Privacy Policy

This Privacy Policy is made pursuant to Article 13 of European Regulation No. 679/2016 and applies exclusively to all Data collected through the pharmaflex.com Website. This Privacy Policy is subject to updates that will be posted on the Website on a timely basis. This Privacy Policy, together with the Terms and Conditions, any other documents referred to in it, and the Cookie Policy, set out the basis on which the Data Subject's Personal Data will be processed.

 

Data Controller

The Data Controller of the Data collected from this Website is PHARMAFLEX S.R.L., Strada Statale 85 Venafrana n. 230, 86079 Venafro (IS), P.IVA 01000390946, email: [email protected].

 

Personal Data

Personal Data means any information concerning an identified or identifiable natural person (Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier, one or more characteristic elements of his/her physical identity.

 

Category of Personal Data Processed

Among the Personal Data processed by this Web Site, either independently or through third parties, are Common Data such as: Cookies; Usage Data; Contact Information including name, e-mail, phone number, and shipping and billing address; login and account information including username, password, and unique user ID; Personal Data including gender, hometown, date of birth, and purchase history; payment method or credit card information; personal preferences including your wish list; and marketing and cookie preferences.

 

Methods of Processing Personal Data

The Personal Data provided or acquired will be subject to Processing based on the principles of fairness, lawfulness, transparency and protection of confidentiality in accordance with current regulations. The Data Controller processes Users' Personal Data by adopting appropriate security measures aimed at preventing unauthorized access, disclosure, modification or destruction of Personal Data. The Processing is carried out by means of computer and/or telematic tools, with organizational methods and logics strictly related to the indicated purposes.

 

Purpose of the Processing of Personal Data and Legal Basis

Personal Data may be collected autonomously by the Data Controller or through third parties. In this case, the computer systems and software procedures in charge of the operation of this Website acquire certain Personal Data of the Users, of a technical-informatics nature (e.g. IP address, type of browser used, operating system, domain name and addresses of websites from which access or exit was made, etc.), the transmission of which is inherent to the normal operation of the Internet. Such Data may be processed for the sole purpose of obtaining anonymous statistical information on the use of the site and/or to check its correct functioning and will be deleted immediately after processing.

The Data that the Data Subject chooses to voluntarily provide will be processed in compliance with the conditions of lawfulness ex art. 6 GDPR and will be processed to enable the Website to provide its services, as well as for the Purposes indicated below and will be kept for the time necessary for the fulfillment of the aforementioned Purposes.

The Purposes of the processing are:

 

(a) Responding to inquiries and providing Information

The Data will be processed for the purpose of being contacted or following up on specific requests made to the Data Controller by the Data Subject for communications of a nature relating to the Data Controller's own Services and/or Content, via e-mail messages or other communication tools such as telephone or WhatsApp Business instant messaging.

Legal basis: this processing is optional and based on the consent of the Data Subject, however, the provision of the Data is necessary for the pursuit of the stated purpose.

Period of data retention: until consent is revoked by the Data Subject.

 

(b) Pre-contractual information and fulfillment.

The Data will be processed in order to be re-contacted or to follow up on specific requests addressed to the Data Controller by the Data Subject for communications of an informative nature and/or for information about the purchase of the Products of the same Data Controller, in case of abandoned shopping cart, through e-mail messages or filling in the Contact Form and other communication tools such as telephone or instant messaging WhatsApp Business.

Legal basis: this processing is optional and based on the consent of the Data Subject, however, the provision of the Data is necessary for the pursuit of the stated purpose.

Period of data retention: until consent is revoked by the Data Subject.

 

(c) Processing required as part of a contract.

The Data will be processed in order to fulfill obligations arising from the contract between the Data Subject and the Data Controller for the sale of the Products on the Website, to contact the Data Subject in relation to the Contract and for the management of the Contract, for the management of requests for legal guarantees, assistance, withdrawal requests, management and termination of the Contract

Legal basis: this processing is necessary for the performance of the contract to which the Data Subject is a party, for the execution of pre-contractual measures or to fulfill a legal obligation to which the Data Controller is subject.

Period of data retention: 10 (ten) years or different legal obligation.

 

(d) Fulfillment of any obligations under applicable laws.

