Privacy Policy

PRIVACY POLICY

Introduction

The EU Regulation 2016/679 on the “protection of individuals with regard to the processing of personal data, as well as on the free movement of such data” (hereinafter “EU Reg. 2016/679” or “GDPR”) contains a series of rules aimed at ensuring that the processing of personal data is carried out in compliance with the fundamental rights and freedoms of individuals.
Therefore, on this page, Giuliani S.p.A. intends to provide pursuant to articles 13 and 14 of the GDPR, the following information on the processing of personal data of users who visit or consult the website accessible electronically from the address: www.giulianipharma.com (hereinafter the “Site”).
This policy relates only to the site giulianipharma.com and does not concern other websites that may be consulted by the user through links contained therein.

Data Controller

The Data Controller is Giuliani S.p.A., (C.F. e P. IVA 00752450155), with registered office in Via Pelagio Palagi n. 2, 20129 – Milan (MI), in the person of its legal representative p.t., (hereinafter “Giuliani” or even just the “Data Controller”).

Data Protection Officer (DPO)

The data controller has also designated a Data Protection Officer pursuant to Article 37 of the GDPR. The interested party may at any time contact the DPO to request explanations regarding this Information or exercise the rights provided for by the legislation on the protection of personal data by sending an e-mail to the e-mail address: dpo@giulianipharma.com

Categories of personal data and source of data

While browsing the Site, the following information relating to the User (hereinafter also “Interested Party”) may be acquired:

a) Navigation data

When connecting to the Site, the computer systems and software procedures used to operate them automatically and / or acquire some information automatically and indirectly (such as, by way of example, the so-called “cookie” as specified in the Cookie Policy) the transmission of which is implicit in the use of the Internet. The processing of this data allows the Data Controller to guarantee the best possible browsing experience as well as to provide all the functions and services offered through the Site. This information is not collected to be associated with identified interested parties, but by their very nature, could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes:

• “IP addresses” or domain names of the computers used by the Users who connect to the Site;
• time of request;
• addresses in URI/URL (Uniform Resource Identifier/Locator) notation of the requested resources;
• methods used to submit the request to the web server;
• size of file obtained in response;
• the numerical code indicating the status of the response given by the web server (successful, error, etc.) and other parameters relating to the operating system and the User’s computer environment..

These data, which are necessary for the use of web services, are also used for the purpose of obtaining anonymous statistical information on the use of the Site and are therefore not collected in order to be associated with identified data subjects.
The navigation data are normally deleted at the end of each treatment but may be used and stored by the Data Controller to ascertain any responsibility in case of computer crimes against the Site or other sites connected or connected to it. Except in this circumstance and as indicated in the Cookie Policy of the Site, navigation data are kept for a limited period of time, in compliance with the provisions of current legislation on the subject.
It is possible to limit the processing of the personal data indicated above by using some features made available by the Site (with reference to the transmission of cookies or similar tools, please refer to what is specified in the Cookie Policy of the Site) or by the device or browser / navigation application. In this case, navigation on the Site may be limited and some of its functions / services may be inaccessible.

b) Data provided voluntarily by the User

The interaction with the “Contacts” and “Adverse Drug Reaction” sections, as well as the optional, explicit and voluntary sending of messages to the contact addresses of the Controller published on the Site, involve the collection and subsequent processing of further personal data by Giuliani.
These additional personal data are freely provided by the User. Unless otherwise specified in the forms on the Site, the data requested are strictly necessary to process the requests received from the interested party.
In particular, the Data Controller collects the following types of personal data:

• identification data (name) and contact data (e-mail), as well as any further information that the interested party provides by communicating directly with the Data Controller through the form in the “Contacts” section of the Site, or by e-mail to the addresses indicated on the Site, or communicated by telephone to the contact numbers published on the Site;
• special categories of personal data provided by filling the forms “Adverse Drug Reaction” on the Site.
• identification and contact data provided by filling in the additional forms on the Site.

The processing of such additional personal data will be based on compliance with the principles of correctness, lawfulness, transparency and protection of the confidentiality and rights of the interested party.
The personal data indicated above are collected directly from the interested party.

