Privacy policy

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 ( “REGULATION”)

IDENTITY AND CONTACT DETAILS OF ERBAMEA S.R.L. AS DATA CONTROLLER AND OF THE DATA PROTECTION OFFICER (“DPO”)

Erbamea s.r.l., with registered office at Via Gonzaga 12/A, Selci - Lama - 06016 San Giustino (PG), registered with the Perugia Companies Register under registration number 02710860541, VAT number and Tax Code 02710860541, subject to the direction and coordination of L'Erbolario Holding S.r.l. – email: erbamea@erbamea.com (“Erbamea”), is the data controller of the personal data of users who browse the website www.erbamea.com (the “Site”) and interact with it.

The Data Controller has appointed a Data Protection Officer (“DPO”) pursuant to Article 37 of the Regulation, who may be contacted at dpo.erbamea@erbolario.com.

1. PROCESSING OF BROWSING DATA

Erbamea processes the personal data of users who browse the Site in order to enable access to it, ensure the correct display of its pages and, more generally, allow users to use the content and features available on the Site.

Browsing data are also processed in order to:

• ensure the security and integrity of the Site, prevent any misuse, identify or manage anomalies and malfunctions;
• obtain statistical information on the use of the Site (for example, number of visits, most frequently visited pages and traffic time bands), including for the purpose of improving its operation and the quality of the services offered.
  

The data processed consist of information whose transmission is inherent in the use of Internet communication protocols and which the IT systems and software procedures used to operate the Site acquire during their normal operation. By way of example, this category includes:

• IP addresses of the devices used by users;
• URI/URL addresses of the requested resources;
• the date and time of the request;
• a numerical code indicating the status of the response provided by the server (for example,
• successful outcome or error);
• other parameters relating to the user’s operating system, browser, device and IT environment.
  

The legal basis for the processing is:

• the performance of pre-contractual measures taken at the request of the data subject or the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) of the Regulation, limited to processing necessary to enable the user to access the Site and use the available content and features;
• the pursuit of the Data Controller’s legitimate interest, pursuant to Article 6(1)(f) of the Regulation, in relation to processing carried out to ensure the security and integrity of the Site, prevent misuse, identify or manage anomalies and malfunctions, obtain statistical information on its use, including for the purpose of improving the Site and the services offered.

The provision of browsing data necessary to enable access to and consultation of the Site takes place automatically during browsing and is necessary to allow use of the relevant content and features.

Processing based on the Data Controller’s legitimate interest has been assessed as proportionate to the purposes pursued and as not adversely affecting users’ rights and freedoms, since it is limited to activities strictly connected with the security, proper functioning and improvement of the Site.

Personal data are processed for the time strictly necessary to pursue the purposes indicated above. In particular, technical and security logs are retained for a maximum period of 12 months, unless further retention is necessary in connection with the investigation or management of security incidents or cyber offences.

The Site also collects personal data through cookies or similar technologies. For further information on cookies and other technologies used by the Site and their respective retention periods, please consult the Site’s “Cookie Policy”.

2. PROCESSING OF DATA FOR THE PURPOSE OF RESPONDING TO REQUESTS FOR INFORMATION OR ASSISTANCE

Users may contact Erbamea, using the contact details provided on the Site, to submit requests for information or assistance and to send any reports or notifications.

Erbamea will process the user’s email address and any additional personal data contained in the communication or subsequently provided, to the extent necessary to manage and respond to the request.

The legal basis for the processing is the performance of pre-contractual measures taken at the request of the data subject or the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) of the Regulation.

Erbamea does not request health data for the ordinary management of requests for information or assistance. Where the data subject voluntarily provides such data or, due to the nature of the request, it becomes necessary to obtain information concerning their health, the relevant processing will be carried out with the data subject’s explicit consent, pursuant to Article 9(2)(a) of the Regulation.

The data subject may withdraw at any time any consent given to the processing of health data by contacting Erbamea at erbamea@erbamea.com. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

The provision of data necessary to manage the request is optional; however, failure to provide such data may prevent Erbamea from responding to the request or providing the assistance requested.

