1 Introduction and scope
Amafarmacia S.r.l. informs people who request information, book or use services at the Mortari and Peirano pharmacies about how their personal data are processed. This notice also covers registration, orders, rentals and communications, to the extent that those activities are actually available and used.
Sections concerning optional services or services that may be introduced in the future apply only when those services are activated and the data subject requests them or joins the relevant initiatives. Their inclusion does not mean that the service is active and does not authorise indiscriminate use of data. Before introducing processing activities not described here or new purposes, Amafarmacia provides the necessary information and obtains consent where required.
This notice concerns personal data relating to natural persons, including contacts and representatives of companies or organisations. “Processing” means any operation performed on personal data, with or without automated means, including collection, recording, consultation, use, disclosure to authorised recipients, storage and erasure.
Specific information provided for individual services, platforms or methods of delivering reports supplements this notice. This document does not replace the information on website browsing data and cookies, nor the privacy notices of third parties acting as independent data controllers.
External videos on Brand pages. Amafarmacia displays the previews itself: YouTube (youtube-nocookie.com) and Vimeo videos are not loaded until you press the “Watch brand video” button. After that click, your browser connects to the video provider, which may process technical information under its own privacy notice. You can read the Brand pages and open the brands’ official links without playing any video.
2 Data controller and contact details
The data controller is Amafarmacia S.r.l., registered office at Via Della Pace 29, 37069 Villafranca di Verona (VR), VAT number 05004940234.
Legal representative: Francesco Condoleo Mortari.
PEC: pec@pec.amafarmacia.it. Website: www.amafarmacia.it.
For enquiries concerning data processing and to exercise your rights, you may contact the data controller using the methods described in section 11, including through the Mortari and Peirano pharmacies.
3 Data processing principles
Amafarmacia processes personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability, pursuant to Article 5 GDPR.
Only data that are relevant and necessary for the relevant service or purpose are requested and used.
4 Types of data and whether provision is required
Depending on the service used, we may process identity and contact data such as first name, surname, address, email, telephone number and, where necessary, Italian tax code; data relating to bookings, requests, orders, rentals and support; billing data and information necessary to manage and verify payments.
Payment data are processed only to the extent required by the chosen payment method and the information actually received by the pharmacy. Where payment is handled by an external provider, data entered directly on that provider’s platform are processed according to the applicable roles and privacy information; not all card details are necessarily disclosed to Amafarmacia.
For healthcare services, strictly necessary health data may be processed, such as information about the service requested, blood glucose and blood pressure values, ECG or Holter reports and swab test results. The type of service booked or device requested may itself reveal health information.
For newsletters, marketing and profiling, contact details, preferences and consent information are processed within the limits described in section 6. Health data and data from which health conditions may be inferred are not used for the commercial profiling described in this notice.
Provision of the data necessary to respond to a request or provide a service is required for those purposes: failure to provide them may prevent the request from being handled, a booking from being made or the service from being provided. Data required by law must be supplied where the relevant obligation applies. Optional fields, where present, are distinguished from required fields in forms or at the time of collection.
Subscription to newsletters and participation in marketing or profiling are optional. Refusal or withdrawal of consent does not affect access to ordinary services. For requests concerning minors or submitted through an authorised representative, data necessary to verify representation or authorisation and protect the data subject may be collected.
5 How data are collected
Data are collected directly from the data subject in the pharmacy, through the pharmacy’s contact channels or through available online functions, for example when making an enquiry, booking, placing an order or registering.
Data may also be received through representatives or authorised persons and through booking, payment or service-delivery platforms, within the limits of the assignment and the actual role performed by each party. Providers processing data on behalf of Amafarmacia are appointed as processors pursuant to Article 28 GDPR; independent controllers provide their own privacy notices.
Where data are not obtained directly from the data subject and Article 14 GDPR applies, Amafarmacia also provides information on the categories of data and the specific source from which they originate, indicating whether the source is publicly accessible. The information is provided within a reasonable period, in any event no later than one month, or at the latest at the time of the first communication with the data subject or first disclosure to another recipient, if earlier, subject to the exceptions provided by law.
Smart “How can I help you?” search (Omnibox). The initial classification of the text you type, autocomplete and recognition of topics, services and brands take place in your browser using a static Amafarmacia index. The text is not placed in the URL, stored by the function in localStorage, sessionStorage or cookies, or sent to external services while you type. Health-related text entered in the function is not used for profiling or marketing.