Purpose of the processing and legal basis

The personal data of the interested party are processed for the following purposes:

1. reply to contact or information requests from Data Subjects received through interaction with the “Contacts” section, or through the Controller’s contact addresses on the Site. In this regard, it is specified that personal data that are not strictly necessary for the pursuit of the purpose will not be processed by the Data Controller. It will not be treated in any way, and therefore the interested party is invited not to communicate any data belonging to the particular categories of data as identified by current legislation (data suitable for revealing racial and ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organizations of a religious nature, philosophical, political or trade union, as well as relating to the state of health and sexual life of the interested party);
2. enable the Data Subject’s participation in competitions or prize operations promoted, from time to time, by the Controller, by managing and executing all measures (pre-contractual and/or contractual) connected with participation in the aforesaid competitions (including the prize allocation stage);
3. optimize the operation of the Site and allow the use of services and features present in the same also through the use of technical cookies, as better specified in the Cookie Policy;
4. exclusively subject to the specific and separate consent of the Data Subject, to periodically send advertising, promotional and/or commercial material, including newsletters, relating to the products offered and/or promotional and sales initiatives promoted by the Data Controller. This may take place both through traditional contact systems (Telephone/Smartphone) and through electronic communications (e-mail);
5. reply to contact or information requests from Data Subjects received through interaction with the “Adverse Drug Reaction” section, or through the Controller’s contact addresses on the Site. In this regard, it is specified that personal data that are not strictly necessary for the pursuit of the purpose will not be processed by the Data Controller.
6. fulfill the obligations established by laws and regulations to which the Data Controller is subject and/or execute orders of Authorities entitled to do so. 

   The legal basis justifying the processing is:

   • for the purposes referred to in sub a); b) and c) the execution of pre-contractual measures adopted at the request of the interested party and/or the execution of the contract in which the subject is party (art. 6, (i), lett. (b) Reg. UE 2016/679);
   • for the purposes referred to in sub d) the specific consent to receive advertising, promotional and/or commercial material, including newsletters, relating to the products offered and/or promotional and sales initiatives promoted by the Data Controller (art. 6, (i), lett. (a) Reg. UE 2016/679);
   • the legitimate interest of the Data Controller (art. 6, (i), lett. (f) Reg. UE 2016/679);
   • for the purposes to in sub e) f) from the fulfillment of a legal obligation to which the Data Controller is subject (art. 6, (i), lett. (c) Reg. UE 2016/679).

   The provision of personal data marked with an asterisk, or otherwise indicated as mandatory in the forms available on the Site, is necessary so that the Data Controller can correctly and completely perform the services requested by the interested party and / or correctly comply with legal or regulatory obligations.

Consensus

The data subject has the right to revoke, at any time, any consent given in whole and/or in part, deciding, for example, to receive only communications by traditional means of contact (telephone/Smartphone) or only by electronic communications (e-mail) or not to receive any communication at all. Any withdrawal of consent will not affect the lawfulness of the processing based on the consent given before the withdrawal.
To revoke consent, the Data Subject may at any time contact the Data Controller at the addresses published in this notice.

Processing Methods

The processing of personal data takes place using manual, computerized and telematic tools with logic strictly related to the purposes declared in this document and, in any case, in order to guarantee the security and confidentiality of the data in accordance with current regulations.
In case of processing carried out with electronic processing methods, Giuliani may use third-party service companies that will be made aware of their responsibilities with a communication of appointment as Data Processor pursuant to art. 28 of the GDPR.

Data retention period

The data collected will be kept for a period of time not exceeding the achievement of the purposes for which they are processed (“storage limitation” art. 5 GDPR), without prejudice to cases of compliance with a legal obligation or an order of an Authority entitled to do so. The verification of the obsolescence of the data stored in relation to the purposes for which they were collected is carried out periodically. At the end of the retention period, personal data will be deleted, destroyed or made anonymous, without prejudice to any retention periods provided for by law.
Specifically:

• for personal data collected for marketing purposes (e.g. newsletter), the retention period will continue until the data subject revokes consent;
• for personal data collected using the form “Contact” provided by the website, the data retention period will be 6 months from the last interaction/communication;
• for personal data collected using the form “Adverse Drug Reaction” provided by the website, the data retention period will be XX from the last interaction/communication.

Therefore, at the end of this term the right of access, cancellation, rectification, and the right to data portability can no longer be exercised.

