FARMACOSMO S.p.A. has drafted this Privacy Policy to inform you about how we collect, use and share your Data. This Policy applies to all information collected through the relevant website www.farmacosmo.it (hereinafter the "Site").
NB: Should you provide us with information voluntarily, you freely consent to the use of your Personal Data as described herein. If you do not intend to consent to the processing of Personal Data, please refrain from communicating this decision to us.
Under Article 13 of EU Regulation 679/2016 (GDPR), we hereby provide the following information.
DATA PROCESSING
1. Data Controller
The data controller is the natural or legal person, public authority, service or other body that, individually or together with others, determines the purposes and means of the processing of Personal Data, also dealing with security profiles.
With regard to this website, FARMACOSMO S.p.A. is the Data Controller of Personal Data, with a registered office in Via Francesco Crispi no. 92 - 80121 Naples, Tax Code, VAT number and registration in the Register of Companies: 07328451211 - REA: 876902 ("farmacosmo").
For any clarification or exercise of your rights, you can contact us at the following addresses: Fax 081.0901315 Tel. 02 8362 3081, email privacy@farmacosmo.it.
2. Place of Data Processing
The processing related to this site’s web services takes place at the aforementioned headquarters in Naples. As regards the transfer of Data, its management and storage, all this takes place on servers physically located within the European Union.
3. DPO (Data Protection Officer)
FARMACOSMO S.p.A. has appointed a Data Protection Officer per Articles 37 and subsequent amendments of the GDPR that can be contacted at the following email address: dpo@farmacosmo.it.
4. Data Processing for Minors
Product purchase is reserved exclusively for adults. However, should a parent or guardian have reason to believe that their child or a minor has provided us with Data, you are kindly requested to contact us. Subscription to the newsletter of a promotional and commercial nature is reserved for users with an email address, who are at least 14 years old.
DATA PROCESSED
1. Data processing methods
Processing operations
For the "processing" of your Data we mean the completion of any operation, or set of operations, referred to in Article 4 no. 2) of the GDPR, consisting of the collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of the Data.
The Personal Data thus collected may be processed both in paper form and with the help of IT, telematics and/or automated tools, by entering them in archives managed by persons formally appointed to do so.
Access to Data
Your Data may only be accessed by authorised parties within the scope of the duties assigned by the Data Controller.
Dissemination and Communication of Data
Your Data shall not be disclosed and, without the need for your express consent - Article 6, Letters b) and c) and f) of the GDPR, may be communicated, where necessary or in any case if required, exclusively to:
• Institutional control bodies in the field of Public Security;
• External consultants in charge of providing administrative, accounting, legal and tax services;
• Credit institutions and data processing companies relating to the temporary management of data only related to the commercial and financial aspects of FARMACOSMO S.p.A.
• Shippers
• Providers of IT products and services (7 pixels as a price comparison service and Trustpilot A/S as an online collection and review service)
Some of the indicated subjects operate as data controllers. The communication to those who, on the other hand, operate as independent Data Controllers is carried out because prescribed by legal obligations or necessary to give effect to the obligations deriving from the contractual relationship or the legitimate interest of the owner consisting of maintaining the security of computer systems and in the performance of defensive activities.
Farmacosmo uses the Trovaprezzi.it, a certified review system that collects feedback from users who have purchased on the affiliated e-shop. In this context: "7Pixel S.r.l., in the person of the pro tempore legal representative, is appointed as the data controller of the User's data (email address) for the management of requests for comments within the Trusted Program of the website www.trovaprezzi.it"
For marketing activities and, specifically, for the management of promotional and commercial communications via email, Farmacosmo makes use of the MailUP service provider. This person acts as a data processor and manages the Data with the guarantees required by current legislation. Any further communication shall only take place with your explicit consent.