The Data will be processed to fulfill any type of obligation contemplated and provided for by current laws, regulations, related rules, business customs, and tax/fiscal matters, including also for the purposes provided for in the anti-money laundering legislation Legislative Decree 231/2007 and subsequent amendments.

Legal basis: this processing is necessary to fulfill a legal obligation to which the Data Controller is subject.

Period of data retention: 10 (ten) years or different legal obligation.

 

(e) Soft spam

The Data will be processed to allow the Data Controller to send by e-mail to the Interested Party commercial and promotional communications concerning Products and/or Services similar to the Products/Services being sold without the need for the express and prior consent of the Interested Party, as provided for in Article 130, paragraph 4, Privacy Code as amended by Legislative Decree No. 101 of 2018, and provided that the Interested Party does not exercise the right to object.

Legal Basis: this processing is based on the legitimate interest of the Data Controller pursuant to Article 6(F) and Recital No. 47 of the GDPR.

Period of data retention: until opposition by the Data Subject.

 

(f) Newsletter

The Data will be processed for sending promotional, commercial and advertising communications and material or inherent to initiatives and events of the Data Controller, through newsletters.

Legal Basis: this processing is based on the consent freely given by the Data Subject pursuant to Article 6(1)(A) of the GDPR.

Data Retention Period: until consent is revoked by the Data Subject through the appropriate tool at the bottom of the newsletter or through a request to the Data Controller.

 

(g) Direct marketing

The Data will be processed for direct sales of Products/Services, market research, sending of communications and promotional, commercial and advertising material or inherent initiatives and events, by e-mail, SMS, Whatsapp, Chat, Direct Messaging from social media, social networks or by phone calls, paper mail and other informative material.

Legal Basis: this processing is based on the consent freely given by the Data Subject pursuant to Article 6(1)(A) of the GDPR.

Period of data retention: until consent is revoked by the Data Subject.

 

(h) Statistics

The Data will be processed to perform statistical analysis on aggregated and anonymous data to analyze the behavior of the Data Subject in order to improve the products and services provided by the Data Controller as well as to meet the Data Subject's expectations.

Legal Basis: this processing is based on the consent freely given by the Data Subject.

Data retention period: until consent is revoked by the Data Subject.

 

(i) Profiling

The Data will be processed for the analysis and evaluation of interests, habits, consumption choices, including the creation of profiles in order to be able to send personalized informative and promotional material about the Services/Products offered by the Data Controller.

Legal Basis: this processing is based on the consent freely given by the Data Subject pursuant to Article 6(1)(A) of the GDPR.

Data retention period: until consent is revoked by the Data Subject.

 

Disclosure of Data

In addition to the Owner, in some cases, they may have access to the Data:

• (a) categories of specially trained appointees involved in the organization of the Website (administrative, sales, marketing, legal, system administrators);
• b) external parties (such as third party technical service providers, hosting providers, IT companies, communication agencies) also appointed as Data Processors by the Data Controller ex art. 28 GDPR. The updated list of Data Processors, if appointed, can always be requested from the Data Controller;
• (c) public or private entities that can access the Data in compliance with legal obligations;
• (d) individuals who perform tasks that are ancillary and instrumental to the Holder's activity.

 

Timing of Treatment

As expressly provided for in Art. 5, co. 1, letter e) of the GDPR, the Data are kept for the time necessary for the Processing of the same in relation to the performance of the service requested by the Data Subject, or required by the Purposes described above in this document.

At the end of the retention period, the Personal Data will be deleted and therefore, the rights of access, deletion, rectification and portability of the Data can no longer be exercised

 

Cookie

This Website uses cookies. Cookies are small text files that can be used by Websites to make the experience more efficient for the Data Subject and to personalize content and ads, provide social media features, and analyze traffic. Cookie Policy

 

Place of Processing and Transfer of Data Abroad

The Data are processed at the operational headquarters of the Data Controller. For further information you may contact the Data Controller. The Data may be processed by individuals and/or legal entities operating on behalf of the Data Controller and under specific contractual obligations and located in EU or non-EU member countries. In the event that Data is transferred outside the EEA, the Data Controller will take all appropriate contractual measures to ensure adequate protection of the Data.