The data will be retained for a maximum period of 5 years as of the last correspondence with the data subject, taking into account the nature and complexity of the request, without prejudice to any further retention necessary for the establishment, exercise or defence of legal claims.

3. PROCESSING OF DATA TO ENABLE USERS TO EXERCISE RIGHTS RECOGNISED BY LAW

Erbamea processes the personal data of data subjects in order to receive, verify and respond to requests concerning the exercise of rights granted to them under applicable law, including the personal data protection rights set forth by the Regulation and rights connected with Erbamea’s liability as a manufacturer, as well as to carry out all activities arising from the management of such requests.

The legal basis for the processing is compliance with the legal obligations to which Erbamea is subject, pursuant to Article 6(1)(c) of the Regulation.

The provision of data necessary to identify the data subject, verify the request and act upon it is necessary to enable Erbamea to comply with its legal obligations. Failure to provide the necessary data may prevent, in whole or in part, the management of and response to the request.

Personal data processed for this purpose will be retained for the period necessary to manage and respond to the request and, subsequently, for the period necessary to enable Erbamea to demonstrate proper compliance with its legal obligations, without prejudice to any further retention period necessary for the establishment, exercise or defence of legal claims, as indicated in paragraph 4 below.

4. PROCESSING OF DATA BY ERBAMEA FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS

Erbamea may process the personal data of data subjects to the extent necessary to establish, exercise or defend its rights, in judicial or out-of-court proceedings, as well as in administrative proceedings or before other competent authorities.

The legal basis for the processing is Erbamea’s legitimate interest in protecting its rights and interests, pursuant to Article 6(1)(f) of the Regulation.

This interest includes, in particular, the need to demonstrate proper compliance with obligations arising from relationships with data subjects or imposed by law, as well as to establish, exercise or defend Erbamea’s rights in connection with requests, complaints, reports, objections or disputes.

The processing is limited to personal data that are relevant and necessary in relation to the specific protection requirement and is carried out taking into account the fundamental rights and freedoms of data subjects.

The data subject may object, on grounds relating to their particular situation, to processing based on legitimate interests pursuant to Article 21 of the Regulation. Where an objection is made, Erbamea may continue the processing if it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or where the processing is necessary for the establishment, exercise or defence of legal claims.

Further information

For the purposes indicated above, Erbamea may, in particular, retain and use the personal data necessary:

1. to demonstrate that it has properly managed requests concerning the exercise of rights recognised by the Regulation or applicable law, including those connected with Erbamea’s liability as a manufacturer;
2. to demonstrate that it has properly managed and responded to requests, complaints, reports or objections from data subjects;
3. to establish, exercise or defend its rights in connection with any disputes.

For this purpose, Erbamea may use personal data initially collected for the other purposes described in this privacy notice, to the extent that their retention and subsequent use are necessary for the establishment, exercise or defence of legal claims.

Personal data will be retained for the period necessary to protect the relevant right and, in the event of a dispute, for the entire duration of the dispute and until expiry of the time limits for any available appeals, without prejudice to any further retention periods required by law.

5. RECIPIENTS OF PERSONAL DATA

Users’ personal data may be disclosed or made accessible, in connection with the purposes described in this privacy notice, to the parties indicated below.

Depending on the circumstances, such parties may process the data as processors appointed pursuant to Article 28 of the Regulation (“Processors”), persons authorised to process personal data under the authority of the Data Controller pursuant to Article 29 of the Regulation (“Authorised Persons”), or independent data controllers.

Further information

In particular, users’ personal data may be disclosed or made accessible:

• to companies belonging to the group of which Erbamea is a member, for the performance, on Erbamea’s behalf, of IT and logistics support activities, customer assistance and, more generally, services supporting the activities described in this privacy notice;
• to companies, consultants or professionals engaged to provide, install, maintain, update and, more generally, manage the hardware, software and technological infrastructure used by Erbamea, including the Site.
  

Processors may engage additional parties to carry out the activities entrusted to them, within the limits and subject to the conditions laid down in Article 28 of the Regulation.

