Customer Service Privacy Notice

PRIVACY NOTICE RELATING TO INTERACTION WITH CUSTOMER SERVICE

Provided pursuant to Article 13 of Regulation 2016/679 (“Regulation”)

V025Omni_2026/11. Publication 09/11/2026.

1. INTRODUCTION – WHAT ACTIVITIES DOES THIS NOTICE COVER?
This notice is dedicated to the processing of personal data connected with the provision of the customer assistance service (“Customer Service”) provided:

•  via the “contact us” form available on the website (“Website”); and/or

•  by telephone, using the contact details indicated on the Website; and/or

•  using the e-mail address info@erbolariocare.shop or info@erbolariocare.shop; and/or

•  via the private messaging of the user’s social channels, Facebook and Instagram, and via WhatsApp; and/or

•  via the virtual chat of the Website; and/or

•  via the form available in the “exercise withdrawal online” and/or “withdrawal” section of the Website.

2. DATA CONTROLLER AND DATA PROTECTION OFFICER (“DPO”) DETAILS
The data controller is L’Erbolario Società Benefit s.r.l., with registered office at Viale Milano 74, 26900 Lodi, VAT No. and Tax Code info@erbolariocare.shop (“L’Erbolario” or “Controller”).
The Controller has appointed the data protection officer (“DPO”) pursuant to Article 37 of the Regulation, who may be contacted at the following address: info@erbolariocare.shop.

3. PURPOSES OF THE PROCESSING, PERSONAL DATA PROCESSED, DATA RETENTION PERIOD

3.1 RESPONDING TO USERS’ REQUESTS

Purpose: personal data are processed exclusively to respond to users’ requests. 

Categories of data: for this purpose, the data provided by the user through the chosen contact channels are processed, as set out below:

•  form in the “contact us” section of the Website: first name, surname, e-mail address and the other data optionally provided by the user in the form (e.g. purchase order);

•  the e-mail address info@erbolariocare.shop or info@erbolariocare.shop: e-mail address and information contained in the communication sent by the user;

•  telephone: telephone number, customer name and the other data necessary to handle the request;

•  private messaging of the user’s social channels (Facebook and Instagram, and via WhatsApp): name or nickname and data optionally provided in the request, telephone number;

•  virtual chat: the operation of the chat does not involve the entry of personal data – which the user must therefore not provide – except where the user asks to be contacted by the Customer Service operator and enters their name and e-mail address, when required. In that case, the Customer Service will also process the personal data necessary to handle the request (e.g. an order number);

•  where applicable: technical metadata, such as the date and time of the request.

Finally, please note that in order to provide the customer assistance activity L’Erbolario does not request data belonging to special categories (e.g. data on health status). However, it is possible that the user, on their own initiative, provides the Customer Service with (and the Customer Service must therefore respond to) information capable of revealing health status. This circumstance may occur, for example, where the user requests assistance regarding the presence of allergens or the dosage of certain products (e.g. food supplements). The processing of information relating to health status is possible subject to the explicit consent of the data subject and L’Erbolario will process the data provided solely for the purpose of providing the requested assistance.

Legal basis: the legal basis legitimising the processing is Art. 6(1)(b) of the Regulation (performance of pre-contractual measures adopted at the request of the data subject or performance of a contract to which the data subject is a party). Where the request involves the processing of data belonging to special categories, the legal basis is the consent of the data subject, pursuant to Art. 9(2)(a) of the Regulation. Finally, where the request concerns the exercise of rights conferred on the user by law (e.g. consumer rights, such as the legal guarantee of conformity), the legal basis legitimising the processing is Art. 6(1)(c) of the Regulation (compliance with a legal obligation).

Nature of the provision of data: the provision of personal data is optional, that is to say there is no obligation for the data subject to provide the data in question. However, in the absence of the data essential to manage the request (e.g. all the data entered in the mandatory fields of the contact form), it will not be possible to respond, in whole or in part, to the user’s request. 
If the user has given consent, they may withdraw it at any time by writing to the Customer Service, through the contact method already used or by writing to info@erbolariocare.shop. Withdrawal of consent does not affect the lawfulness of the processing carried out before withdrawal.
The provision of data is, on the other hand, mandatory in the case of a request to exercise a right provided for by law (e.g. consumers’ rights; data subjects’ rights, as governed by the Regulation, for which see paragraph 6 below), since the processing of data is necessary to enable the Controller to comply with a legal obligation and the user to exercise the rights conferred on them by law. Failure to provide the essential data could therefore prevent or make more difficult the management of the request, without prejudice to the data subject’s entitlement to the rights recognised by applicable legislation.