 

Exercise of data subject's rights

The Data Subject has the right to exercise the faculties provided for in Articles 7, 15-22 of European Reg. 679/2016. In particular, he/she has the right to revoke his/her consent at any time and, upon simple request to the Data Controller, he/she may request access to the Personal Data, receive the Personal Data provided to the Data Controller and where possible transmit them to another Data Controller without hindrance (so-called portability), obtain the updating, limitation of the processing, rectification of the Data and the deletion of those processed in breach of the regulations in force. He/she has the right, for legitimate reasons, to object to the Processing of Personal Data concerning him/her and to the Processing for purposes of sending advertising material, direct sales and for carrying out market research. He/she also has the right to lodge a complaint with the Privacy Guarantor as the supervisory authority for the protection of personal data or to take appropriate legal action. Data subjects may exercise their rights by contacting the Data Controller by e-mail at: [email protected].

 

Tools used for the Processing of Personal Data 

 

CONTACT FORM

The Interested Party, by filling out the Contact Form with their Data, consents to their use to respond to requests for information, or any other purpose indicated by the header of the form. Personal Data collected through Contact Form: Email, First Name and Last Name.

 

Shopify (Shopify International Ltd)

This site uses solutions offered by Shopify to create Contact Forms. Personal data collected: Email, First name and Last name. Place of data processing: Ireland - Privacy Policy(https://www.shopify.com/legal/privacy)

 

OTHER CONTACT TOOLS  

 

WhatsApp Business

WhatsApp Business is an instant messaging service provided by WhatsApp Ireland Limited. For the purposes of the processing methods, reference is also made to the WhatsApp Business Data Processing Terms found at the following link: https://www.whatsapp.com/legal/business-data-processing-terms/. The Data Subject's data will transit in WhatsApp Business services according to the terms that WhatsApp reports in the document "WhatsApp Business Terms of Service" at the following link: https://www.whatsapp.com/legal/business-terms/ . Personal Data collected: phone number, email, Usage Data, Cookie. Place of Processing: Ireland-. Privacy Policy (https://www.whatsapp.com/legal?eea=0#privacy-policy)

 

Chat Bot

To handle inquiries with users this website uses a Chat service provided by:

 

Live chat (Live Chat, Inc)

Live chat is a service offered by LiveChat Inc. that allows you to manage the communication of your commercial offerings. Live chat may use various technologies to collect and store information when you use the services with which it is integrated, this may include the use of cookies and similar tracking technologies. Place of Processing: USA - Privacy policy (https://www.livechat.com/legal/privacy-policy/)

 

EMAIL ADDRESS MANAGEMENT

These services enable the management of a database of email contacts, telephone contacts, or contacts of any other type used to communicate with the Data Subject. These services may also allow for the collection of Data related to the date and time of viewing of messages by the Data Subject, as well as the Data Subject's interaction with them, such as information about clicks on links embedded in messages.

 

Newsletter

By registering for the newsletter, the Data Subject's email address is automatically added to a list of contacts to whom email messages containing information, including information of a commercial and promotional nature, relating to this Web Site may be sent. The Data Subject's email address may also be added to this list as a result of registering with this Website or after making a purchase. The Interested Party may choose at any time to unsubscribe from the newsletter by clicking on a specific button they will find within the emails. After clicking the unsubscribe button the Data Subject's Data will be deleted immediately from the "email marketing" software. Personal Data collected: email and Name. This Website uses the newsletter service provided by:

 

Klaviyo (Klaviyo, Inc.)

Klaviyo is a service that organizes and analyzes the distribution of newsletters. In case a Data Subject does not want his or her Data to be handled by Klaviyo, it will be necessary for him or her to unsubscribe from the newsletter. For this purpose, a link is provided in each newsletter sent. Personal Data collected: email and name. Place of Processing: USA - Privacy Policy (https://www.klaviyo.com/legal/dpa#)

 

SECURITY MEASURES TAKEN  

This Website, to make it secure when Personal Data is entered, has an SSL certificate and uses the HTTPS protocol. With the use of this protocol, the transactions and data that are transmitted in the Websites take place with maximum security and the content of the communication is not read or manipulated in any way by third parties.

