Newsletter Privacy Notice

PRIVACY NOTICE FOR USERS WHO SUBSCRIBE TO THE NEWSLETTER

Provided pursuant to art. 13 of Regulation 2016/679 (“Regulation”)

V025Omni_2026/11. Published 09/11/2026.

1. INTRODUCTION – WHAT ACTIVITIES DOES THIS NOTICE COVER?

This notice governs the processing of the personal data of users who subscribe to the newsletter of L’Erbolario from the website (“Site”). Subscription to the newsletter is independent of the creation of the personal account on the Site and of joining the L’Erbolario Loyalty Programme, which are governed by the respective privacy notices available on the Site.

2. DATA CONTROLLER AND DATA OF THE DATA PROTECTION OFFICER (“DPO”)

The data controller is L’Erbolario Società Benefit s.r.l., with registered office in Viale Milano 74, 26900 Lodi, VAT No. and Tax Code info@erbolariocare.shop (“L’Erbolario” or “Controller”).

The Controller has appointed the data protection officer (“DPO”) pursuant to art. 37 of the Regulation, who can be reached at the following address: info@erbolariocare.shop.

3. PURPOSES OF THE PROCESSING, PERSONAL DATA PROCESSED, DATA RETENTION PERIOD

3.1 SENDING OF COMMERCIAL COMMUNICATIONS, INCLUDING THE NEWSLETTER

Purposes: subject to the express consent of the user, L’Erbolario will process the personal data in order to send them commercial communications, including the newsletter, discount vouchers and promotions, relating to its own products and services or those of third parties as well as for the purpose of carrying out market research (customer satisfaction), by e-mail, sms and/or telephone (where the relevant contact details have been provided) (“marketing purposes”). In addition, the consent thus expressed will allow L’Erbolario to include in the newsletters also tracking pixels (tracking pixel) which make it possible to understand whether a communication has been opened and to collect information useful for improving the effectiveness of communications. The user may always disable tracking by selecting the dedicated link in the footer of the newsletter, or withdraw the consent given for marketing purposes in full through the specific link, also present in the footer of each e-mail, as better described in the paragraph “withdrawal of consent” below.

Categories of data processed: name, surname, e-mail address, telephone number (if provided). In the event of activation of the tracking pixels (where consent has been given for marketing purposes and no objection to such tracking has been raised): data relating to the opening of the e-mail and to the clicks made (event, date and time, IP address and information on the programme or device used for the opening; internal links of the communication accessed by the user).

Legal basis: the legal basis legitimising this processing is the consent of the data subject, art. 6.1 a) of the Regulation.

Nature of the provision of data: the provision of data for marketing purposes is optional; there is, in fact, no legal or contractual obligation on the user to provide such data for this purpose and/or to give consent to the processing of their personal data.

Withdrawal of consent: the user may withdraw at any time the consent given and/or object, in whole or in part, to the processing of their data:

• by clicking on the “Unsubscribe” button in the newsletters and in the commercial communications sent by e-mail or objecting only to the use of tracking pixels, by selecting the dedicated link present in the footer of the newsletter;

• by contacting customer service, through the dedicated contact channels or by writing to the address info@erbolariocare.shop or

• if registered on the Site, through the account settings.

It is further specified that:

• with the withdrawal of consent for marketing purposes, without any further indication, the user will no longer receive any commercial communication from L’Erbolario, by e-mail or by the other methods described herein;

• by selecting only the link dedicated to the deactivation of tracking pixels, present in each newsletter, the user will continue to receive the commercial communications of L’Erbolario, but without the insertion of the tracking pixels within them (or, in any case, with tools that do not allow the collection of information directly or indirectly attributable to the user);

• in any case, the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before the withdrawal;

• the failure to provide the data for marketing purposes, the failure to give consent to such processing and/or the withdrawal of such consent (including where referring exclusively to the use of tracking pixels) and/or the exercise of the right to object do not entail any consequence on the possibility for the user to register on the Site or to make purchases on the Site and/or to join and participate in the L’Erbolario Loyalty Programme.

