L’Erbolario Loyalty Programme Privacy Notice

PRIVACY NOTICE FOR USERS WHO HAVE JOINED THE L’ERBOLARIO LOYALTY PROGRAMME

Provided pursuant to art. 13 of Regulation 2016/679 (“Regulation”)

V025Omni_2026/11. Published 09/11/2026.

1. INTRODUCTION – WHAT ACTIVITIES DOES THIS NOTICE COVER?

This notice governs the processing of users’ personal data with regard to:

A.
The registration and the participation in the L’Erbolario Loyalty Programme (also the “Programme”) of L’Erbolario Società Benefit s.r.l. (“L’Erbolario”) which may be carried out:

• at participating points of sale under the “L’Erbolario” sign (“Points of Sale”) at the till or via the specific QR Code available at the Point of Sale;

• through the website (“Site”), by completing the specific registration form. The creation of a personal account on the Site does not automatically entail joining the L’Erbolario Loyalty Programme, for which separate membership is required, in accordance with the procedures described on the Site and as provided for by the Programme rules available on the Site and at the Points of Sale (“Rules”). Similarly, please note that joining the Loyalty Programme at a Point of Sale does not automatically entail the creation of a personal account on the Site, which the user may activate separately by following the authentication procedure provided for by the Site and using the same e-mail address provided when joining the Programme.

B.
the sending of commercial communications and analysis of users’ preferences and purchasing habits (so-called marketing and profiling purposes), for which the user may optionally give separate consents when joining the Programme, at the Points of Sale or on the Site.

2. DATA CONTROLLER AND CONTACT DETAILS OF THE DATA PROTECTION OFFICER (“DPO”)

The data controller is L’Erbolario Società Benefit s.r.l., with registered office at Viale Milano 74, 26900 Lodi, VAT No. and Tax Code info@erbolariocare.shop (“L’Erbolario” or “Controller”).

The Controller has appointed the data protection officer (“DPO”) pursuant to art. 37 of the Regulation, who can be reached at the following contact: info@erbolariocare.shop.

3. PURPOSES OF THE PROCESSING, PERSONAL DATA PROCESSED, DATA RETENTION PERIOD

3.1 PARTICIPATION IN THE L’ERBOLARIO LOYALTY PROGRAMME

Purpose: L’Erbolario will process the user’s personal data to enable them to participate in the L’Erbolario Loyalty Programme, at the Points of Sale and/or on the Site, and to manage the related activities such as, in particular:

• the generation of a card containing a unique code and a barcode (“Loyalty Card”), issued at the time of joining the Programme. Users who join the Loyalty Programme and who have also created a personal account on the Site may view their Loyalty Card within the account;

• the allocation of loyalty points and discount vouchers, as governed by the Programme, for purchases made at the Points of Sale and, subject to the creation of a personal account on the Site, also for orders placed on the Site;

• the allocation of free gifts and discounts and the use of dedicated services (e.g. Clicca & Prenota), reserved for users who have joined the Programme;

• participation in “L’Erbolario Club”, of which L’Erbolario is the promoter, and in the related prize events pursuant to D.P.R. 430/2001,

in accordance with the terms and conditions set out in the Rules of the L’Erbolario Loyalty Programme.

The personal data will also be processed to:

• provide assistance to the user regarding the L’Erbolario Loyalty Programme, where requested, through Customer Service;

• send institutional communications concerning the Programme (e.g. expiry of points and/or amendments to the Programme Rules; allocation of the free gifts or discounts provided for by the Programme);

• enable users who joined the Loyalty Programme at a Point of Sale and who have subsequently activated a personal account on the Site to view and manage, including through that account, the information relating to their participation in the Programme, including the Loyalty Card and the preferences previously expressed regarding the processing of personal data (for which reference is made to paragraphs 3.2 and 3.3 below).

Categories of data processed:

• data provided when joining the Programme (e.g. first name, surname, email address, date of birth and, if provided, telephone number and gender);

• date and channel of registration with the Programme (Point of Sale or Site);

• identification code of the Loyalty Card;

• data relating to participation in the promotional initiatives governed by the Programme (e.g.: products entitling to points, points accumulated, vouchers accrued and/or used, prizes requested, prize delivery data; use of the free gifts and/or discounts allocated and the channel used).