2. Purpose of processing and legal basis:
We use your Data for a variety of legitimate business reasons and purposes:
a) to provide you with the products you have purchased and to send you communications related to your order. For example, we shall use your Data to manage your order, confirm your purchase and manage services related to it such as shipping the products purchased. The legal basis for this processing is the execution of the contract of sale to which you are a party from the moment you accept the terms and conditions of sale indicated on the site;
b) to comply with the accounting and tax obligations in force, to comply with the obligations provided for by the Law, by a Regulation, by EC Legislation or by an Order of the Authority (in particular tax, anti-money laundering, banking and public security), as well as by supervisory and control bodies and for anonymous and aggregated statistical purposes. The legal basis for this processing is compliance with legal obligations;
c) to control unlawful conduct and/or prevent other unlawful acts or fraud, as permitted by applicable law. The legal basis for such processing is the legitimate interest of the Data Controller;
d) for the initiation, exercise or defence of legal actions of which the company "FARMACOSMO S.p.A." is part or could be part thereof. The legal basis for such processing is the legitimate interest of the Data Controller;
e) for email marketing purposes, also within the scope of the newsletter service, if subscribed. The legal basis for this processing is your explicit consent;
f) for the sole purpose of evaluating the quality of the products offered and to measure the degree of customer satisfaction, through requests for reviews of the products purchased. The legal basis for such processing is the legitimate interest of the Data Controller;
g) for reasons related to the application of future vacant professional positions in the context of the activities of the Data Controller. In particular, we refer to the Data collected during a selection or through the spontaneous sending of the Curriculum Vitae, carried out by email as well as through the section expressly dedicated to the purpose: "Work with us" on the website www.farmacosmo.it as well as through Sites or portals to which the Data Controller refers for the selection process and/or through the dedicated social media networks (e.g. LinkedIn). The Data collected is processed to verify the skills necessary for the recruitment or start of a working collaboration with the Company, as well as for purposes related or instrumental to the performance of the research and selection of personnel. It is understood that the provision of your personal data for the specific purpose indicated above is optional, but necessary to consider, possibly, the application and contact you to select the staff. The legal basis of the processing for the aforementioned purposes is represented by the need to execute activities of a pre-contractual/contractual nature requested by the candidate.
3. Data Retention Times
We store your data for the time necessary to achieve the purposes for which it was collected.
Your Data may also be stored so that we can contact you, to ensure compliance with national laws, prevent fraud, for any disputes, solve problems, provide assistance in case of investigations, take other actions where required by national laws in force and assert or defend a right in court: in these cases, the Data Controller may be obliged to keep Personal Data for a longer period.
For marketing purposes, the retention period of your data is 24 months from collection.
At the end of the retention period, all Personal Data shall be deleted. Therefore, upon the expiry of this term, the right of access, cancellation, rectification and the right to data portability (as indicated below) may no longer be exercised.
SECURITY OF DATA PROVIDED
Means of Protection
To protect your Data, we will take appropriate measures in line with applicable data protection and security laws and regulations, including asking our service providers to use appropriate measures to protect the confidentiality and security of your Data. Depending on the technological development, the implementation costs and the nature of the Data to be protected, we take technical and organisational measures to prevent risks, such as the destruction, loss or alteration of your Data and the unauthorised disclosure or access thereto.
Duties of the interested party
We remind you that you shall ensure, as far as you know, that the Data you provide us is correct, complete and updated. In addition, if you share other people's Data with us, you should collect such Data following any ongoing legal requirements. For example, you shall need to inform the other people, of whom you provide us with the Data, and obtain their consent.
RIGHTS OF THE DATA SUBJECT
Methods of exercising the rights
Under the provisions of Chapter III of the GDPR, Data Subjects may at any time exercise the rights provided for therein and in particular:
• Right of access: it consists of the right to obtain confirmation from the Data Controller whether the processing of Personal Data concerning you is in progress and, in this case, to receive information about the purposes of the processing, the categories of Data involved, the recipients or categories of recipients to whom the Personal Data are or may be communicated, the period of retention of Personal Data or the criteria for determining this period (Article 15, GDPR);
• Right of rectification: consists of the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate Personal Data and the integration of incomplete Personal Data (Article 16, GDPR);
• Right to erasure: consists of the right to obtain from the Data Controller, without undue delay, the erasure of Personal Data, in the cases provided for by the GDPR (so-called "right to be forgotten" - Article 17, GDPR);
• Right of limitation: consists of the right to obtain from the Data Controller the limitation of processing, in the cases provided for by the GDPR (Article 18, GDPR);
• Right to portability: it consists of the right to receive from the Data Controller in a structured format, commonly used and readable by an automatic device, the Personal Data concerning you provided to the Data Controller and request to transmit them directly, or through the Data Controller if technically feasible, to another Data Controller (so-called "right to data portability" - Article 20 GDPR);
• Right to object: to object to the processing of Personal Data in the event of particular situations affecting you (Article 21 of the GDPR);
• Right to withdraw consent: consists of the right to withdraw consent to the processing of your Personal Data, where provided. It may be exercised concerning all or only some of the purposes of the processing, and about all or some of the Data provided. The withdrawal of consent does not affect the lawfulness of the processing based on the previously given consent. In the same way, the consents expressed in reference to this policy can be revoked at any time notwithstanding the lawfulness of the processing based on the consent given prior to revocation.
• Right of complaint: Data Subjects who believe that the processing of Personal Data relating to them through the Website takes place in violation of the provisions of the Regulation have the right to lodge a complaint with the supervisory authority, as provided for by Article 77 of the Regulation, or to take appropriate legal action against the Data Controller or the Data Processor (Article 79 of the Regulation).