To recognise a possible medicine or active-ingredient name, only after the user explicitly submits the search may the Omnibox send the text in a POST request to the Amafarmacia server, where it is compared with a local index derived from AIFA Open Data. This request is not made while typing or during autocomplete. The text is not sent to AIFA, does not appear in the URL and the function does not create a search history. Recognition identifies the name only and does not assess suitability, dose, interactions or personal treatment.
When the search proposes an external contact, for example with a pharmacist, the handoff happens only after an explicit action by the user. Health-related text typed in the Omnibox is not automatically transferred to WhatsApp or other third parties: the user chooses what information to communicate in the next channel.
6 Purposes of processing and legal bases
The purposes listed below apply only to activities that are actually carried out. The legal basis is identified in relation to each specific purpose; consent for optional activities is separate from management of the requested service.
6.1 Enquiries, bookings and services
Management of pre-contractual enquiries, bookings, customer support, payments and performance of requested services. Legal basis for contractual management: Article 6(1)(b) GDPR. Tax and accounting obligations are addressed in section 6.4.
Depending on location availability and applicable eligibility requirements, services may include 24-hour blood pressure monitoring, ECG, 24- or 48-hour Holter ECG monitoring, capillary blood testing, plethysmography, bone-density assessment (MOC), swab tests, vaccinations, hearing checks, nutritional or pharmaceutical consultations, hair/scalp analysis, facial skin analysis, personalised make-up and ear-lobe piercing.
For health data necessary for preventive medicine, diagnosis, healthcare or treatment, Article 9(2)(h) GDPR also applies, subject to paragraph 3 of that Article and applicable national provisions, with processing carried out by or under the responsibility of professionals subject to professional secrecy or other persons bound by a statutory duty of confidentiality.
The healthcare legal basis does not automatically apply to cosmetic or commercial services. For any further healthcare processing that does not fall within the basis described above, specific information is provided on the purpose and the applicable alternative basis before data are collected. Any clinical consents and consents required for particular reporting methods remain separate.
Additional services may fall within this section where the purposes and characteristics of processing are already described; otherwise, this notice is supplemented before such processing begins.
6.2 Registration and order fulfilment
Where available, creation and management of the requested account, receipt and fulfilment of orders, and sending related confirmation, update or support messages. Legal basis: Article 6(1)(b) GDPR.
These communications are limited to managing the requested relationship. Promotional communications are governed by sections 6.3, 6.6 and 6.8. Any processing of health data necessary for a service follows section 6.1 and any applicable service-specific information.
6.3 Newsletter by request
Sending newsletters containing information, news and initiatives relating to the pharmacies and their services, where the service is active and the data subject subscribes voluntarily. Legal basis: Article 6(1)(a) GDPR, in compliance with Article 130 of the Italian Privacy Code for promotional communications.
Consent is optional, can be documented and may be withdrawn at any time using the unsubscribe link in communications or by contacting the controller. Newsletter subscription does not imply consent to profiling.
6.4 Legal obligations
Compliance with applicable tax, accounting, pharmacovigilance and other legal obligations, and response to lawful requests from competent authorities. Legal basis: Article 6(1)(c) GDPR.
Where compliance involves health data, processing also relies on the relevant basis under Article 9 GDPR provided for by the rules governing the specific obligation; for pharmacovigilance, where applicable, Article 9(2)(i) concerning public health is relevant. Only data that are required and pertinent are disclosed.
6.5 Service analysis and improvement
Assessment of service quality and management of feedback and reports. Statistics are produced in aggregated and genuinely anonymous form where identification is not necessary; data that are merely pseudonymised remain personal data.
For non-promotional organisational analysis involving ordinary personal data, limited to what is necessary and preceded by a documented assessment of necessity and balancing of interests, the legal basis is Article 6(1)(f) GDPR. The legitimate interest pursued is to assess and improve the quality of support and organisation of services. The data subject may object as described in section 11.
This legal basis does not by itself authorise processing of health data. Electronic invitations to reviews, questionnaires or market research of a promotional nature are handled under the consent described in section 6.8. Identifiable responses are not published as testimonials without a separate legal basis and appropriate information.
6.6 Communications about similar products or services
Within the limits of Article 130(4) of the Italian Privacy Code, Amafarmacia may use an email address provided in the context of a sale to offer its own products or services similar to those purchased, provided the data subject has been informed and has not objected. A simple enquiry or booking, without a sale, is not sufficient.
