Privacy Policy
Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) to users of the supransiol.it website
PhytoItalia S.r.l. attaches great importance to the privacy of its users and customers. In this policy we explain, clearly and transparently, what data we collect through the supransiol.it website, the purposes for which we use it, the legal bases we rely on and the rights you may exercise.
1. Data controller
PhytoItalia S.r.l.
Registered office: Via Valparaiso, 1 – 20144 Milan (MI), Italy
Operational office: Via Gran Sasso, 37 – 20011 Corbetta (MI), Italy
VAT number: 03903090961
Telephone: +39 02 97292427
Privacy contact: gdpr@phytoitalia.it
For any matter concerning the processing of your personal data, and to exercise the rights described in section 8, you may write to gdpr@phytoitalia.it.
2. Data collected, purposes and legal bases
We collect only the data necessary for the purposes described below. We do not process special categories of data (such as health data) unless you voluntarily choose to provide them to us, for example when contacting us with an enquiry.
| Purpose | Data processed | Legal basis |
|---|---|---|
| Website browsing Technical operation and security |
IP address, browser and device type, operating system, pages visited, date and time, server log data | Legitimate interest in ensuring the proper operation and security of the website (Art. 6(1)(f) GDPR) |
| Product purchases Order and contract management |
Name and surname, billing and shipping address, email, telephone number, tax code or VAT number where required, order details | Performance of a contract to which you are party (Art. 6(1)(b) GDPR) |
| Payment | Data required for the transaction. Payment card details are processed directly by the payment service provider and are neither collected nor stored by the Controller | Performance of the contract (Art. 6(1)(b) GDPR) |
| Shipping | Name and surname, delivery address, email, telephone number | Performance of the contract (Art. 6(1)(b) GDPR) |
| Customer account Registration and reserved area |
Email, password (stored in encrypted form), personal details, order history | Performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR) |
| Tax and accounting obligations | Billing data and accounting records | Compliance with legal obligations (Art. 6(1)(c) GDPR) |
| Contact requests Replies and customer support |
Name, email, telephone number if provided, content of the message | Legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR); consent where the message contains special category data (Art. 9(2)(a) GDPR) |
| Newsletter and marketing communications | Email, name | Freely given and revocable consent (Art. 6(1)(a) GDPR) |
| Statistics and measurement | Browsing data collected through analytics cookies | Consent given through the cookie banner (Art. 6(1)(a) GDPR) |
No automated decision-making. We do not carry out any automated decision-making or profiling producing legal effects concerning you, within the meaning of Article 22 GDPR.
3. Nature of the provision of data
Providing the data marked as mandatory in the website forms is necessary in order to act on your request: without it we cannot complete an order, arrange delivery, issue an invoice or reply to a message.
Providing data for newsletter purposes is entirely optional: declining in no way affects your ability to purchase from or use the website. Consent may be withdrawn at any time via the link at the bottom of every message or by writing to the Controller.
4. Recipients of the data
Your data may be disclosed to the following categories of recipients, acting either as processors appointed under Article 28 GDPR or, where they operate independently, as separate controllers:
- the provider of website hosting and maintenance services;
- the payment service provider, which processes transaction data independently under its own privacy policy;
- couriers and logistics operators responsible for delivering orders;
- providers of website traffic analytics services;
- the provider of the newsletter platform, where activated;
- accounting, tax and legal professionals and consultants;
- competent authorities, where required by law or for the establishment of legal claims.
Your data is never disseminated and is not transferred or sold to third parties for their own marketing purposes. An up-to-date list of processors is available on request by writing to gdpr@phytoitalia.it.
5. Transfers of data outside the European Union
Some of the providers we rely on — in particular for analytics services — may process data in countries outside the European Economic Area, notably the United States of America.
In such cases, transfers take place solely where the appropriate safeguards set out in Chapter V GDPR are in place, such as an adequacy decision of the European Commission or the Standard Contractual Clauses approved by Decision (EU) 2021/914, supplemented where necessary by additional protective measures. You may request a copy of the safeguards adopted by writing to gdpr@phytoitalia.it.
6. Retention period
We retain your data for no longer than is necessary for the purposes for which it was collected and, thereafter, for the period required by legal obligations.
| Type of data | Retention period |
|---|---|
| Order and billing data | 10 years from completion of the transaction, as required by Italian civil and tax law |
| Customer account data | For the duration of the relationship and until account deletion is requested |
| Contact requests | As long as needed to handle the request and, as a rule, no longer than 24 months |
| Newsletter data | Until consent is withdrawn |
| Server browsing logs | As a rule no longer than 12 months, save where required to investigate offences |
| Data collected through cookies | As set out in the cookie policy |
At the end of the periods indicated, data is deleted or irreversibly anonymised.
7. Cookies and tracking technologies
The website uses technical cookies, necessary for its operation, and — subject to your consent — analytics and third-party cookies. Technical cookies require no consent; all others are activated only after you have made a choice through the dedicated banner.
You may change or withdraw your preferences at any time using the cookie settings panel available on the website. For the full list of cookies used, together with their purposes and durations, please see the Cookie Policy.
8. Your rights
As a data subject you have the right, at any time, to:
- access your personal data and obtain a copy of it (Art. 15);
- obtain rectification of inaccurate data or completion of incomplete data (Art. 16);
- obtain erasure of your data, in the cases provided for by law (Art. 17);
- obtain restriction of processing (Art. 18);
- receive your data in a structured, commonly used format and transmit it to another controller — data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
To exercise these rights, simply write to gdpr@phytoitalia.it. We will reply without undue delay and in any event within one month of receiving your request, a period which may be extended by a further two months in particularly complex cases.
Right to lodge a complaint. If you believe that the processing of your data infringes applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome — garanteprivacy.it), or with the supervisory authority of the Member State in which you habitually reside.
9. Data security
We implement appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure or access, taking into account the state of the art and the nature of the data processed. These include encryption of communications via the HTTPS protocol, restriction of access to authorised personnel, and procedures for updating and monitoring our systems.
10. Minors
The services offered through the website are not intended for minors. We do not knowingly collect personal data from children under 14 without the consent of the holder of parental responsibility. Should we become aware of any such processing, we will delete the data promptly.
11. Changes to this policy
This policy may be updated to reflect changes in legislation or the introduction of new services. The version in force is always the one published on this page, together with the date it was last updated. We invite you to consult it periodically.
Data controller — PhytoItalia S.r.l., Via Valparaiso 1, 20144 Milan (MI), Italy — VAT 03903090961
Legal reference: Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
Last updated: 5 August 2026