If you need to change your personal information, and you are a registered customer, you can correct, update or remove it by accessing your Reserved Area. In your account area - Information section - you will find the "ACCOUNT CANCELLATION" option, which you can access by clicking the "Cancel Your Account" button. Thus, you can permanently delete your data on Farmacosmo. If you are not a registered customer, you can write to us at: privacy@farmacosmo.it
If you are no longer interested in receiving advertisements and other marketing information by email, please send a request to privacy@farmacosmo.it (including your full name, email address and postal address) or you can unsubscribe by clicking the appropriate link at the bottom of the emails sent through the MailUP software or by accessing the customer's private area, in the dedicated section.
AMENDMENTS HERETO
Changes to the Data Processing Policy and Privacy Policy
This document constitutes the site's disclosure and may be subject to change. If substantial modifications are made to the use of the Data relating to the user by the Data Controller, the latter shall notify the user by publishing them with the maximum highlight on its pages or through alternative or similar means.
The document was updated on 10/06/2022 to be in line with the relevant regulatory provisions, and in particular per EU Regulation no. 2016/679 and Legislative Decree101/2018.
If you have any questions regarding the Privacy Policy, please do not hesitate to contact us at privacy@farmacosmo.it.
Joint Controllership Information Notice for the Fidelity Program pursuant to Article 13 of EU Regulation 2016/679
Dear Data Subject,
With this document (the “Notice”), we wish to renew our commitment to ensuring that the processing of personal data collected through the registration form for the Fidelity Program, carried out by both automated and manual means, is conducted in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 (“GDPR” or the “Regulation”) and other applicable data protection laws (the “Privacy Regulations”).
The term personal data refers to the definition set out in Article 4, paragraph 1 of the Regulation, namely “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (“Personal Data”).
This Notice – drafted in accordance with the principle of transparency and including all the elements required by Article 13 of the Regulation – aims to describe the management methods of the promotional marketing program by Farmacosmo (the “Fidelity Program”) active both on the e-commerce platform www.farmacosmo.it (the “Platform”), and in pharmacies branded “Farmacosmo” belonging to the Group (the “Farmacosmo Pharmacies”), with reference to the processing of Personal Data carried out by the Joint Controllers, as defined below.
We will also provide you, in a simple and intuitive way, with all the useful and necessary information so that you can provide your Personal Data in a conscious and informed manner and, at any time, exercise your rights under the GDPR.
Please note that this Notice applies exclusively to the Fidelity Program and does not apply to any other processing activities carried out on web pages possibly visited by the user while browsing the Platform by clicking on links and/or banners on the same.
JOINT CONTROLLERS OF THE PROCESSING
Dear Data Subject,
With this document (the “Notice”), we wish to renew our commitment to ensuring that the processing of personal data collected through the registration form for the Fidelity Program, carried out by both automated and manual means, is conducted in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 (“GDPR” or the “Regulation”) and other applicable data protection laws (the “Privacy Regulations”).
The term personal data refers to the definition set out in Article 4, paragraph 1 of the Regulation, namely “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (“Personal Data”).
This Notice – drafted in accordance with the principle of transparency and including all the elements required by Article 13 of the Regulation – aims to describe the management methods of the promotional marketing program by Farmacosmo (the “Fidelity Program”) active both on the e-commerce platform www.farmacosmo.it (the “Platform”), and in pharmacies branded “Farmacosmo” belonging to the Group (the “Farmacosmo Pharmacies”), with reference to the processing of Personal Data carried out by the Joint Controllers, as defined below.
We will also provide you, in a simple and intuitive way, with all the useful and necessary information so that you can provide your Personal Data in a conscious and informed manner and, at any time, exercise your rights under the GDPR.
Please note that this Notice applies exclusively to the Fidelity Program and does not apply to any other processing activities carried out on web pages possibly visited by the user while browsing the Platform by clicking on links and/or banners on the same.
JOINT CONTROLLERS OF THE PROCESSING
Farmacosmo S.p.A., with registered office at Via Francesco Crispi 92, 80121 – Naples (NA), Tax Code, VAT No. and Company Register No. 07328451211, in the person of its legal representative pro tempore Dr. Fabio De Concilio (“Farmacosmo”), and the pharmacies (“Pharmacy” or “Pharmacies”) that are part of the Farmacosmo Group (individually the “Controller”, jointly the “Joint Controllers”), jointly determine – for the purposes and in the manner set out below – the purposes of the processing in relation to Personal Data acquired on the Platform and in the Farmacosmo Pharmacies in execution of the Fidelity Program.
Each of the above-mentioned companies acts as Controller according to the definition in Article 4, point 7) of the Regulation, i.e., “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” for the processing of Personal Data related to their own business activities and Platform usage. They will also act, for the purposes better specified below, as Joint Controllers under Article 26 of the Regulation for the data processing activities carried out for the purposes outlined in this Notice.
