Privacy Policy

Who is responsible

The data controller is Antica Erboristeria Salus, the trader who operates the website anticaerboristeriasalus.com and its online shop. You can reach us at info@anticaerboristeriasalus.com for anything concerning your personal data: requests, questions, complaints and objections all go to that address, and they are handled by the people responsible for the shop.

We have assessed our processing operations against Art. 37 of the Regulation. We do not carry out large-scale monitoring or process special categories of data on a large scale, so we are not required to appoint a Data Protection Officer; the controller answers directly for the matters described here.

Scope of this policy

This policy covers the website anticaerboristeriasalus.com, its online shop, the customer service channels published on the site, and the newsletter. It applies whether you buy something, register an account, or simply read a page.

It does not cover other websites you may reach through links on our pages. Once you leave our domain, the policy of that site applies, and we have no control over what it does with your data.

Data we collect

Data you give us

• Identity and contact details — first and last name, email address, telephone number, billing and delivery address, and, where invoicing requires it, tax code or VAT number.
• Order details — the products you buy, quantities, order value, delivery preferences, and correspondence relating to the order.
• Account details — username, password stored in hashed form, saved addresses, order history, wishlist.
• Communications — messages sent through the contact form, by email, by telephone or through social channels, including anything you choose to write in them.
• Reviews and published content — ratings, product reviews and comments you decide to publish.

Data collected automatically

• Technical data — IP address, browser type and version, operating system, device type, screen resolution, language settings.
• Usage data — pages viewed, time spent, referring address, searches made on the site, clicks, cart activity.
• Cookie identifiers — described in section 06 and, in full detail, in the Cookie Policy.

Data from other sources

• Payment authorisation results and anti-fraud outcomes from the payment institutions that process your payment. We never receive or store your full card number.
• Delivery status and proof of delivery from the carrier handling your parcel.
• Aggregate audience statistics from the measurement tools installed on the site, where you have consented to them.

Purposes and legal bases

We process personal data only where Art. 6 of the Regulation gives us a lawful basis. Each purpose is listed below with the data it involves and the basis we rely on.

Where the basis is legitimate interest we have carried out a balancing test and concluded that our interest in running a secure shop does not override your rights and freedoms. You may ask for a summary of that assessment, and you may object to the processing at any time under Art. 21.

Health-related information

We do not ask for health data and we do not need it to sell you anything. If you spontaneously mention a condition, an allergy, a pregnancy or a medication while asking for advice, that information falls under Art. 9 of the Regulation. We use it for the sole purpose of answering you, on the basis of the explicit consent you give by sending the message, we do not record it in your customer profile, and we delete it once the exchange is closed.

Cookies and tracking

Technical cookies are set as soon as you arrive, because the cart, the checkout and the login cannot work without them. Everything else — preference, measurement and advertising cookies — is installed only after you accept that category in the consent banner. Refusing takes exactly as many clicks as accepting, and closing the banner or continuing to scroll is never treated as consent.

Your choice is stored for up to six months, after which we ask again, and you can review or withdraw it at any moment from the cookie settings link published on the site. The complete list of cookies, with categories, purposes and durations, is set out in the Cookie Policy.

How long we keep data

When a period expires the data is deleted or irreversibly anonymised, so that it can no longer be traced back to you.

Who we share data with

We do not sell personal data, and we do not disclose it for anyone else's marketing. Data is shared only with parties who need it to deliver what you asked for, always under a written agreement pursuant to Art. 28 of the Regulation where they act on our instructions.

The current list of the specific suppliers acting as processors is available on request at info@anticaerboristeriasalus.com.

Transfers outside the EEA

We choose suppliers who keep data inside the European Economic Area whenever that option exists. Where a supplier processes data in a third country, the transfer takes place only under one of the safeguards of Chapter V of the Regulation: an adequacy decision of the European Commission, the Standard Contractual Clauses adopted by the Commission together with any supplementary technical and organisational measures, binding corporate rules, or another mechanism expressly permitted.