Data retention period: until the withdrawal of consent and for a maximum of 36 months from the provision of the data. The user is reminded that, if they have joined the L’Erbolario Loyalty Programme, this period starts again each time they make a purchase at a Point of Sale using the Loyalty Card or, if they have activated a personal account on the Site, when they make a purchase using the e-mail address associated with the account or use on the Site one of the services reserved for participants in the L’Erbolario Loyalty Programme, being able, on such occasions, to withdraw the consent previously given.

The information relating to the openings of commercial communications by e-mail and to the interactions with them, collected by means of tracking pixels, will be retained in a form attributable to the individual recipient exclusively for the time necessary to pursue the purposes for which they are collected and, in any case, no longer than the retention period of personal data for marketing purposes indicated above.

It remains understood that L’Erbolario may retain the personal data for the maximum retention periods referred to in the other sections of this notice, if pertinent and/or, in any case, in the cases established by the Regulation and/or by law.

3.2 EXERCISE OR DEFENCE OF A RIGHT

Purposes: L’Erbolario will process the data of users for the establishment, exercise or defence of a right in all competent fora.

Categories of data processed:

• data provided in relation to the purpose described above;

• data and metadata collected for security purposes.

Legal basis: the legal basis legitimising the processing is the legitimate interest of the data controller or of a third party pursuant to art. 6, para. 1, lett. f) of the Regulation. It constitutes a legitimate interest of the controller to avail itself of remedies in order to ensure respect for its contractual rights or to demonstrate the fulfilment of the obligations deriving from the contract with the data subject (use of the services reserved for users subscribed to the newsletter), as well as those imposed by law (for example, collection and documentation of consent). This interest is founded on the constitutionally protected right of defence and may be considered to prevail over the fundamental rights and freedoms of the data subject, also in consideration of their reasonable expectations. The user has in any case the right to object, at any time and for reasons connected with their personal situation, to the processing of personal data carried out for the purposes indicated above (i.e. defence of a right or purposes of justice), by contacting L’Erbolario at the contact details indicated in paragraph 6 below.

Nature of the provision of data: for the purpose in question, data initially collected for different purposes are processed. The further processing of such data is permitted as it is based on the legitimate interest of the Controller, given that the purpose in question is compatible with the original purposes of the collection, which include the need for the Controller to exercise its contractual rights and rights provided for by law, ensuring the correct operation and security of the services offered, as well as compliance with applicable regulations. In the event of exercise of the right to object, L’Erbolario will refrain from further processing the personal data of users for this purpose, unless it demonstrates the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject.

Data retention period: the personal data will be retained for the period necessary for the establishment, exercise or defence of the rights of the Controller or of third parties, taking into account the applicable limitation periods and the possible duration of judicial or administrative proceedings.

4. RECIPIENTS OF THE PERSONAL DATA

The personal data described in paragraph 3 above may be communicated to third parties which provide services in favour of the Controller and are specifically appointed by the latter pursuant to art. 28 of the Regulation as well as to employees and/or collaborators of the Controller, duly authorised and instructed, pursuant to art. 29 of the Regulation. A list of the categories of recipients is provided below:

• companies or consultants in charge of the installation and/or supply and, in general, of the management of the hardware and software used by L’Erbolario for the activities described in this notice;

• companies of the group to which L’Erbolario belongs, for the carrying out of administrative activities connected with the activities described in this notice;

• providers of the systems for sending electronic communications, including the newsletters;

• natural and/or legal persons (e.g. legal consulting firms), where the communication is necessary or functional to the correct fulfilment of the contractual obligations undertaken as well as of the obligations deriving from the law or in the case of establishment, exercise or defence of a right.