Legal basis: Article 6(1)(f) GDPR, based on the interest in promoting the controller’s own similar products and services within the customer relationship and in compliance with the specific statutory exception. This use may be refused at the time of collection and objected to free of charge and easily in every subsequent email.
This rule applies only to email and does not extend to SMS or messaging. It does not authorise use of medical history or information revealing health status to select recipients of promotions.
6.7 Establishment, exercise or defence of legal claims
Establishment, exercise or defence of legal claims in judicial or out-of-court proceedings, limited to data necessary in relation to the dispute. Legal basis: Article 6(1)(f) GDPR, based on the controller’s interest in protecting its rights. Article 9(2)(f) GDPR also applies to strictly necessary health data.
6.8 Promotional activities and marketing
With prior consent, sending commercial communications, offers of gifts or discounts and invitations to market research by email, SMS, messaging, telephone or post, within the channels described at the time of consent. Legal basis: Article 6(1)(a) GDPR, in compliance with provisions applicable to the channel used, including Article 130 of the Italian Privacy Code.
Consent is freely given, specific, informed, capable of being documented and separate from any consent to profiling. It may be withdrawn at any time by simple means, without affecting requested services. Health data are not used for the promotional activities described in this section.
Any disclosure of data to third parties for their own independent promotional purposes requires separate information and specific consent; it is not authorised merely by consenting to Amafarmacia marketing.
6.9 Equipment rental
Management of the rental request and agreement, delivery, return, payments and support. Legal basis: Article 6(1)(b) GDPR, without prejudice to the obligations described in section 6.4.
If information necessary for the rental reveals health status, the relevant basis under Article 9 GDPR is also identified. Article 9(2)(h) applies only where the processing actually falls within healthcare and the relevant conditions are met; in other cases, specific information is provided before collection.
6.10 Profiling of commercial preferences
Where activated and subject to separate consent, analysis of declared commercial preferences and purchases of non-health products that do not reveal health conditions, in order to group interests and personalise offers. Medical reports, healthcare services, purchases of medicines and other data capable of revealing health status are excluded.
Legal basis: Article 6(1)(a) GDPR. Profiling is optional; refusal or withdrawal does not restrict purchases or access to services. Sending offers through different channels remains subject to the legal basis applicable to that communication.
Before consent is given, the data actually used and the personalisation methods are explained. This activity is used to select relevant commercial content and does not result in decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.
7 How data are processed
Processing is carried out using IT, electronic and paper-based tools, with technical and organisational measures appropriate to the risk and designed to protect confidentiality, integrity, availability and resilience, pursuant to Article 32 GDPR.
Access is limited to authorised persons according to their duties and the purposes involved. Relevant service information is made available when external calendars and platforms are used. Data subjects are asked not to transmit reports or additional health data through channels not intended for their collection.
8 Recipients of the data
Within the purposes described, data may be accessed by employees and collaborators authorised and instructed by the controller; hosting, IT maintenance, cloud, booking and other service providers acting on its behalf and appointed as processors under Article 28 GDPR; and healthcare professionals, advisers and payment service providers who, depending on the activities actually performed, may act as processors or independent controllers.
Data may also be disclosed to public authorities, healthcare bodies, supervisory bodies and law-enforcement authorities where required by law, as well as to parties necessary for the protection of rights within the limits of section 6.7. Any joint-controller arrangements are governed by Article 26 GDPR, with the essence of the arrangement made available to data subjects.
Personal data are not disseminated as part of the activities described here. Service providers do not acquire, merely by virtue of their appointment, the right to use data for their own advertising purposes. Information on recipients and their respective roles may be requested from the controller.
9 Transfers outside the European Economic Area
Any use of providers or sub-processors located outside the European Economic Area, or access to data by such parties, is subject to compliance with Chapter V GDPR.
Transfers may take place on the basis of a European Commission adequacy decision applicable to the recipient under Article 45, or subject to appropriate safeguards under Article 46, such as Standard Contractual Clauses, together with the necessary assessments and any supplementary measures. The derogations under Article 49 may be used only where their specific conditions are met.
Before collection or introduction of such a transfer, information on destinations, the legal mechanism and applicable safeguards is made available in this notice or in supplementary service information. Information and a copy of relevant safeguards may be requested from the controller. An adequacy decision or valid safeguard does not in itself require additional consent to the transfer.
