Browsing Privacy Notice

WEBSITE BROWSING PRIVACY NOTICE

Provided pursuant to art. 13 of Regulation 2016/679 (“Regulation”)

V025Omni_2026/10. Published 22/10/2026

1 INTRODUCTION – WHAT ACTIVITIES DOES THIS NOTICE COVER?

This notice describes the general methods of processing the personal data of users who browse within the website (“Site”). For a detailed description of the cookies and other markers active on the Site, the user is invited to read the Cookie Policy, accessible from the banner displayed on first access to the Site or from the footer of each page of the Site.

Use of tracking pixels in e-mails

E-mail communications sent by L’Erbolario may contain tools called tracking pixels, consisting of images of small size, generally not visible to the recipient, which, when downloaded, may make it possible to detect certain information relating to the interaction with the message, such as whether it has been opened, the date and time of the same, the type of device used and other technical information relating to the consultation of the communication. For example, whether the message has been opened, the date and time of opening, the type of device used or other types of information relating to the consultation of the message. The use of such tracking tools may concern both commercial and promotional communications (e.g. newsletter) and those more properly transactional or of an institutional and informational nature.

Pixels that do not require the consent of the data subject

Tracking pixels may be used without the consent of the data subject in the cases provided for by applicable law and, in particular, where their use is necessary for specific security needs, also connected with the authentication of the user, or in order to verify that the data subject has become aware of service communications which L’Erbolario is required to send to them.

These communications may include, for example, those relating to the confirmation of account activation, the management of access credentials, the confirmation of operations carried out by the user, contractual amendments, deadlines and compliance obligations or other service information for which it is relevant to verify that the message has been brought to the recipient’s knowledge.

Tracking pixels may also be used, in the permitted cases, to process aggregate statistics on the opening of communications, also for the purpose of improving the correct delivery of e-mails and countering spam, provided that suitable measures are adopted to prevent individual tracking of recipients.

Pixels that require the consent of the data subject

Outside the cases described above, the use of tracking pixels requires the consent of the data subject. In particular, the use of such tools in commercial communications for the purposes of measuring and statistically analysing the effectiveness of communications (open and click rates) and of improving promotional campaigns, as well as the methods of managing the relevant consent, are described in the privacy notice relating to the processing of personal data for marketing purposes, available in the “Privacy” section of the Site.

The user may, in any case, prevent the loading of tracking pixels by disabling, in the settings of their e-mail programme or service, the automatic download of external images or by choosing, where available, the display of messages in plain text format only.

2. DATA CONTROLLER AND DATA OF THE DATA PROTECTION OFFICER (“DPO”)

The data controller is L’Erbolario Società Benefit s.r.l., with registered office in Viale Milano 74, 26900 Lodi, VAT No. and Tax Code info@erbolariocare.shop (“L’Erbolario” or “Controller”).
The Controller has appointed the data protection officer (“DPO”) pursuant to art. 37 of the Regulation, who can be reached at the following address info@erbolariocare.shop.

3. PURPOSES OF THE PROCESSING, PERSONAL DATA PROCESSED, DATA RETENTION PERIOD

3.1 BROWSING AND SECURITY OF THE SITE

Purposes: L’Erbolario will process the personal data of users who browse the Site in order to allow the correct display of the pages of the Site and, in general, to allow the use of the contents online.
Further processing may be carried out in order to:

• ensure IT security, the prevention of abuse or the management of operating anomalies and
• obtain statistical information on the use of the Site (for example number of accesses, most visited pages, traffic time slots), in order to improve the quality of the services offered.

Categories of data processed: the data processed consist of browsing data, whose transmission is implicit in the use of Internet communication protocols. This category includes, by way of example:

• IP addresses of the devices used by users;
• URI/URL addresses of the resources requested;
• date and time of the request;
• numeric code indicating the status of the server response (for example positive outcome, error, etc.);
• other parameters relating to the operating system and the IT environment of the user.

While browsing, the user is free to provide personal data for the use of the services of the Site (e.g. request to customer service, registration on the Site, subscription to the newsletter). In these cases, in the sections of the Site of interest (e.g. subscription to the newsletter, customer service request form), the user will find the specific notices on the processing of their personal data, always and in any case accessible in the “Privacy” section of the Site.

Legal basis: the legal basis legitimising the processing described above is:

• the performance of the contract or, depending on the case, the implementation of pre-contractual measures adopted at the request of the data subject (art. 6.1.b) of the Regulation), limited to the processing of browsing data necessary to allow the user to access the Site and to use the publicly available contents;
• the legitimate interest of the Controller, pursuant to art. 6.1 f) of the Regulation, limited to the processing of data carried out to ensure the security and integrity of the Site, to prevent abuse or malfunctions and to obtain statistics on the use of the service.

Nature of the provision of data: the provision of browsing data is necessary to allow consultation of the Site and takes place automatically during the use of Internet protocols. The processing based on the legitimate interest of the Controller has been assessed as proportionate and not detrimental to the rights of users, as it is intended to ensure the security of the Site, prevent abuse and allow the Controller to carry out activities strictly connected with browsing such as obtaining statistics on the use of the site for the purposes of improving it.

Data retention period: the personal data will be processed for the time strictly necessary to ensure the protection and the correct provision of the services. Technical and security logs are retained for a maximum period of 12 months, without prejudice to the need for further retention connected with investigations into IT incidents or unlawful acts.

