Privacy policy | Sanitpharma

Information for users, customers, suppliers, partners and others

Sanitpharma S.r.l. (tax code and VAT number 04442100964), with registered office at Viale Papiniano 44, 20123 Milan (MI), Italy, as Data Controller, provides this information under Article 13 of Regulation (EU) 2016/679 (“GDPR”) to users of the website www.sanitpharma.com and its online shop, and to individuals acting in the name and on behalf of customers, suppliers, partners and others involved in contractual or pre-contractual activities with Sanitpharma S.r.l.

1. Personal data processed

The personal data processed are identification and contact details provided by or received from the data subject when:

registering on the website and using the customer area (first name, last name, email, password);
purchasing from the online shop (shipping and billing address, telephone, tax details, products purchased);
subscribing to the newsletter (email address);
sending requests through the website’s contact form, by email or by telephone;
visiting us, or through direct contacts made at events, etc.;
requesting commercial information or submitting offers, including in tender procedures;
exchanging communications and transactions after an order for goods or services (supplied/purchased).

Payment card details are never received by Sanitpharma S.r.l.: they are processed directly by PayPal.

2. Purposes and legal basis of processing

Personal data are processed in order to:

manage the user’s account, orders, payments, shipments, returns and customer service (performance of a contract, Article 6(1)(b) GDPR);
answer requests and exchange information needed to perform the contract, including pre- and post-contractual activities (Article 6(1)(b) GDPR);
comply with obligations under laws, regulations or EU legislation, for example on tax and accounting, and with orders from public Authorities (legal obligation, Article 6(1)(c) GDPR);
send the newsletter with news and promotions, only to users who have subscribed (consent, Article 6(1)(a) GDPR). Consent can be withdrawn at any time through the link in every email;
collect statistics on the use of the website and on purchases through Google Analytics, only with the consent given through the cookie banner (consent, Article 6(1)(a) GDPR). Details are in the Cookie policy;
keep the website secure and prevent abuse and fraud (legitimate interest of the Controller, Article 6(1)(f) GDPR).

The data subject may refuse to provide personal data. However, the data needed to manage orders, requests and contractual relationships are essential: refusing to provide them may prevent, in whole or in part, the performance of the relationship or of pre- and post-contractual activities. Providing data for the newsletter is optional.

3. How data are processed

Data are processed lawfully, fairly and transparently, using manual or automated tools, including by storing them in databases, directories and lists suitable for storing, managing and transmitting data, in the ways and within the limits needed to achieve the purposes above. Sanitpharma S.r.l. has adopted appropriate security measures to protect the data. Data are processed only by persons authorised to do so for the purposes stated. The Controller does not carry out automated decision-making or profiling.

4. Recipients of the data

Personal data will not be disclosed to the public in any form, including by making them available or open to consultation. They may, however, be shared, strictly as far as needed for the purposes stated, with:

the Controller’s employees and collaborators authorised to process them, trained to do so within the limits of their role and in line with the instructions received;
PayPal, to process payments;
couriers and carriers, to deliver orders;
IT service providers (website hosting, email, support for software and networks), appointed as data processors;
parties who, on the Controller’s behalf, supply or deliver goods or perform services, and external advisers (for example accountants and tax advisers);
parties entitled to access them under laws, regulations and EU legislation.

5. Transfer of data

Data are processed within the European Union. Some service providers used by the website (for example Google for the pharmacy map and Google Analytics, and PayPal for payments) belong to groups that are also based outside the European Union, in particular in the United States. Where data are transferred outside the European Union, they are transferred only to countries covered by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or on the basis of standard contractual clauses approved by the Commission, under Articles 45 and 46 GDPR.

6. Data retention

Data on orders, invoices and contractual relationships are kept for 10 years, as required by Italian civil and tax law (Article 2220 of the Civil Code).
Account data are kept for as long as the user keeps the account active.
The email address used for the newsletter is kept until consent is withdrawn.
Other data are kept for as long as needed for the purposes stated and in any case for no more than 15 years, unless the law requires otherwise or the data are needed to exercise rights, including in court.

When personal data no longer need to be kept, they are deleted or anonymised.

7. Rights of the data subject

Under Articles 15 to 22 GDPR, the data subject may exercise the following rights:

access: obtain confirmation as to whether their data are being processed, and information on the purposes, categories of data, recipients, retention period and methods of processing;
rectification and completion of inaccurate or incomplete data;
erasure, when the data are no longer needed for the purposes, when they withdraw consent or object to processing, or when the data are processed unlawfully;
restriction of processing, when they contest the accuracy of the data (for the time needed to check it), when processing is unlawful, or when the Controller no longer needs the data but the data subject asks for them to be kept for legal claims;
data portability to another controller, when processing is carried out by automated means and is based on consent or on a contract;
objection to processing based on legitimate interest;
withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

These rights can be exercised by writing to info@sanitpharma.com, stating the subject of the request and the right to be exercised. The Controller may ask for further information to verify the identity of the person making the request.

8. Right to lodge a complaint

The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where they habitually reside, work or where the alleged infringement took place.

9. Data controller

The data controller is Sanitpharma S.r.l. (tax code and VAT number 04442100964), with registered office at Viale Papiniano 44, 20123 Milan (MI), Italy, which can be contacted about any matter concerning personal data at the address above or by email at info@sanitpharma.com.

Customers, suppliers and partners are asked to share this information widely with everyone (employees, collaborators, subcontractors and others) whose names and/or personal data will be provided to Sanitpharma S.r.l. in the course of existing contractual or pre-contractual relationships.

For information about cookies, please see the Cookie policy.