Privacy Policy
Information notice on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and Article 130 of Italian Legislative Decree no. 196/2003. Website www.pharmacomitalia.it Last update 16/06/2026
1. Why this notice is provided
This privacy notice describes how PHARMACOMITALIA processes the personal data of users who visit www.pharmacomitalia.it and/or use the services available through the website, including contact forms, information request forms, document upload forms, newsletter subscription, embedded YouTube videos and embedded Google Maps.
This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”) and does not apply to other websites, pages or third-party online services that may be accessed through links on this website.
2. Data Controller
The Data Controller is:PHARMACOMITALIA
VAT number: 15500781008
Tax Code: 96437360587
European VAT: IT15500781008
Registered office: Via Padre Perilli n. 46, 00125 Rome (RM), Italy
Email: segreteria@pharmacomitalia.it
3. Data Protection Officer
The Data Controller has not appointed a Data Protection Officer (“DPO”), as the appointment is not currently mandatory.
For any request relating to the processing of personal data and for the exercise of privacy rights, data subjects may contact the Data Controller at: segreteria@pharmacomitalia.it.
4. Categories of personal data processed
4.1 Browsing data
The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category includes, by way of example: IP addresses, domain names of the devices used by users, URI/URL addresses of requested resources, date and time of the request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the server response and other parameters relating to the user’s operating system and IT environment.
These data are not collected to directly identify the user, but by their nature and through processing and association with data held by third parties, they could allow users to be identified.
4.2 Data voluntarily provided by email and forms
The optional, explicit and voluntary sending of messages to the contact addresses indicated on the website and/or the completion of forms available on the website entails the acquisition of the data necessary to reply to the request, as well as any additional personal data entered by the user.
In particular, the website may collect through forms data such as:
- company name;
- email address;
- VAT number;
- name and surname of the representative or contact person;
- role of the representative or contact person;
- documents, completed forms and attachments uploaded by the user;
- company description, sector, activities and role in the supply chain;
- confirmation of having read the privacy notice;
- any expression of willingness to be contacted regarding the request.
Users are invited not to enter in free-text fields or attachments any irrelevant data, unauthorised third-party data or special categories of personal data pursuant to Article 9 GDPR, such as health data, genetic data, biometric data, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation. If such data are voluntarily submitted, the Data Controller will process them only where strictly necessary to handle the request and may delete them where they are not necessary.
4.3 Data processed for newsletter purposes
If the user subscribes to the newsletter, the Data Controller may process the email address and any additional data requested in the subscription form, as well as technical data relating to the management of the sending, such as subscription date, proof of consent, withdrawal of consent, delivery outcome and, where provided by the system used, aggregate or individual opening and interaction statistics.
4.4 Data processed through cookies and tracking tools
The website uses cookies and similar technologies, as better described in the Cookie Policy. Some cookies are necessary for the technical functioning of the website and to store user preferences. Other cookies or tracking tools, such as Google Analytics 4, YouTube and Google Maps, are used only with the user’s prior consent, except where strictly necessary to provide a requested service or for security purposes.
4.5 Data processed through Google reCAPTCHA
The website forms are protected by Google reCAPTCHA, a service used to reduce spam, abuse and automated submissions. The use of reCAPTCHA may involve the processing of user technical data, such as IP address, device and browser information, interaction data with the page, online identifiers and cookies set by Google.
The use of reCAPTCHA is intended to ensure the security of the website and forms. If the user does not wish to use a form protected by reCAPTCHA, they may contact the Data Controller by email at the address indicated in this notice.
4.6 Data processed through YouTube and Google Maps
The website may embed YouTube videos and Google Maps through iframes or other integration tools.
When the user views or interacts with such content, Google may process personal data such as IP address, device data, browser data, information about the visited page, interaction data, cookies and other online identifiers. Such processing is also subject to Google’s privacy notices and privacy settings.
To ensure greater protection, YouTube and Google Maps content should be loaded only after the user has given consent via the cookie banner or by using a dedicated content activation command.