To this end, the Joint Controllers have entered into a Joint Controller Agreement whereby they have committed to:
- jointly determine certain purposes and methods of processing Personal Data of the Data Subjects;
- jointly define, clearly and transparently, the procedures to provide a prompt response should you wish to exercise your rights as provided under Articles 15, 16, 17, 18, and 21 of the Regulation, as well as in cases of data portability under Article 20 of the Regulation, as further described in the relevant section of this Notice;
- jointly define this Notice in the parts of common interest, including all information required by the GDPR.
The essential content of the agreement is available from each Joint Controller and may be provided upon specific request by the Data Subject, to be sent using the contacts provided in the appropriate section of this Notice.
PURPOSE AND LEGAL BASIS OF THE PROCESSING
Some of your Personal Data may be collected in the following ways:
A. Personal Data voluntarily provided by the customer when registering for the Fidelity Program via the Platform or paper form
This refers to all Personal Data freely provided by the customer to enroll in the Fidelity Program via an online or paper form, which includes the creation of a virtual Fidelity Card to accumulate points and receive discounts.
This processing is lawful under Article 6, paragraph 1, letter b) of the Regulation (performance of a contract or pre-contractual measures at the request of the data subject) and for the fulfillment of legal obligations.
To allow the Joint Controllers to process your Personal Data for this purpose, the requested fields in the forms (online or paper) must be completed. Failure to provide even one of the mandatory fields may result in the inability to process your data and, consequently, to provide you with the requested information and services.
For this purpose, the Joint Controllers will acquire the following types of data:
- Common Personal Data, such as name, surname, tax code or email address.
No special categories of data as defined in Article 9 of the Regulation (e.g., health data) are processed.
B. Personal Data collected during browsing on the Platform
If you use the personal area dedicated to the Fidelity Program on the Platform, the IT systems and software procedures responsible for the Platform's operation may acquire some Personal Data implicitly through Internet communication protocols.
This category includes, for example: IP addresses, browser type, operating system, domain names and addresses of websites accessed, information about pages visited on the Platform, access time, time spent on a page, internal navigation paths, and other parameters related to the user’s operating system and environment. These technical/informatic data are collected and used by Farmacosmo only in an aggregated, non-identifiable form and may be used for identifying responsibilities in the event of cybercrime against the Platform.
The legal basis for this processing is the legitimate interest of Farmacosmo in managing and ensuring the proper functioning of the Platform.
C. Direct Marketing
This refers to promotional activities (using both automated and traditional means) of products and/or services offered by the Joint Controllers that may be of interest to you. For this purpose, and pursuant to Article 6, paragraph 1, letter f) of the Regulation and Article 130, paragraph 4 of the Italian Privacy Code (so-called “soft spam exception”), the Joint Controllers may conduct such activities based on their legitimate interest, even without your explicit consent, as clarified in Recital 47 of the Regulation.
This is subject to prior assessments by the Joint Controllers on the balance between their legitimate interest and your fundamental rights and freedoms. You may object, wholly or partially, to receiving such communications at any time without affecting the other processing purposes.
The Joint Controllers may also process your Personal Data for the following purposes, only with your express consent under Article 6, paragraph 1, letter a) of the GDPR:
- Indirect Marketing – Promotion of products and/or services provided by third parties, without sharing your Personal Data with such third parties.
- Profiling – Collection and processing of data related to your online behavior in order to define the most accurate possible user profile.
RECIPIENTS OF YOUR PERSONAL DATA
Your Personal Data may be handled, on behalf of the Joint Controllers, only by personnel expressly authorized to process them (under Article 29 of the GDPR) and by third parties specifically appointed as Data Processors (under Article 28 of the GDPR), in order to correctly perform all processing activities necessary to achieve the purposes of this Notice.
Where required by law or to prevent or suppress the commission of a crime, your Personal Data may also be disclosed to public authorities or the judiciary.
RETENTION PERIOD OF PERSONAL DATA
In accordance with the principle of storage limitation (Article 5.1(e) of the Regulation), your Personal Data will be processed by the Joint Controllers only for the time necessary to achieve the purposes of this Notice.
In particular, your data will be processed for the minimum time necessary, as stated in Recital 39 of the Regulation, i.e., until the relationship between you and Farmacosmo (including Farmacosmo Pharmacies) ceases, and for any additional retention period imposed by law (also as provided by Recital 65 of the Regulation).
In any case, your data will be subject to periodic review, at least every 12 months, to assess its relevance. If your data is no longer relevant, it will be deleted.
DATA SUBJECTS’ RIGHTS AND HOW TO EXERCISE THEM
You may exercise your rights under Articles 15 and following of the Regulation at any time with respect to each individual Controller. Specifically, you have the right to obtain:
DATA PROCESSING LOCATIONS
Your Personal Data will be processed by the Joint Controllers within the territory of the European Union.