 

reCAPTCHA

This Website uses reCAPTCHA which is a service subject to the privacy (https://policies.google.com/privacy?hl=it)

and to the terms and terms and conditions (https://policies.google.com/terms?hl=it)

Google's usage policy.

 

WEBSITE REGISTRATION

With the registration service, the Data Subject allows the Site to identify him/her and give him/her access to dedicated services. Registration and authentication services can also take place with the help of third parties. In this case, the application may access some Data stored by the third-party service used for registration and identification.

 

Shopify (Shopify International Ltd.)

This website uses the service offered by Shopify that allows the Data Subject to create a restricted area. Place of Processing Ireland. For more information on the permissions that follow, the Data Subject may refer to the Privacy Policy (https://it.shopify.com/legal/privacy)

 

STATISTICS

Statistical services allow the Data Controller exclusively to monitor and analyze traffic data and are used to track the behavior of the Data Subject. This Website uses the following services:

 

Google Analytics (Google Ireland Limited)

Google Analytics is an analytics service provided by Google Ireland Limited. Google uses the Personal Data collected for the purpose of tracking and examining the use of this Website, compiling reports and sharing them with other services developed by Google. Google may use Personal Data to contextualize and personalize ads in its advertising network. Google may also transfer this information to third parties where required to do so by law or where such third parties process this information on Google's behalf. IP address anonymization is enabled on this site. The IP address transmitted by your browser for purposes related to Google Analytics will not be merged with other data already held by Google.

At the following link https://tools.google.com/dlpage/gaoptout?hl=it the browser add-on for deactivating Google Analytics is made available by Google. Personal Data Collected: Cookies and Usage Data. Place of processing: Ireland -. Privacy Policy (https://policies.google.com/privacy?hl=it)

 

INTERACTION WITH SOCIAL NETWORKS

These services allow for interactions with social networks directly from the pages of this Website. The interactions and information acquired by this Website are in each case subject to the privacy settings of the Data Subject related to each social network. In the event that a social network interaction service is installed, it is possible that, even if Users do not use the service, it will collect traffic data related to the pages where it is installed.

 

1. Facebook (Meta Platforms, Inc.)

Facebook buttons are interaction services with the social network Facebook, provided by Meta Platforms, Inc. Personal data collected: cookies and usage data. Place of processing: Ireland - Privacy Policy(https://www.facebook.com/privacy/explanation)

 

2. Instagram (Meta Platforms, Inc.)

Instagram buttons are interaction services with the social network Instagram, provided by Meta Platforms, Inc. Personal data collected: cookies and usage data. Place of processing: Ireland - Privacy Policy (https://help.instagram.com/519522125107875)

 

REMARKETING AND RETARGETING

These services allow this Website to communicate, optimize, and serve advertisements based on a Data Subject's past use of this Website. This activity is done by tracking Usage Data and the use of Cookies. This Web Site uses the following services:

 

1. Facebook Remarketing (Meta Platforms, Inc.)

Facebook Remarketing is a Remarketing and Behavioral Targeting service provided by Facebook, which links this Website's activity with the Facebook advertising network. This Website makes use of the Facebook Pixel tool in order to measure conversions. Thanks to the Facebook Pixel you can understand the actions that people perform on the Website. The Data that is collected can be used to:

- Make sure listings are shown to the right people;

- Create audience groups for which to target advertisements;

- Take advantage of the additional advertising tools of the platform you are advertising on

The information collected is anonymous to the operators of this Site and cannot be used to identify an individual Data Subject. However, the information is saved and analyzed by Facebook, which could link the action back to an individual profile and use this information for internal Facebook advertising purposes, as outlined by Facebook's privacy policy. This will allow Facebook to show advertisements on both Facebook and third-party sites. The Site Owner has no control over how this data is used. For more information on how users can protect their privacy, please refer to the Privacy of Facebook. (https://www.facebook.com/about/privacy/)

 