You may ask us which safeguard covers a specific transfer and obtain a copy of the relevant documentation, with commercially confidential passages redacted.

Security measures

Under Art. 32 of the Regulation we apply technical and organisational measures proportionate to the risk: encrypted connections across the whole site, passwords stored as salted hashes, access to the back office limited by role and protected by strong authentication, regular updates of the platform and its components, encrypted and periodically tested backups, segregation of production and test environments, and confidentiality undertakings for everyone authorised to process data on our behalf.

No system can be declared immune. Should a breach occur that is likely to result in a risk to your rights, we notify the supervisory authority within 72 hours as required by Art. 33 and, where the risk is high, we inform you directly and without undue delay under Art. 34, describing what happened and what you can do about it.

Marketing and consent

The newsletter reaches only those who asked for it. Consent is given by ticking a box that is never pre-ticked and, where double opt-in applies, by confirming through the link we send by email; we keep a record of when and how it was given. Every message carries a working unsubscribe link, and unsubscribing takes effect at once, without any explanation being required.

If you have already bought from us, we may write to you about products similar to those you purchased, relying on Art. 130(4) of the Privacy Code. You can refuse this both at the moment we collect your address and in each message we send, and refusing has no effect on your orders or on any right described here.

Profiling and automated decisions

We take no decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. Prices are the same for everyone and are not adjusted according to your device, your location or your browsing history.

Where you have accepted advertising cookies, your activity may be used to form interest segments and show you more relevant content. That is profiling connected to direct marketing, and Art. 21(2) lets you stop it at any time, unconditionally, through the cookie settings or by writing to us.

Children

The shop is intended for adults. In relation to information society services offered directly to a child, Art. 8 of the Regulation together with Art. 2-quinquies of the Privacy Code sets the age of consent in Italy at 14 years. We do not knowingly collect data from anyone below that age, and orders may be placed only by persons of full legal capacity. If you believe a minor has provided us with personal data, write to us and we will erase it promptly.

Your rights under the GDPR

Regulation (EU) 2016/679 gives you a set of rights over your personal data. They apply to every processing operation described in this document, they are free of charge, and you never have to explain why you are exercising them.

• Art. 15

  AccessObtain confirmation that we process data about you, receive a copy of it, and be told the purposes, the categories involved, the recipients, the retention period, the source, and whether automated decision-making takes place.

• Art. 16

  RectificationHave inaccurate data corrected and incomplete data completed, including by adding a supplementary statement.

• Art. 17

  ErasureHave your data deleted where it is no longer necessary, where you withdraw the consent it was based on, where you object successfully, where it was processed unlawfully, or where a legal obligation requires deletion.

• Art. 18

  RestrictionHave processing frozen while accuracy is being verified, in place of erasure where processing is unlawful, or while an objection is being assessed.

• Art. 19

  NotificationHave every recipient of your data informed of any rectification, erasure or restriction, and be told who those recipients are.

• Art. 20

  PortabilityReceive the data you provided, where processing is based on consent or on a contract and is carried out by automated means, in a structured, commonly used, machine-readable format, and have it transmitted directly to another controller where technically feasible.

• Art. 21

  ObjectionObject at any time, on grounds relating to your situation, to processing based on legitimate interest. Where you object to direct marketing, including any profiling connected to it, processing stops immediately and unconditionally.

• Art. 22

  Automated decisionsNot be subject to a decision producing legal effects or similarly significant effects based solely on automated processing, and where such processing is permitted, obtain human intervention, express your point of view and contest the decision.

• Art. 7(3)

  Withdrawal of consentWithdraw consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.

• Art. 77

  ComplaintLodge a complaint with a supervisory authority, in the country where you live, where you work, or where the alleged infringement took place.

• Art. 79

  Judicial remedyBring proceedings before a court against a controller or processor, independently of any administrative complaint.

• Art. 82

  CompensationReceive compensation for material or non-material damage suffered as a result of an infringement of the Regulation.