Legal basis: the legal basis legitimising this processing is:

• performance of the contract or, as the case may be, implementation of pre-contractual measures taken at the request of the data subject (art. 6.1.b) of the Regulation);

• compliance with legal obligations (e.g. DPR 430/2001 on prize events), pursuant to art. 6.1 c) of the Regulation (in the case of participation in L’Erbolario Club and/or in the other prize events that may be governed by the L’Erbolario Loyalty Programme).

Nature of the provision of data: the provision of data is optional, i.e. there is no legal or contractual obligation for the user to provide personal data. However, since the processing of such data is necessary to enable the user to participate in the L’Erbolario Loyalty Programme and for the management of the Programme itself, failure to communicate the personal data will entail the impossibility for the user to participate in the Programme.

The provision of data is, on the other hand, mandatory in all cases in which, within the L’Erbolario Loyalty Programme, the user takes part in an initiative qualifying as a “prize event” pursuant to D.P.R. 430/2001 (e.g. “L’Erbolario Club”) and participates in it for the purposes of the allocation of a prize.

Data retention period:

• the user’s identification data and those of the Loyalty Card will be retained until the revocation of the Loyalty Card and/or the cessation of the user’s participation in the L’Erbolario Loyalty Programme. Please note that prolonged inactivity of the Loyalty Card for a continuous period exceeding 36 months will entail its suspension and subsequent deletion. For the purposes of assessing inactivity, account is taken of the failure to use the Loyalty Card in purchases made at the Points of Sale and/or on the Site, in accordance with the procedures provided for by the Programme Rules. Furthermore, the 36-month period will also be interrupted where the user, although not making purchases associated with the Loyalty Card, uses one of the services reserved for users who have joined the L’Erbolario Loyalty Programme on the Site or at one of the Points of Sale;

• the data relating to the user’s participation in the L’Erbolario Loyalty Programme will be retained for a maximum period of 12 months from the closure of the Programme.

It is specified that the cessation of membership of the L’Erbolario Loyalty Programme, including at the user’s request, does not automatically entail the deletion of any personal account activated on the Site, which may continue to be used for the features and services available therein. Similarly, the closure of the personal account on the Site does not automatically entail the cessation of membership of the L’Erbolario Loyalty Programme, in which the user may continue to participate through the Points of Sale, in accordance with the procedures provided for by the Rules. In both cases, the user remains entitled to request the cessation of both relationships.

3.2 MARKETING

Purpose: subject to the user’s express consent, L’Erbolario will process the personal data to send commercial communications, including the newsletter, discount vouchers and promotions, relating to its own or third parties’ products and services, as well as for the purposes of carrying out market research (customer satisfaction), by e-mail, sms and/or telephone. Furthermore, the consent so expressed will allow L’Erbolario to include in the e-mails also tracking pixels (so-called tracking pixel) which make it possible to understand whether a communication has been opened and to collect information useful for improving the effectiveness of the communications. The user may always disable tracking by selecting the dedicated link in the e-mail footer, or withdraw entirely the consent given for marketing purposes through the specific link, also present in the footer of every e-mail, as better described in the “withdrawal of consent” paragraph below.

Categories of data processed: first name, surname, email address, telephone number (if provided). In the event of activation of the tracking pixels (where consent has been given for marketing purposes and no objection to such tracking has been raised): data relating to the opening of the e-mail and to the clicks made (event, date and time, IP address and information on the mail programme or device used for the opening; internal links of the communication accessed by the user).

Legal basis: the legal basis legitimising this processing is the consent of the data subject, art. 6.1 a) of the Regulation.

Nature of the provision of data: the provision of data for marketing purposes is optional; indeed, there is no legal or contractual obligation on the user to provide such data for this purpose and/or to give consent to the processing of their personal data.

Withdrawal of consent: the user may at any time withdraw the consent given and/or object to the processing of their data, in whole or in part:

• by clicking on the “Unsubscribe” link in the e-mail communications or, to object only to the use of the tracking pixels, by selecting the dedicated link in the footer of those communications;

• by going to a Point of Sale, or

• by contacting customer service, through the dedicated contact channels or by writing to info@erbolariocare.shop or

• if registered on the Site, through the account settings.

