www.pharmaintegratori.it
Data Protection Officer (DPO): Not appointed
2. Types of Data Processed
We process the following categories of personal data:
Personal and contact details: First name, surname, shipping and billing addresses, email address, telephone number.
Payment data: Information relating to the payment methods used, processed directly by payment platforms such as Stripe, PayPal, etc.
Browsing data: IP address, browser type, pages visited and time spent on the website, collected through cookies.
Order-related data: Purchase history, products purchased and consumer preferences.
Special categories of data, if voluntarily provided: Information about allergies, intolerances or dietary preferences communicated in order to personalise product recommendations.
3. Purposes of Processing
Your personal data is processed for the following purposes:
Performance of the sales contract: Managing orders, processing payments, shipping products, and handling returns and refunds (Article 6(1)(b) GDPR).
Compliance with legal obligations: Invoicing, accounting, and fulfilment of tax and regulatory obligations (Article 6(1)(c) GDPR).
Customer support: Responding to requests for information, managing complaints and providing after-sales support (Article 6(1)(b) GDPR).
Direct marketing, only with your consent: Sending newsletters, promotional communications, special offers and information about new products (Article 6(1)(a) GDPR).
Service analysis and improvement: Conducting anonymous statistical analyses of user behaviour to optimise the browsing experience and our commercial offering (Article 6(1)(f) GDPR).
Profiling, only with your consent: Creating consumer profiles in order to send personalised offers based on previous purchases (Article 6(1)(a) GDPR).
4. Legal Basis for Processing
The processing of your personal data is based on the following legal grounds:
Performance of a contract: To manage orders and provide the requested services.
Legal obligation: To comply with tax, accounting and regulatory obligations.
Explicit consent: To send marketing communications and carry out profiling.
Legitimate interest: To improve our services, prevent fraud and ensure website security.
5. Recipients of the Data
Your personal data may be disclosed to the following parties, who may be appointed as Data Processors where necessary pursuant to Article 28 of the GDPR:
E-commerce platform: WooCommerce.
Hosting services: SiteGround, for website management and hosting.
Couriers and shipping providers: Poste Italiane, DHL, BRT and Amazon Logistics, for order delivery.
Payment processors: Stripe and PayPal, for processing transactions.
Email marketing services: Brevo, for sending newsletters.
Consultants and professionals: Accountants, employment consultants and legal advisers, for accounting and legal compliance purposes.
Public authorities: Only where required by law, such as the Guardia di Finanza or the Italian Revenue Agency.
Your data will not be disclosed or transferred to third parties for marketing purposes without your explicit consent.
6. International Data Transfers
Some of the services used, such as hosting, email marketing and analytics services, may involve the transfer of data outside the European Union. In such cases, transfers are carried out in compliance with the GDPR, ensuring appropriate safeguards through:
European Commission adequacy decisions.
Standard Contractual Clauses (SCCs).
Certifications such as the Data Privacy Framework, where applicable to transfers to the United States.
7. Data Retention Period
Your personal data is retained for the time strictly necessary to fulfil the purposes indicated:
Data processed for the performance of a contract: For the entire duration of the contractual relationship and thereafter for 10 years, in accordance with the ordinary limitation period under Article 2946 of the Italian Civil Code.
Data processed for legal obligations, including invoices and accounting records: For 10 years from the date on which the document was issued, pursuant to Article 2220 of the Italian Civil Code.
Marketing data: Until consent is withdrawn or for 24 months from the last contact.
Browsing data and cookies: In accordance with the periods specified in the Cookie Policy—generally 12 months for technical cookies and 6 months for profiling cookies.
Customer support data: For the time necessary to process the request and subsequently for 24 months.
At the end of the applicable retention period, the data will be securely deleted or anonymised.
8. Data Subject Rights
Pursuant to Articles 15–22 of the GDPR, you have the right to:
Access, Article 15: Obtain confirmation as to whether or not personal data concerning you exists and access its content.
Rectification, Article 16: Request the correction of inaccurate or incomplete data.
Erasure, or the “right to be forgotten”, Article 17: Request the deletion of your data where it is no longer necessary or where you withdraw your consent.
Restriction of processing, Article 18: Request the restriction of processing in certain circumstances.
Data portability, Article 20: Receive your data in a structured format and transmit it to another data controller.
Objection, Article 21: Object to the processing of your data on legitimate grounds.
The right not to be subject to automated decision-making, Article 22: Including profiling, except where you have given your explicit consent.
How to Exercise Your Rights
You may exercise these rights by sending a written request to:
Email: ali@pharmaintegratori.it
Postal address: Via Andrea Bernardini, 50 – 56032 – Buti (PI), Italy
A response will be provided within 30 days of receipt of the request.
9. Right to Lodge a Complaint with the Supervisory Authority
If you believe that the processing of your personal data infringes the GDPR, you may lodge a complaint with:
Italian Data Protection Authority
Garante per la Protezione dei Dati Personali
Address: Piazza Venezia 11, 00187 Rome, Italy
Telephone: +39 06 696771
Email: garante@gpdp.it
Certified email (PEC): protocollo@pec.gpdp.it
Website: www.garanteprivacy.it
10. Security Measures
We have adopted appropriate technical and organisational measures to protect your personal data, including:
SSL/TLS encryption: All communications and transactions on the website are protected by an SSL certificate.
Restricted access: Only authorised personnel may access personal data.
Regular backups: Regular backup copies are made to prevent data loss.
Security updates: Our systems are kept up to date to prevent vulnerabilities.
Staff training: All personnel receive training on data protection.
11. Minors
Our website is not intended for individuals under 14 years of age. We do not knowingly collect personal data from children under 14 without the consent of their parents or legal guardians. If we become aware that such data has been collected, we will proceed to delete it.
12. Amendments to the Privacy Policy
We reserve the right to amend this Privacy Policy in order to reflect changes in applicable legislation or in our business operations. Any amendments will be published on this page, together with the relevant update date. We recommend that you consult this section periodically.