10 Retention periods
Personal data will be retained for the time necessary to provide the requested services and for the purposes for which they were collected. They may also be retained thereafter to ensure compliance with national law, prevent fraud, collect any amounts due, handle disputes, resolve issues, provide assistance in investigations and take other actions where permitted by applicable national law. Contractual and tax data: 10 years. Inactive account: 10 years from last access. Newsletter: 2 years from the last interaction. Customer Satisfaction: 24 months from the last purchase or booking. Soft spam: 24 months from the previous purchase. Marketing and profiling: 24 months (marketing) / 12 months (profiling) from collection or the last interaction, unless consent is withdrawn.
Once the relevant period has expired, data will be erased or anonymised.
11 Data subject rights and how to exercise them
In the cases and within the limits provided by Articles 15 to 22 GDPR, the data subject may obtain confirmation as to whether data are being processed, access the data and receive a copy, and request rectification of inaccurate data and completion of incomplete data.
Erasure may be requested where the conditions of Article 17 are met, for example where data are no longer necessary, have been unlawfully processed, or consent is withdrawn and no other legal basis applies. Statutory exceptions remain applicable, including retention obligations and the protection of legal rights.
Restriction of processing may be obtained in the cases set out in Article 18: where accuracy is contested for the period necessary to verify it; where processing is unlawful and erasure is opposed; where data are needed by the data subject for the establishment, exercise or defence of legal claims even though the controller no longer needs them; or following an objection pending verification of whether the controller’s grounds override those of the data subject.
The data subject may object to processing based on legitimate interests on grounds relating to their particular situation. In that event, the controller will cease processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims. Objection to direct marketing, including related profiling, may be exercised at any time without giving reasons and results in processing for those purposes ceasing.
For data provided by the data subject and processed by automated means on the basis of consent or a contract, the right to data portability may be exercised under Article 20: the data may be received in a structured, commonly used and machine-readable format and transmitted to another controller; direct transmission is carried out where technically feasible and without adversely affecting the rights and freedoms of others.
Consent may be withdrawn at any time as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not require erasure of data that must be retained on another lawful basis.
Requests may be submitted without particular formalities to the controller identified in section 2, including in person at the pharmacies, by ordinary post to the registered office or by certified email (PEC) to pec@pec.amafarmacia.it. Newsletter and promotional messages include an unsubscribe link or other opt-out mechanism. Use of certified email or registered post is not mandatory. Additional identifying information is requested only where there are reasonable doubts about identity and only to the extent necessary.
A response is provided without undue delay, normally within one month of receipt. Where permitted, this period may be extended by a further two months, provided the data subject is informed within the first month and reasons for the extension are given. Requests are free of charge, except in the manifestly unfounded or excessive cases provided for by Article 12 GDPR.
A complaint may be lodged with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures published on its website ↗, and the competent courts may also be contacted.
12 Automated decision-making
Within the activities described, no decisions are made based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them. Any commercial personalisation described in section 6.10 does not have such effects.
The Omnibox may classify a request to propose an informational or organisational destination — for example general information, a service, a brand, contact with a pharmacist, or an indication that professional health assessment is needed. This classification does not diagnose, interpret personal reports or values, decide treatments or doses, or replace assessment by a healthcare professional.
If processing falling within Article 22 GDPR is introduced, the applicable conditions will be verified before it begins and meaningful information will be provided about the logic involved, significance and envisaged consequences. Required safeguards will be ensured, including, where relevant, human intervention, the opportunity to express a point of view and to contest the decision; for special categories of data, the restrictions in Article 22(4) also apply.
13 Changes to this notice
This notice may be updated in response to legal, organisational or service changes. The updated version is made available on the website with its date. Material changes are communicated to data subjects in a manner appropriate to the relationship and processing concerned.
Before using data already collected for a different purpose, Amafarmacia provides the additional information required by Articles 13(3) and 14(4) GDPR, verifies the applicable legal basis and obtains new consent where necessary. Publication of an update alone does not constitute consent.
14 Legal references and useful links
Regulation (EU) 2016/679 — EUR-Lex ↗
Italian Legislative Decree No. 196 of 30 June 2003, Personal Data Protection Code, as subsequently amended and supplemented, including Article 130 on unsolicited communications.