5. Purposes, legal bases, retention periods and nature of provision
| Purpose | Data processed | Legal basis | Retention period | Nature of provision |
|---|---|---|---|---|
| Browsing and technical functioning of the website | Browsing data, technical logs, device data | Legitimate interest of the Controller in the proper functioning and security of the website, Article 6(1)(f) GDPR | For the duration of the session and, for technical logs, for the time strictly necessary for website security and maintenance, normally no longer than 30 days unless required to investigate unlawful acts or comply with legal obligations | Necessary to browse the website |
| Website security and abuse prevention, including reCAPTCHA on forms | Technical data, IP address, browser data, interaction data, online identifiers | Legitimate interest of the Controller in website security and spam/abuse prevention, Article 6(1)(f) GDPR; for any non-technical cookies, consent where required | According to the service settings and for the time necessary for security purposes; for cookies, please see the Cookie Policy | Necessary to use protected forms; alternatively, the user may contact the Controller by email |
| Handling requests via forms or email, contacting the user and sending requested information | Company name, email, VAT number, representative/contact person, role, attachments, company description, content of the request | Performance of pre-contractual measures or handling of a data subject’s request, Article 6(1)(b) GDPR; where applicable, consent of the data subject, Article 6(1)(a) GDPR | Maximum 12 months from closure of the request, unless further retention is necessary for legal obligations or protection of rights | Necessary to receive a reply and to be contacted |
| Assessment of documents, forms and attachments submitted by the user | Data contained in uploaded attachments and forms | Performance of pre-contractual measures or handling of the request, Article 6(1)(b) GDPR | Maximum 12 months from closure of the request, unless legal obligations or protection of rights require otherwise | Necessary where the attachment is required to handle the request |
| Newsletter subscription and sending | Email address, subscription data, proof of consent, any interaction data with communications | Consent of the data subject, Article 6(1)(a) GDPR; Article 130 of Italian Legislative Decree no. 196/2003 | Until withdrawal of consent and in any case for a maximum period of 24 months from the last consent or useful interaction, without prejudice to retention of proof of consent for defensive purposes | Optional; failure to provide data prevents newsletter subscription |
| Statistics with Google Analytics 4 | Cookies, online identifiers, browsing data, interaction events | Consent of the data subject, Article 6(1)(a) GDPR | According to the duration indicated in the Cookie Policy and the retention settings configured in the service | Optional; if consent is not given, the service is not activated |
| Display of embedded YouTube videos | IP address, device/browser data, cookies, video interaction data | Consent of the data subject, Article 6(1)(a) GDPR | According to Google/YouTube settings and the Cookie Policy | Optional; if consent is not given, the video may not be displayed |
| Display of embedded Google Maps | IP address, device/browser data, cookies, map interaction data | Consent of the data subject, Article 6(1)(a) GDPR | According to Google settings and the Cookie Policy | Optional; if consent is not given, the map may not be displayed |
| Handling requests to exercise privacy rights | Identification data, contact data, content of the request, necessary documentation | Legal obligation, Article 6(1)(c) GDPR | 5 years from closure of the request, unless litigation arises | Necessary to handle the request |
| Establishment, exercise or defence of legal claims | Data necessary to protect the rights of the Controller or third parties | Legitimate interest, Article 6(1)(f) GDPR | For the time necessary to protect the right and in any case according to the applicable limitation periods, normally up to 10 years | Necessary in case of dispute or pre-litigation |
| Compliance with legal obligations | Data required by applicable law or competent authorities | Legal obligation, Article 6(1)(c) GDPR | For the period required by applicable law | Necessary |
6. Processing methods
Personal data are processed using IT, telematic and, where necessary, manual tools, in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, integrity and confidentiality.
The Data Controller adopts appropriate technical and organisational measures to protect personal data against loss, unlawful or improper use, unauthorised access, disclosure, alteration or destruction.
7. Recipients of personal data
Personal data may be processed by persons authorised by the Data Controller and, where necessary, communicated to subjects belonging to the following categories:
- providers of technical services for website operation, hosting, maintenance and IT security;
- providers of email, form management and communication services;
- any providers of newsletter platforms;
- administrative, legal, tax or technical consultants;
- Google Ireland Limited and/or Google LLC for services such as reCAPTCHA, Google Analytics 4, YouTube and Google Maps;
- public authorities, entities or subjects entitled to receive the data under legal obligations or requests from competent authorities.
Subjects processing data on behalf of the Data Controller are, where necessary, appointed as Data Processors pursuant to Article 28 GDPR. The updated list of processors may be requested from the Data Controller by writing to segreteria@pharmacomitalia.it.
8. Transfers of data outside the European Economic Area
Data are mainly processed within the European Economic Area.
The use of Google services, including reCAPTCHA, Google Analytics 4, YouTube and Google Maps, may involve transfers of data to countries outside the European Economic Area, including the United States of America.
Where carried out, such transfers take place on the basis of the safeguards provided for by Articles 44 et seq. GDPR, such as adequacy decisions of the European Commission, including the recipient’s possible adherence to the EU-US Data Privacy Framework, standard contractual clauses or further measures provided for by applicable law.
For more information on the safeguards applied, data subjects may contact the Data Controller at segreteria@pharmacomitalia.it.
9. Automated decision-making
The Data Controller does not carry out fully automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects them.
The use of statistical or security tools, such as Google Analytics 4 or reCAPTCHA, does not involve automated decisions by the Data Controller with legal effects on the user.
10. Data subjects’ rights
Data subjects may exercise, where applicable under the law, the following rights:
- right of access to personal data;
- right to rectification of inaccurate data or completion of incomplete data;
- right to erasure;
- right to restriction of processing;
- right to data portability;
- right to object to processing based on legitimate interest;
- right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal;
- right to lodge a complaint with the competent supervisory authority.
To exercise their rights, data subjects may write to: segreteria@pharmacomitalia.it.
11. Withdrawal of consent and newsletter
Users may withdraw consent to the newsletter at any time by using the unsubscribe link included in each communication, where available, or by writing to segreteria@pharmacomitalia.it with the subject “Newsletter cancellation”.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
12. Cookies and tracking tools
For detailed information on cookies and other tracking tools used by the website, their purposes and how to manage preferences, please refer to the Cookie Policy published on the website.
13. Changes to this notice
The Data Controller reserves the right to amend, update, supplement or remove parts of this notice. The updated version will be published on the website with the relevant update date.
Last update: 16/06/2026