Categories of data subject to whom data may be communicated

The personal data of the interested party may be made accessible for the purposes described above:

• to employees and collaborators of the Data Controller, in their capacity as authorized persons to process and/or system administrators, within the scope of their respective duties and in accordance with the instructions received;
• to third party companies or other entities that perform activities functional to the management and administration of the Site (such as hosting companies; service providers, managers of electronic platforms and more generally IT service providers);
• to subjects carrying out tasks of a technical or organizational nature (provision of printing, enveloping, transmission, transport and sorting services for communications, or to third-party companies carrying out outsourced call center services);
• exclusively in the case of data collected for the purposes referred to in paragraph 4 letter c), the data may be disclosed to parties authorized to process the data (such as: notaries; chamber of commerce officials, etc.) or to providers of services necessary for the running of the prize competition (such as: prize providers; shippers; parties associated with the prize competition held, etc.);
• to all those entities entitled to access the data by virtue of laws or regulations (such as, for instance, public offices and authorities);
• to companies responsible for the internal control of the Data Controller on the basis of the laws and regulations in force on the subject.

These entities, bodies, companies will process the data of data subjects in their capacity as Data Processors duly designated by the Controller or, when relevant, as autonomous Data Controllers.
The complete and updated list of the persons appointed as Data Processors is kept at the registered office of the Data Controller.

Place of processing

The data will be processed by the Data Controller at its registered office located in Via Pelagio Palagi n. 2, 20129 – Milan (MI).

Transfer of personal data extra – EU

The personal data of the interested parties are stored on servers located at the registered office of the Data Controller, as well as at the headquarters of service companies within the European Union.
If, for technical and/or operational reasons, it is necessary to use subjects located outside the European Union, the transfer of personal data to such subjects will be regulated in accordance with the provisions of the GDPR. All the necessary precautions will therefore be taken in order to guarantee the total protection of personal data based on: a) on adequacy decisions of the recipient third countries expressed by the European Commission; b) on the provision of adequate guarantees to protect the interested party (by way of example, standard data protection clauses adopted by the European Commission or by a national supervisory authority, codes of conduct, ad hoc contractual clauses, etc.); c) on the specific conditions of derogation provided for by art. 49 of the GDPR including the explicit consent of the interested party.

Interaction with social networks and external platforms

The site, through widgets and buttons, may interact with external platforms and social networks. In this case, the information acquired depends on the settings of the profiles used by the user on each social network and not on the administrator of this site, especially if the user has the access profile to these platforms active.
Links with Facebook®, Youtube®, Twitter®, Instagram®, etc. allow you to interact with Giuliani’s pages on the social networks and share ideas, opinions or website topics with the respective social platforms and may collect data from the data subject.
We highlight that you may be able to access the Website or connect to areas and our blogs, which also contain shopping tips. In some cases, you may be enabled to post information, communicate with others, such as coming from Giuliani’s page on other social networking sites, view/review products and offers, and post comments or content.
Before interacting with these areas, please read the General Terms of Use carefully, keeping in mind that, under certain circumstances, the information you post may be viewed by anyone with access to the Internet, and any information you include in your postings may be read, collected, and used by third parties.
More information may be acquired from the sites of companies offering the service. Please note that in that case during such navigations your personal information is not managed by Giuliani, whose intervention is limited to making the link available through such buttons only to offer an additional service to the person concerned but has no control over them.

Data subjects’ rights

According to Articles. 15 et seq. of the GDPR, the interested party has the right to:

• request access to your personal data;
• request the updating, correction or integration of their personal data;
• revoke any consent eventually given.

The interested party also has the right, in certain circumstances, to:

• oppose the processing of their personal data;
• request the deletion of their personal data;
• restrict the processing of your personal data;
• request that your personal data be transmitted to him or transmitted to another data controller (data portability).

The interested party has in any case the right to lodge a complaint with the Supervisory Authority for the protection of personal data in the event that he considers that his personal data are processed in violation of Reg. (EU) 2016/679.

How to exercise data subject’s rights

The interested party may at any time exercise the rights attributed to him by sending a registered letter with return receipt addressed to “Giuliani S.p.A.”, Via Pelagio Palagi n. 2, 20129 – Milan (MI), or by sending an email to: giulianiprivacy@giulianipharma.com.

Data ultima modifica: 05/12/2023