How to exercise them

Send a request to info@anticaerboristeriasalus.com, stating which right you wish to exercise. If we have reasonable doubts about who is asking, we may request further information to confirm your identity, and we ask for nothing beyond what is needed for that purpose.

We reply without undue delay and in any case within one month of receiving the request. That period may be extended by two further months where the request is complex or where several requests are pending, in which case we tell you within the first month and explain why. If we cannot act on a request, we tell you the reason and remind you of your right to complain to a supervisory authority and to seek a judicial remedy.

Supervisory authority

In Italy the supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it. If you live or work in another Member State you may address the authority of that country instead. Complaining costs you nothing and does not prevent you from also going to court.

Your rights as a consumer

If you buy from this website for purposes outside your trade, business, craft or profession, you are a consumer under Art. 3 of Italian Legislative Decree 206/2005, the Consumer Code, which implements Directives 2011/83/EU and (EU) 2019/771. The rights below are mandatory: they apply automatically, no clause can reduce them, and any waiver you might sign is void.

• Art. 49

  Clear information before you buyReceive, before being bound, the main characteristics of the goods, the identity of the trader, the total price including taxes and all delivery charges, the payment and delivery arrangements, the conditions of the right of withdrawal, and the existence of the legal guarantee of conformity.

• Art. 51

  Confirmation on a durable mediumHave the button that concludes the order clearly labelled with the obligation to pay, and receive confirmation of the contract, including these terms, on a durable medium within a reasonable time after the order.

• Art. 52

  Fourteen days to change your mindWithdraw from a distance contract within 14 days of receiving the goods, without giving any reason and without penalty, save for the exceptions listed in Art. 59.

• Art. 53

  Extended period if not informedIf you were not told about the right of withdrawal, the period runs for a further 12 months; if the information arrives during those 12 months, the 14 days start from the day it is received.

• Art. 56

  Refund within 14 daysBe reimbursed for everything paid, including standard delivery costs, within 14 days of the withdrawal notice, using the same means of payment you used, with no fee charged for the refund.

• Art. 61

  Delivery within 30 daysReceive the goods without undue delay and in any case within 30 days of the conclusion of the contract; if that deadline passes, set an additional reasonable period and, if it also passes, terminate the contract and be refunded in full.

• Art. 63

  Risk passes on deliveryBear no risk of loss or damage in transit: risk passes to you only when you, or a third party you designated other than the carrier, take physical possession of the goods.

• Art. 64

  Support at basic rateContact the trader about the contract on a telephone line that costs no more than the basic rate.

• Art. 65

  No hidden extrasOwe nothing for additional payments that were not expressly agreed by you: pre-ticked boxes never count as consent, and any sum charged that way is repaid.

• Artt. 128–135-septies

  Two-year legal guaranteeHold the seller liable for any lack of conformity existing at delivery and appearing within two years, with the right to repair or replacement free of charge and, where those are impossible, disproportionate or not provided in reasonable time, to a proportionate price reduction or termination of the contract. During the first year the defect is presumed to have existed at delivery. The action is time-barred 26 months after delivery.

• Artt. 33–38

  No unfair termsBe free of clauses that, contrary to good faith, create a significant imbalance to your detriment: such clauses are void, while the rest of the contract continues to bind the trader. Ambiguous wording is always interpreted in your favour.

• Art. 66-quinquies

  Unsolicited goodsOwe nothing for goods supplied without being ordered; your silence is never consent.

• Art. 66-bis

  Your local courtBring or defend proceedings before the court of your own place of residence or domicile, if located in Italy; any clause pointing elsewhere is void.

• Artt. 141 ss.

  Out-of-court resolutionUse an alternative dispute resolution body, or the European online dispute resolution platform, to settle a dispute without going to court. Taking that route is voluntary and never removes your right to judicial protection.

Changes to this policy

We update this policy when our services, our suppliers or the applicable rules change. The version in force is always the one published on this page, identified by the date shown at the top. Where a change materially affects how we use your data, we announce it by email or through a notice on the site before it takes effect, and where the law requires it we ask for your consent again.