For purposes connected with organisational, administrative, financial and accounting activities, personal data may also be disclosed to L’Erbolario Holding s.r.l., the parent company and controlling company of Erbamea s.r.l., as well as, for the same purposes, to other group companies, which process the data as independent data controllers. Such disclosure is based on the legitimate interest of Erbamea and the other companies concerned in the circulation of information within the same group of undertakings, pursuant to Article 6(1)(f) of the Regulation, taking into account Recital 48 of the Regulation.

The Site is hosted on the Shopify technology platform, owned by Shopify International Ltd., established in Ireland (“Shopify”), and uses certain advanced services made available through the platform, including, for example, the product search functionality within the catalogue (Shopify Search & Discovery). In connection with such services, Shopify may process, as an independent data controller, certain personal data arising from users’ browsing and interaction with the Site.

Such data may include, among other things, technical data relating to connection and browsing, as well as information on how users interact with the Site, including searches carried out within the catalogue. In connection with the above services, Shopify may use such information to provide, develop and improve the advanced services made available through its platform.

The above processing is carried out by Shopify as an independent data controller and in accordance with the methods, purposes and retention periods determined by Shopify. For further information on the processing of personal data carried out by Shopify, please consult its consumer privacy policy available at: https://www.shopify.com/it/legal/privacy/consum. Data subjects may also exercise directly against Shopify the rights granted to them under applicable law in relation to processing carried out by Shopify as an independent data controller, including, where applicable, the rights of access, rectification and erasure, as well as the right to withdraw consent or object to certain processing activities.

For further information and to exercise the rights available in relation to processing carried out by Shopify, data subjects may use Shopify’s privacy portal at https://privacy.shopify.com

6. TRANSFERS OF DATA TO THIRD COUNTRIES

The use by Erbamea and by parties processing personal data on its behalf of certain services and technological infrastructure may involve the transfer or, in any event, the processing of personal data in countries outside the European Economic Area (“EEA”).

In such cases, the transfer will take place in compliance with the conditions laid down in the Regulation and, in particular, on the basis of an adequacy decision adopted by the European Commission pursuant to Article 45 of the Regulation or through the adoption of appropriate safeguards pursuant to Article 46 of the Regulation, including the standard contractual clauses adopted by the European Commission.

In particular, the Site is hosted on the Shopify technology platform. In providing its services, Shopify International Ltd., established in Ireland, may transfer personal data to other Shopify group companies and service providers located in countries outside the EEA, including Canada and the United States, adopting the safeguards required by applicable law.

Further information on transfers of personal data carried out by Erbamea and by parties processing data on its behalf is available from the Data Controller upon request.

For further information on transfers carried out by Shopify as an independent data controller, please refer to Shopify’s privacy policy indicated in paragraph 5 above.

7. DATA SUBJECTS’ RIGHTS

Data subjects may exercise against Erbamea, in the cases and subject to the conditions laid down in the Regulation, the right to obtain access to their personal data (Article 15), rectification of inaccurate data and completion of incomplete data (Article 16), erasure of data (Article 17), restriction of processing (Article 18), as well as, where applicable, the right to data portability (Article 20) and the right to object to processing (Article 21).

Where processing is based on consent, the data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests concerning the exercise of rights may be submitted without any particular formalities by contacting Erbamea using the contact details provided in this privacy notice or by writing to erbamea@erbamea.com.

The data subject may also contact the Data Protection Officer (“DPO”) at dpo.erbamea@erbolario.com.

To facilitate the exercise of rights, the data subject may use, without this being a requirement for submitting the request, the form prepared by the Italian Data Protection Authority (Garante per la protezione dei dati personali), available at: https://www.garanteprivacy.it/home/modulistica-e-servizi-online#diritti.

8. RIGHT TO LODGE A COMPLAINT WITH THE DATA PROTECTION AUTHORITY AND JUDICIAL REMEDIES

A data subject who considers that the processing of personal data relating to them infringes the Regulation has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 of the Regulation, in accordance with the procedures indicated on the Authority’s website.

The forms and information made available by the Italian Data Protection Authority for lodging a complaint can be consulted at: https://www.garanteprivacy.it/home/modulistica-e-servizi-online#diritti.

This is without prejudice to the data subject’s right to seek a judicial remedy before the competent court in the cases and in accordance with the procedures provided for by Article 79 of the Regulation.

Version 2.0, September 2026