Privacy notice
Privacy Policy.
How we process your personal data, in accordance with Regulation (EU) 2016/679 (GDPR). Last updated: June 2025.
Data controller
The controller responsible for processing your personal data is:
Personal data collected
During registration, purchase and browsing we collect the following categories of data:
- →Identity data: first and last name
- →Contact data: email address, phone number (optional)
- →Delivery data: full delivery address (street, number, postcode, city, province)
- →Order data: products purchased, amounts, dates and delivery status
- →Payment data: processed exclusively by Stripe — we do not store card numbers or banking details
- →Browsing data: IP address (anonymised), pages visited, session duration (via Google Analytics)
Purposes of processing
We process your personal data for the following purposes:
Purpose 01
Order management
Receiving, confirming, preparing and tracking orders. Email communication about order status is an integral part of the service.
Legal basis: performance of contract (Art. 6.1.b GDPR)
Purpose 02
Shipping and delivery
Passing your address to BRT courier for national delivery, or to our team for local deliveries in the Itria Valley.
Legal basis: performance of contract (Art. 6.1.b GDPR)
Purpose 03
Payments via Stripe
Payment data is processed directly by Stripe, Inc. We do not access or store credit card numbers or banking details. Stripe is PCI DSS Level 1 certified.
Legal basis: performance of contract (Art. 6.1.b GDPR)
Purpose 04
Legal and tax obligations
Retention of accounting and tax documents (invoices, receipts) as required by Italian law (D.P.R. 633/1972).
Legal basis: legal obligation (Art. 6.1.c GDPR)
Purpose 05
Statistical analysis (optional)
Aggregated analysis of site usage via Google Analytics (GA4) to improve the browsing experience. Active only with your consent.
Legal basis: consent (Art. 6.1.a GDPR)
Data retention
Your personal data is kept for the minimum time necessary for the purposes for which it was collected:
When the stated periods expire, data is deleted or anonymised.
Sharing with third parties
We do not sell or transfer your personal data to third parties for commercial purposes. Data is shared only with the following parties, to the extent necessary to provide the service:
- →Stripe, Inc. — payment processing (USA, transfer under Standard Contractual Clauses)
- →BRT Corriere Espresso — parcel delivery in Italy
- →Google Ireland Ltd. — statistical analysis via Google Analytics (only with your consent)
- →Competent authorities — only when required by law or court order
Your rights
Under Articles 15–22 of the GDPR, you have the right to:
Access
Request a copy of the data we hold about you.
Rectification
Correct inaccurate data or have it updated.
Erasure
Request deletion of your data ("right to be forgotten"), where no legal obligation prevents it.
Portability
Receive your data in a structured, machine-readable format, or transfer it to another controller.
Objection
Object to processing based on legitimate interest or consent.
Restriction
Request restriction of processing in specific circumstances provided for by the GDPR.
To exercise your rights, write to apothekealimentare@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it).
Data security
We implement appropriate technical and organisational measures to protect your data from unauthorised access, accidental loss or disclosure. Connections to this site are encrypted via HTTPS/TLS. Payments are processed on Stripe's infrastructure with end-to-end encryption.
Contact
For any questions about this privacy notice or the processing of your personal data:
Apothéke Alimentare
apothekealimentare@gmail.com