It is further specified that:

• by withdrawing consent for marketing purposes, without any further indication, the user will no longer receive any commercial communication from L’Erbolario, by e-mail or by the other methods described herein;

• by selecting only the link dedicated to disabling the tracking pixels, present in every e-mail communication, the user will continue to receive L’Erbolario’s commercial communications, but without the insertion of tracking pixels within them (or, in any case, with tools that do not allow the collection of information directly or indirectly attributable to the user);

• in any case, the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before the withdrawal;

• the failure to provide the data for marketing purposes, the failure to give consent to such processing and/or the withdrawal of such consent and/or the exercise of the right to object (including where referring exclusively to the use of the tracking pixels) entail no consequence on the user’s ability to participate in the L’Erbolario Loyalty Programme and/or to make purchases at the Points of Sale or on the Site.

Data retention period: until the withdrawal of consent and for a maximum of 36 months from the provision of the data. The user is reminded that this period starts again each time the user makes a purchase at a Point of Sale using the Loyalty Card or, if registered on the Site, makes a purchase on the Site or interacts with one of the Site’s services reserved for users who have joined the Programme, being able, on such occasions, to withdraw the consent previously given.

The information relating to the openings of the commercial communications by e-mail and to the interactions with them, collected by means of the tracking pixels, will be retained in a form attributable to the individual recipient exclusively for the time necessary to pursue the purposes for which it is collected and, in any case, no longer than the data retention period for marketing purposes indicated above.

It remains understood that L’Erbolario may retain the personal data for the maximum retention periods referred to in the other sections of this notice, where relevant and/or, in any case, in the cases established by the Regulation and/or by law.

3.3 PROFILING

Purpose: subject to the user’s explicit consent, L’Erbolario will process the personal data to:

– monitor and analyse users’ behaviour on the Site (e.g. pages visited and products viewed) and, where the relevant consent for marketing purposes has been given, including the use of the tracking pixels, the information relating to the opening of the commercial communications sent by e-mail and the selection of the links contained therein, in order to identify users’ interests and preferences;

– monitor and track purchase data (e.g.: type of products purchased, frequency and volume of purchases, etc.) at the Points of Sale and/or on the Site;

– analyse and process the personal data in order to identify correlations between users’ behaviours and place users in various “clusters”, i.e. sets of customer types that may have common characteristics; and/or

– send, by e-mail or by sms or telephone operator and/or display to users, on the Site, personalised offers, i.e. matched to the cluster in which the user has been placed and, therefore, of their presumed specific interest.

Categories of data processed:

• first name, surname, gender (if provided), date of birth;

• purchase data (frequency, quantity, type, amount, delivery address, telephone number, payment method);

• purchase channels (e.g. Site and/or Points of Sale);

• data relating to participation in the L’Erbolario Loyalty Programme (e.g. points accumulated; prizes requested);

• browsing data (e.g. IP address, pages and products viewed);

• in addition, where consent has been given for marketing purposes, including the use of the tracking pixels, and no withdrawal limited to such tracking has occurred, data relating to the opening of the e-mail and to the clicks made (event, date and time, IP address and information on the mail programme or device used for the opening; internal links of the communication accessed by the user).

Legal basis: the legal basis legitimising this processing is the explicit consent of the data subject, art. 6.1 a) of the Regulation.

Nature of the provision of data: the provision of data for profiling purposes is optional: indeed, there is no legal or contractual obligation on the user to provide the data for this purpose and/or to give consent to the processing of their personal data.

Withdrawal of consent: the user may at any time withdraw the consent given and/or object, at any time, to the processing of their data at the Points of Sale or, if registered on the Site, through the reserved area of the Site or by contacting customer service, through the dedicated contact channels or by writing to info@erbolariocare.shop. It is further specified that:

• the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before the withdrawal;

• the failure to provide the data for profiling purposes, the failure to give consent to such processing and/or the withdrawal of such consent and/or the exercise of the right to object entail no consequence on the user’s ability to participate in the Programme and/or to make purchases at the Points of Sale and/or on the Site;

• where the user has given consent for marketing purposes and has not also withdrawn that separate consent (in the manner described in paragraph 3.2 above), the withdrawal of consent to profiling will not automatically entail the cessation of the commercial communications.