Data retention period: personal data will be retained for a maximum period of 36 months from the last interaction with the user, depending on the type of request made. For example, requests to exercise the data subjects’ rights provided for by the Regulation fall within the maximum retention period.
In the case of use of the virtual chat, conversations that end without a request for intervention by a Customer Service operator are retained for 30 days.
Please note that any requests received through the user’s Facebook, Instagram or WhatsApp channels and residing on those platforms will follow the retention periods provided for by those platforms.

3.2 SERVICE IMPROVEMENT AND INTERNAL REPORTING

Purpose: the personal data provided to request assistance from the Customer Service may be processed in order to:

•  improve the efficiency of the assistance service: if the user has already contacted the Customer Service, the latter may associate with the contact data initially provided (e.g. e-mail address) any additional identification or contact data (e.g. first name and surname, telephone number) that the user provides on the occasion of subsequent requests, including through different channels. This association enables the Customer Service to recognise the user and to handle subsequent requests more quickly and effectively;

•  internal reporting, that is to say to analyse, in aggregate form, the number and type of requests received and handled by the Customer Service and to improve the quality of the service offered.

Categories of data: identification data, contact data, contact channel; day and time of the request; category of the request (e.g. product, return, etc.).

Legal basis: the legal basis legitimising this processing is the legitimate interest of the Controller, pursuant to Art. 6(1)(f) of the Regulation.

Nature of the provision of data: for the purposes described above, L’Erbolario uses the personal data initially collected to improve the customer assistance service. Indeed, it is a legitimate interest of the Controller:

•  to ensure that the user receives timely and accurate responses to every interaction with the Customer Service and

•  to understand the volume and type of requests received by the Customer Service in order to improve the service.

This legitimate interest is compatible with the rights and freedoms of the data subjects who contact the Customer Service and who expect to receive assistance promptly and efficiently. 

Data retention period: the data will be retained for:

•  a maximum period of 36 months from the last interaction with the user, depending on the type of request made. For example, requests to exercise the data subjects’ rights provided for by the Regulation fall within the maximum retention period;

•  12 months, in the case of internal reporting.

3.3 ESTABLISHMENT OR DEFENCE OF A RIGHT

Purpose: L’Erbolario will process users’ data for the establishment, exercise or defence of a right in all competent fora.

Categories of data processed: data provided in relation to the purposes described in paragraphs 3.1 and 3.2.

Legal basis: the legal basis legitimising the processing is the legitimate interest of the data controller, pursuant to Art. 6(1)(f) of the Regulation. It is a legitimate interest of the Controller to pursue remedies in order to demonstrate that it has correctly responded to users’ requests (also on the basis of the provisions of the Consumer Code and of the Civil Code, in addition to the Regulation) and that it has complied with the obligations imposed by law. This interest is founded on the constitutionally protected right to defence and may be considered to prevail over the fundamental rights and freedoms of the data subject, also in consideration of the latter’s reasonable expectations. The user nevertheless has the right to object, at any time and on grounds relating to their particular situation, to the processing of personal data carried out for the purposes indicated above (that is to say defence of a right or the interests of justice), by contacting L’Erbolario at the contact details indicated in paragraph 6 below.

Nature of the provision of data: for the purpose in question, data initially collected for different purposes (described in paragraphs 3.1 – 3.2) are processed. The further processing of such data is permitted as it is based on the Controller’s legitimate interest, given that the purpose in question is compatible with the original purposes of collection, which include the Controller’s need to exercise its contractual rights and those provided for by law. In the event of exercise of the right to object, L’Erbolario will refrain from further processing the users’ personal data for this purpose, unless it demonstrates the existence of compelling legitimate grounds which override the interests, rights and freedoms of the data subject.

Data retention period: personal data will be retained for the period necessary for the establishment, exercise or defence of the rights of the Controller or of third parties, taking into account the applicable limitation periods and the possible duration of judicial or administrative proceedings.