3.2 EXERCISE OR DEFENCE OF A RIGHT

Purposes: the Controller may process the personal data collected during browsing in order to establish, exercise or defend a right of its own before the courts as well as in the event of disputes relating to the use of the Site.
Categories of data processed: technical or browsing data possibly necessary for this purpose (e.g. system logs, IP addresses or information related to accesses to the Site).

Legal basis: The processing is based on the legitimate interest of the Controller pursuant to art. 6, para. 1, lett. f) of the Regulation. It constitutes a legitimate interest of the Controller to avail itself of remedies in order to demonstrate that it has fulfilled its obligations to ensure the security and correct operation of the Site as well as to prevent and defend itself against fraudulent activities or abuse. The user has in any case the right to object, at any time and for reasons connected with their personal situation, to the processing of personal data carried out for the purposes indicated above (i.e. defence of a right or purposes of justice), by contacting L’Erbolario at the contact details indicated in art. 6.

Retention period: the personal data will be processed in accordance with the provisions of the rules on limitation periods with reference to wrongs of a contractual and/or non-contractual nature.

4. RECIPIENTS OF THE PERSONAL DATA

The personal data described in art. 3 above may be communicated to third parties which provide services in favour of the Controller and are specifically appointed by the latter pursuant to art. 28 of the Regulation as well as to employees and/or collaborators of the Controller, duly authorised and instructed, pursuant to art. 29 of the Regulation. A list of the categories of recipients is provided below:

• companies or consultants in charge of the installation and/or supply and, in general, of the management of the hardware and software used by L’Erbolario for the activities described in this notice;
• natural and/or legal persons (legal, administrative and tax consulting firms), where the communication is necessary or functional to the correct fulfilment of contractual obligations as well as of obligations deriving from the law or in the case of establishment, exercise or defence of a right.

Finally, the personal data may also be processed by parties acting as autonomous data controllers such as:

• Shopify International Ltd., with registered office in Ireland, owner of the technological platform that hosts the Site, may process the personal data of users as an autonomous data controller for purposes connected with the technical and operational management of the platform, the maintenance of security and the operation of the services offered through the Site. Such processing may concern, among other things, technical connection and browsing data (such as IP addresses, information on the browser and on the device used, date and time of the connection, URLs visited and other system logs generated by the infrastructure), collected automatically during the use of the Site. The data are processed by Shopify in compliance with its own security standards and internal log retention policies, exclusively for the purposes indicated above and for the time necessary to ensure their correct technical management. For more information on the methods of processing of data by Shopify, it is possible to consult the relevant privacy notice available at the following link: https://www.shopify.com/it/legal/privacy/consumers

The list of recipients of the personal data is available from the Controller.

5. TRANSFER OF DATA TO THIRD COUNTRIES

The personal data are processed with IT tools of which L’Erbolario is a licensee or, in any case, under a specific contract. The providers of such tools and/or of the services provided through the Site are based in the European Union. However, the management and/or maintenance of the IT tools and/or the provision of certain services may entail the need for personal data to be transferred also outside the European Union. In such a case, the transfer will take place in accordance with one of the methods provided for by the law in force such as, in particular: (i) the existence of an adequacy assessment by the European Commission or (ii) the selection of parties adhering to international programmes for the free movement of data (e.g. EU-US Data Privacy Framework), pursuant to art. 45, para. 3 of the Regulation, or (iii) the adoption of contractual clauses approved by the European Commission (so-called “Standard Contractual Clauses”), pursuant to art. 46 of the Regulation.

Further information is available, on request, from the Controller.

6. RIGHTS OF THE DATA SUBJECT

The data subject may exercise, at any time, the rights provided for by articles 15 – 22 of the Regulation. In particular, the data subject has the right to:

• request access to their personal data, the rectification or erasure of the same, the restriction of processing in the cases provided for by art. 18 of the Regulation,
• obtain in a structured, commonly used and machine-readable format the data concerning them in the cases provided for by art. 20 of the Regulation (so-called right to portability).
• withdraw the consent given (where required), pursuant to art. 7 of the Regulation (in the manner described below or by accessing the account of the Site, if registered, or by contacting the Points of Sale);
• submit a request to object to the processing of data, pursuant to art. 21 of the Regulation, in which to give evidence of the reasons justifying the objection: the Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for proceeding with the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a right before the courts.

Requests to exercise the rights listed above must be sent to the Controller by one of the methods described below (or by the other methods provided for in this notice):

• to the e-mail address privacy@ or
• by contacting customer service, using the specific form present on the Site;
• by post, at the addresses indicated in art. 2.

Requests to exercise the rights of the data subject may also be addressed to the Data Protection Officer (“DPO”) at the address: dpo@

The Controller will respond to the data subject’s request without unjustified delay and, in any case, within one month of receipt of the request itself. This period may be extended by two months, if necessary, taking into account the complexity and the number of requests, after informing the data subject of the extension and of the reasons justifying it.

The data subject’s right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), pursuant to art. 77 of the Regulation, or to bring a judicial remedy, pursuant to art. 79 of the Regulation, remains unaffected, where they consider that the processing of their data is contrary to the provisions of the Regulation or of the law in force.