Data retention period: until the withdrawal of consent and for a maximum of 36 months from the provision of the data. It remains understood that L’Erbolario may retain the personal data for the maximum retention periods referred to in the other sections of this notice, where relevant and/or, in any case, in the cases established by the Regulation and/or by law.

3.4 AGGREGATE ANALYSIS

Purpose: L’Erbolario may also process the data of users enrolled in the Loyalty Programme for internal analysis purposes, on an aggregate basis (e.g. breakdown of data subjects by age and/or gender), aimed at improving the services and the product offering.

Categories of data: gender, age, channel of registration with the L’Erbolario Loyalty Programme, type and volume of purchases, use of vouchers.

Legal basis: the legal basis legitimising this processing is the legitimate interest of the data controller or of a third party (art. 6.1.f) of the Regulation). It constitutes a legitimate interest of the Controller to be able to carry out internal analyses, on an aggregate basis, aimed at understanding the composition of the participants in the L’Erbolario Loyalty Programme (e.g. statistical assessment of the percentage of women and men, percentage distribution by age group) and the volumes and type of products purchased within it, in order to improve the Programme and the offering of the associated products. This legitimate interest is compatible with the rights and freedoms of the data subjects since the analysis is carried out on an aggregate basis and is intended to provide the data controller with a general orientation, functional to the definition of strategic choices, without the analysis so conducted being able to entail direct repercussions on individual data subjects (e.g. targeted and/or personalised advertising solicitations) and without carrying out assessments, predictions or drawing conclusions regarding specific natural persons.

Nature of the provision of data: for the purposes described above, L’Erbolario uses personal data originally collected for different purposes (namely registration with the L’Erbolario Loyalty Programme), the further processing of which is lawful as it is based on L’Erbolario’s legitimate interest in orienting its strategic and business choices. In the event of exercise of the right to object by the user, L’Erbolario will refrain from continuing the processing of users’ personal data for this purpose, unless it demonstrates the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or that the processing is necessary for the establishment, exercise or defence of a right in judicial proceedings.

3.5 SECURITY, OPERATION AND CONTROL OF THE SITE

Purpose: L’Erbolario will process users’ data to:

• prevent, ascertain and manage any conduct in breach of what is established in the Rules of the Loyalty Programme at the Points of Sale and/or on the Site;

• verify the presence of any bugs and/or malfunctions of the Site and to prevent and manage cyber attacks and/or other computer-related offences;

• comply with the obligations imposed by laws, regulations or by orders issued by the competent authorities.

Categories of data processed:

• data connected with the accumulation of points and/or the use of the benefits provided for by the Rules of the L’Erbolario Loyalty Programme on the Site and/or at the Points of Sale (e.g. transaction history, points accumulated/used, benefits requested);

• data resulting from the user’s interactions with the Site, both as a logged-in user and as a non-logged-in user (e.g. browsing data, access logs, date and time, actions performed within the Site);

• technical and security data necessary for the monitoring, diagnostics and prevention of unlawful activities or malfunctions (e.g. IP address, system errors, unauthorised access attempts).

Legal basis:

• for the prevention and ascertainment of any conduct in breach of the Rules of the L’Erbolario Loyalty Programme, the legal basis for the processing is art. 6, para. 1, letter f) of the Regulation. It constitutes a legitimate interest of L’Erbolario to carry out activities aimed at preventing fraudulent participation in the L’Erbolario Loyalty Programme and/or in the other prize events of which L’Erbolario is the promoter. This interest coincides with that of the participants in the Programme as well as – more generally – with the interest of the community in discouraging and identifying fraudulent conduct, especially in contexts (such as prize events) in which public trust must be protected;

• for the verification of any bugs and malfunctions of the Site, as well as for the prevention and management of cyber attacks and/or other computer-related offences, the legal basis for the processing is art. 6, para. 1, letter f) of the Regulation. It constitutes a legitimate interest of L’Erbolario to ensure the security and functionality of its IT systems, as well as the protection of the information processed through the Site. This interest is also consistent with the expectations of users, who expect to be able to browse in a secure, reliable and technically functioning digital environment;

• to comply with the obligations imposed by laws, regulations or by orders issued by the competent authorities, the legal basis for the processing is compliance with a legal obligation, art. 6.1 c) of the Regulation.