4. RECIPIENTS OF PERSONAL DATA

The personal data described in paragraph 3 above may be communicated to third parties which provide services for the Controller and are specifically appointed by the latter pursuant to Art. 28 of the Regulation, as well as to employees and/or collaborators of the Controller, duly authorised and instructed, pursuant to Art. 29 of the Regulation. A list of the categories of recipients is provided below:

•  companies or consultants responsible for the installation and/or supply and, in general, the management of the hardware and software used by L’Erbolario for the activities described in this notice. This category includes, in particular, Zendesk Inc., provider of the platform used to manage the requests addressed to the Customer Service, and Shopify International Ltd., provider of the technology platform hosting the Website, which process personal data on behalf of L’Erbolario, as data processors pursuant to Art. 28 of the Regulation, in the context of the services respectively provided;

•  entities providing logistics and transport services, responsible for the delivery of the products purchased on the Website;

•  natural and/or legal persons (legal, administrative and tax consultancy firms), where the communication is necessary or functional to the correct performance of the contractual obligations, as well as of the obligations arising from the law or in the case of establishment, exercise or defence of a right. 

Finally, personal data may also be processed by entities acting as independent data controllers such as:

•  for purposes connected with the performance of organisational, administrative, financial and accounting activities, personal data may be communicated to L’Erbolario Holding s.r.l., the parent and controlling company of L’Erbolario Società Benefit s.r.l. and, for the same purposes, also to the other companies of the group, as independent data controllers, on the basis of the legitimate interest of the controllers in the circulation of information within the same business group, as defined by Art. 4(19) of the Regulation;

•  Shopify International Ltd., based in Ireland, owner of the technology platform hosting the Website, may process certain personal data of users as an independent data controller, including identification data and data relating to the devices used and to interactions with the Website, for its own purposes (e.g. security). For more information on the processing carried out by Shopify as an independent controller, please consult the relevant privacy notice. To exercise the rights provided for by the Regulation vis-à-vis Shopify, the user may use the tools made available on the Privacy controls page.

Please note that if the user chooses to contact the Customer Service through social network platforms or third-party messaging services, the relevant operators may also process their personal data for their own purposes, in accordance with their respective privacy notices. The processing carried out by L’Erbolario for the management and response to the request is instead governed by this notice.

The list of recipients of personal data is available at the Controller’s premises.

5. TRANSFER OF DATA TO THIRD COUNTRIES

Personal data are processed with IT tools of which L’Erbolario is a licensee or, in any event, under a specific contract. The providers of such tools and/or of the services provided through the Website are established in the European Union. However, the management and/or maintenance of the IT tools and/or the provision of certain services may entail the need for personal data to be transferred also outside the European Union. In such case, the transfer will take place in accordance with one of the methods provided for by applicable law such as, in particular: (i) the existence of an adequacy decision by the European Commission or (ii) the selection of entities adhering to international frameworks for the free movement of data (e.g. EU-US Data Privacy Framework),  pursuant to Art. 45(3) of the Regulation, or (iii) the adoption of contractual clauses approved by the European Commission (so-called “Standard Contractual Clauses”), pursuant to Art. 46 of the Regulation.

Further information is available, on request, from the Controller.

6. RIGHTS OF THE DATA SUBJECT

The data subject may exercise, at any time, the rights provided for in Articles 15 – 22 of the Regulation. In particular, the data subject has the right to:

•  request access to their personal data, the rectification or erasure thereof, the restriction of processing in the cases provided for by Art. 18 of the Regulation;

•  obtain in a structured, commonly used and machine-readable format the data concerning them in the cases provided for by Art. 20 of the Regulation (so-called right to portability);

•  withdraw the consent given, where applicable, pursuant to Art. 7 of the Regulation;

•  lodge a request to object to the processing of data, pursuant to Art. 21 of the Regulation, setting out the reasons justifying the objection: the Controller reserves the right to assess the request, which would not be accepted in the event of the existence of compelling legitimate grounds for proceeding with the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of a legal claim in court.

Requests to exercise the rights listed above must be sent to the Controller in one of the ways described below (or in the other ways provided for in this notice):

•  to the e-mail address info@erbolariocare.shop or

•  by contacting the customer service through the dedicated form on the Website;

•  by post, at the contact details indicated in paragraph 2.

Requests to exercise the data subject’s rights may also be addressed to the Data Protection Officer (“DPO”) at the address: info@erbolariocare.shop.

The Controller will respond to the data subject’s request without unjustified delay and, in any event, within one month of receipt of the request. This period may be extended by two months, where necessary, taking into account the complexity and number of the requests, after informing the data subject of the extension and of the reasons justifying it.
The data subject retains the right to lodge a complaint with the Italian Data Protection Authority, pursuant to Art. 77 of the Regulation, or to bring a judicial remedy, pursuant to Art. 79 of the Regulation, where they consider that the processing of their data is contrary to the provisions of the Regulation or of applicable legislation.