2. Google ADS

Google ADS is a service provided by Google Ireland Limited that links this Website with Google's advertising network. This Web Site makes use of the Remarketing functionality of Google Analytics combined with the cross-device adaptability of Google ADS. This functionality makes it possible to connect target groups for promotional campaigns created by the Marketing function of Google Analytics with the adaptability to different Google ADS devices. This makes it possible to show advertisements based on the Respondent's personal interests, identified through an analysis of the Respondent's web behavior, whether on a mobile device or other devices. You can permanently disable targeting and remarketing features by disabling the "personalized advertising" feature in your Google account. To do so, simply follow this link: https://www.google.com/settings/ads/onweb/ Personal Data Collected: Cookies and Usage Data. Place of processing: Ireland - Privacy Policy (https://policies.google.com/privacy?hl=it)

 

CONTENT ON EXTERNAL PLATFORMS

These services make it possible to display content hosted on external platforms directly from the pages of this Website and interact with them.
In the event that such a service is installed, it is possible that, even if Users do not use the service, it will collect Traffic Data related to the pages where it is installed.

This Website uses

 

1. Google Maps

Google Maps is a map display service operated by Google that allows this Website to integrate such content within its pages. Personal Data Collected: Cookies and Usage Data. Place of Processing: Ireland -. Privacy Policy (https://policies.google.com/privacy?hl=it)

 

2. Instagram widget (Meta Platforms, Inc.).

It is an image/video display service operated by Meta Platforms, Inc. that.

allows this Application to integrate such content within its own

pages. Personal Data Processed: Cookies; Usage Data. Place of Processing:

Ireland- Privacy Policy (https://help.instagram.com/519522125107875)

 

PAYMENT MANAGEMENT

Payment processing services allow this Website to process payments by credit card, bank transfer or other means. The Data used for payment is acquired directly from the operator of the requested payment service without being processed in any way by this Website. Some of these services may also allow the scheduled sending of messages to the Data Subject, such as emails containing invoices or notifications regarding payment. This Website uses the following services:

 

1. Soisy (Soisy S.p.a.)

Soisy is a payment service provided by Soisy S.p.a. that allows the Data Subject to make installment payments online. Personal Data collected: Cookies and various types of Data as specified by the privacy policy of the service. Place of processing: Italy- Privacy Policy (https://www.soisy.it/privacy-policy/)

 

2. Klarna (Klarna Bank AB)

Klarna is a service that enables the Interested Party to make deferred digital payments and transfer money via the Internet. This service is provided by the company Klarna Bank AB. Personal Data collected: Various types of Data as specified by the privacy policy of the service. Place of processing: Sweden - Privacy Policy(https://cdn.klarna.com/1.0/shared/content/legal/terms/0/it_it/privacy)

 

3. PayPal (Paypal Europe S.à.r.l. et Cie, S.C.A Inc.).

PayPal is a payment service provided by PayPal Europe S.à.r.l. et Cie, S.C.A Inc. that enables the Data Subject to make online payments using their PayPal credentials. Personal Data collected: Cookies and various types of Data as specified by the privacy policy of the service. Place of processing: Luxembourg - Privacy Policy (https://www.paypal.com/it/webapps/mpp/ua/privacy-full)

 

4. Google Pay (Google Ireland Limited)

Google Pay is a payment service provided by Google Ireland Limited, which enables the Data Subject to make online payments using their Google Account. Personal Data collected: Cookies and various types of Data as specified by the service's privacy policy. Place of processing: Ireland - Privacy Policy (https://policies.google.com/privacy?hl=it)

 

5. Shop Pay (Shopify International Ltd.)

Shop Pay is an online payment service provided by Shopify International Ltd. that allows the Data Subject to register their payment, shipping and billing information for quick check-out management on the Shopify platform. Personal Data collected: Various types of Data as specified by the privacy policy of the service. Place of processing: Ireland -. Privacy Policy (https://www.shopify.com/legal/privacy)

 

Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this Privacy Policy at any time by giving notice to Users on this page. Therefore, please consult this page often, taking as reference the date of last modification indicated at the bottom. If you do not accept the changes made to this Privacy Policy, you must cease using this Website and may request the Data Controller to remove your Personal Data. Unless otherwise specified, the previous Privacy Policy will continue to apply to the Personal Data collected up to that point. The Data Controller is not responsible for updating all links viewable in this Privacy Policy, so whenever a link is not working and/or updated, Users acknowledge and agree that they should always refer to the document and/or section of the websites referred to by that link.

 

Privacy Policy updated as of April 2023