Nature of the provision of data: For the purposes described above, L’Erbolario uses personal data originally collected for different purposes (namely, to allow access to and browsing of the Site, registration on the Site and participation in the L’Erbolario Loyalty Programme), the further processing of which is lawful as it is based on the legitimate interest of the Controller. This legitimate interest is founded on the compatibility between the purpose of preventing misuse of the Site and of the services reserved for registered users, as well as fraudulent participation in the L’Erbolario Loyalty Programme, and the purposes for which the data were initially collected. In the event of exercise of the right to object, L’Erbolario will refrain from further processing the users’ personal data for that purpose, unless it demonstrates the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject, or that the processing is necessary for the establishment, exercise or defence of a right in judicial proceedings.

Data retention period: the data processed for the purposes of monitoring the operation of the Site, security, prevention of cyber attacks and verification of the correctness of participation in the L’Erbolario Loyalty Programme will be retained for the time strictly necessary to pursue such purposes, without prejudice to any requirements connected with the exercise or defence of a right (for which see paragraph 3.6 below). The technical and security logs are retained for a maximum period of 12 months, while the data relating to the L’Erbolario Loyalty Programme may be retained for up to 12 months from the expiry of the Programme, without prejudice to specific requirements justifying longer retention.

3.6 EXERCISE OR DEFENCE OF A RIGHT

Purpose: L’Erbolario will process users’ data for the establishment, exercise or defence of a right in all competent fora.

Categories of data processed:

• data provided in relation to the purposes described in paragraphs 3.1 – 3.5 of this notice;

• data and metadata collected for security purposes.

Legal basis: the legal basis legitimising the processing is the legitimate interest of the data controller or of a third party pursuant to art. 6, para. 1, letter f) of the Regulation. It constitutes a legitimate interest of the controller to avail itself of legal remedies in order to ensure compliance with its contractual rights or to demonstrate the performance of the obligations arising from the contract with the data subject (for example, participation in the L’Erbolario Loyalty Programme or use of the services reserved for registered users), as well as those imposed by law (for example, collection and documentation of consent). This interest is founded on the constitutionally protected right to defence and may be considered to prevail over the fundamental rights and freedoms of the data subject, also in consideration of the data subject’s reasonable expectations. The user has in any case the right to object, at any time and on grounds relating to their personal situation, to the processing of personal data carried out for the purposes indicated above (namely defence of a right or purposes of justice), by contacting L’Erbolario at the contact details indicated in paragraph 6 below.

Nature of the provision of data: for the purpose in question, data initially collected for different purposes are processed (described in paragraphs 3.1 – 3.5). The further processing of such data is permitted as it is based on the legitimate interest of the Controller, given that the purpose in question is compatible with the original purposes of the collection, which include the need for the Controller to exercise its contractual rights and those provided for by law, ensuring the proper functioning and security of the services offered, as well as compliance with applicable legislation. In the event of exercise of the right to object, L’Erbolario will refrain from further processing the users’ personal data for this purpose, unless it demonstrates the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject.

Data retention period: the personal data will be retained for the period necessary for the establishment, exercise or defence of the rights of the Controller or of third parties, taking into account the applicable limitation periods and the possible duration of judicial or administrative proceedings.

4. RECIPIENTS OF THE PERSONAL DATA

The personal data described in paragraph 3 above may be communicated to third parties that perform services for the Controller and are specifically appointed by the latter pursuant to art. 28 of the Regulation, as well as to employees and/or collaborators of the Controller, duly authorised and instructed, pursuant to art. 29 of the Regulation. A list of the categories of recipients is provided below:

• companies or consultants appointed for the installation and/or supply and, in general, the management of the hardware and software used by L’Erbolario for the activities described in this notice;

• companies of the group to which L’Erbolario belongs, for the performance of administrative activities connected with the activities described in this notice;

• service providers supporting the management of the prize events (including “L’Erbolario Club”) and/or of any competitions organised from time to time by L’Erbolario;

• providers of the systems for sending electronic communications, including newsletters;

• natural and/or legal persons (legal, administrative and tax consultancy firms), where the communication is necessary or functional to the proper performance of the contractual obligations undertaken in relation to the management of the Programme and/or of any competitions organised from time to time by L’Erbolario, as well as of the obligations arising from the law or in the case of the establishment, exercise or defence of a right.