Furthermore, the personal data will be processed by employees/collaborators of the Controller, expressly instructed and authorised for this purpose, in accordance with art. 29 of the Regulation.

Finally, the personal data may also be processed by parties acting as autonomous data controllers:

• for purposes connected with the carrying out of activities of an organisational, administrative, financial and accounting nature, the personal data may be communicated to L’Erbolario Holding s.r.l., parent company and controlling entity of L’Erbolario Società Benefit s.r.l. and, for the same purposes, also to the other companies of the group, as autonomous data controllers, by reason of the legitimate interest of the controllers in the circulation of information within the same business group, as defined by art. 4.19 of the Regulation.

Among the providers of technology services there is Shopify International Ltd., with registered office in Ireland, provider of the platform that hosts the Site, which processes the personal data of users on behalf of L’Erbolario, as data processor, pursuant to art. 28 of the Regulation, in the context of the provision of the services of the platform.

Shopify may also process, as an autonomous data controller, certain personal data of users, including identification data and data relating to the devices used and to the interactions with the Site, for its own purposes (e.g. security of online services and improvement of functionalities). For more information on the processing carried out by Shopify as an autonomous controller, it is possible to consult the relevant privacy notice. To exercise the rights provided for by the Regulation against Shopify, the user may use the tools made available on the Privacy controls page.

The list of recipients of the personal data is available from the Controller.

5. TRANSFER OF DATA TO THIRD COUNTRIES

The personal data are processed with IT tools of which L’Erbolario is a licensee or, in any case, under a specific contract. The providers of such tools and/or of the services provided through the Site are based in the European Union. However, the management and/or maintenance of the IT tools and/or the provision of certain services may entail the need for personal data to be transferred also outside the European Union. In such a case, the transfer will take place in accordance with one of the methods provided for by the law in force such as, in particular: (i) the existence of an adequacy assessment by the European Commission or (ii) the selection of parties adhering to international programmes for the free movement of data (e.g. EU-US Data Privacy Framework), pursuant to art. 45, para. 3 of the Regulation, or (iii) the adoption of contractual clauses approved by the European Commission (so-called “Standard Contractual Clauses”), pursuant to art. 46 of the Regulation.

Further information is available, on request, from the Controller.

6. RIGHTS OF THE DATA SUBJECT

The data subject may exercise, at any time, the rights provided for by articles 15 – 22 of the Regulation. In particular, the data subject has the right to:

• request access to their personal data, the rectification or erasure of the same, the restriction of processing in the cases provided for by art. 18 of the Regulation,

• obtain in a structured, commonly used and machine-readable format the data concerning them in the cases provided for by art. 20 of the Regulation (so-called right to portability).

• withdraw the consent given, pursuant to art. 7 of the Regulation (in the manner described below or by accessing the account of the Site, if registered);

• submit a request to object to the processing of data, pursuant to art. 21 of the Regulation, in which to give evidence of the reasons justifying the objection: the Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for proceeding with the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a right before the courts.

Requests to exercise the rights listed above must be sent to the Controller by one of the methods described below (or by the other methods provided for in this notice):

• to the e-mail address info@erbolariocare.shop or

• by contacting customer service, at the address info@erbolariocare.shop; or

• by contacting customer service using the specific form present on the Site;

• by post, at the addresses indicated in paragraph 2 above.

Requests to exercise the rights of the data subject may also be addressed to the Data Protection Officer (“DPO”) at the address: info@erbolariocare.shop.

The Controller will respond to the data subject’s request without unjustified delay and, in any case, within one month of receipt of the request itself. This period may be extended by two months, if necessary, taking into account the complexity and the number of requests, after informing the data subject of the extension and of the reasons justifying it.

The data subject’s right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), pursuant to art. 77 of the Regulation, or to bring a judicial remedy, pursuant to art. 79 of the Regulation, remains unaffected, where they consider that the processing of their data is contrary to the provisions of the Regulation or of the law in force.