Lastly, the personal data may also be processed by entities acting as independent data controllers:

• notaries or other public officials appointed to carry out the drawing of lots within the prize events, in cases where the communication of the data is necessary to comply with a legal obligation;

• for purposes connected with the performance of organisational, administrative, financial and accounting activities, the personal data may be communicated to L’Erbolario Holding s.r.l., the parent and controlling company of L’Erbolario Società Benefit s.r.l. and, for the same purposes, also to the other companies of the group, as independent data controllers, by reason of the legitimate interest of the controllers in the circulation of information within the same business group, as defined by art. 4.19 of the Regulation.

The technology service providers include Shopify International Ltd., based in Ireland, provider of the platform hosting the Site, which processes users’ personal data on behalf of L’Erbolario, as data processor, pursuant to art. 28 of the Regulation, in the context of the provision of the platform services.

Shopify may also process, as an independent data controller, certain personal data of users, including identification data and data relating to the devices used and to the interactions with the Site, for its own purposes (e.g. security of the online services and improvement of the features). For more information on the processing carried out by Shopify as an independent controller, please consult the relevant privacy notice. To exercise the rights provided for by the Regulation towards Shopify, the user may use the tools made available on the Privacy controls.

The list of recipients of the personal data is available from the Controller.

5. TRANSFER OF DATA TO THIRD COUNTRIES

The personal data are processed with IT tools licensed to L’Erbolario or, in any case, under a specific contract. The providers of such tools and/or of the services supplied through the Site are based in the European Union. However, the management and/or maintenance of the IT tools and/or the provision of certain services may require personal data to be transferred also outside the European Union. In such case, the transfer will take place in accordance with one of the methods provided for by applicable law such as, in particular: (i) the existence of an adequacy decision by the European Commission or (ii) the selection of entities adhering to international programmes for the free movement of data (e.g. EU-US Data Privacy Framework), pursuant to art. 45, para. 3 of the Regulation, or (iii) the adoption of contractual clauses approved by the European Commission (so-called “Standard Contractual Clauses”), pursuant to art. 46 of the Regulation.

Further information is available, upon request, from the Controller.

6. RIGHTS OF THE DATA SUBJECT

The data subject may exercise, at any time, the rights provided for by articles 15 – 22 of the Regulation. In particular, the data subject has the right to:

• request access to their personal data, the rectification or erasure thereof, the restriction of processing in the cases provided for by art. 18 of the Regulation,

• obtain in a structured, commonly used and machine-readable format the data concerning them in the cases provided for by art. 20 of the Regulation (so-called right to portability).

• withdraw the consent given, pursuant to art. 7 of the Regulation (in the manner described below or by accessing the Site account, if registered, or by applying at the Points of Sale);

• submit a request to object to the processing of data, pursuant to art. 21 of the Regulation, setting out the reasons that justify the objection: the Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for proceeding with the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a right in judicial proceedings.

Requests to exercise the rights listed above must be sent to the Controller using one of the methods described below (or the other methods provided for in this notice):

• to the email address info@erbolariocare.shop or

• by contacting customer service, at the address info@erbolariocare.shop; or

• by contacting customer service using the specific form on the Site;

• by post, at the contact details indicated in paragraph 2 above.

Requests to exercise the data subject’s rights may also be addressed to the Data Protection Officer (“DPO”) at the address: info@erbolariocare.shop.

The Controller will respond to the data subject’s request without unjustified delay and, in any case, within one month of receipt of the request. This period may be extended by two months, if necessary, taking into account the complexity and number of requests, after informing the data subject of the extension and of the reasons justifying it.

The data subject retains the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), pursuant to art. 77 of the Regulation, or to bring a judicial remedy, pursuant to art. 79 of the Regulation, where they consider that the processing of their data is contrary to what is provided for by the Regulation or by applicable legislation.