Information on the processing of personal data
pursuant to art. 13 of Regulation (EU) 2016/679 (GDPR) and of Italian Legislative Decree 196/2003 as amended by Italian Legislative Decree 101/2018
This notice describes how the personal data of the users who visit the lodifa.it website and of the customers of Lodifa Srl's B2B platform are processed. The website is currently at the stage of presenting the services; a B2B platform dedicated to pharmacies and parapharmacies will be launched in the future.
2. Data controller
The data controller is Lodifa Srl, with registered office at Via XX Settembre, 47 – 00187 Rome, Italy, VAT no. 16417251002, certified e-mail (PEC) lodifasrl@pec.it, tel. +39 081 5706612, e-mail info@lodifa.it.
Lodifa Srl has not appointed a Data Protection Officer (DPO), as the conditions that make it mandatory under art. 37 GDPR are not met. For any matter relating to the processing of personal data, you can contact the controller at the details above.
3. Types of data processed
3a. Browsing data
The computer systems acquire, in the course of their normal operation, data whose transmission is implicit in the use of Internet protocols: IP addresses, URLs of the resources requested, time of the request, and parameters of the operating system and browser used. These data are processed solely for security and diagnostic purposes and are kept for a limited period.
3b. Data provided voluntarily through the contact form
The data provided through the contact form (name, e-mail address, any telephone number and the content of the message) are processed to reply to the request received. Providing them is optional, but failing to provide the data marked as mandatory makes it impossible to handle the request.
3c. B2B customer data (platform stage)
With the launch of the B2B platform, the following will be processed: company registry data (company name, VAT number, tax code, registered and operating offices, SDI code, company PEC); identification and contact data of company contacts (natural persons acting on behalf of the customer); credentials to access the platform; data on wholesale orders (products, quantities, prices); invoicing data.
Data on wholesale orders are not data concerning health within the meaning of art. 9 GDPR, as they relate to the commercial activity of the customer as a legal person, and not to the state of health of identifiable natural persons.
3d. Applicants' data
The data sent with the «Work with us» form (first name, surname, e-mail, telephone, city, position of interest, cover note and attached CV) are processed to assess the application and, if the profile is of interest, to contact the applicant for the selection. The site does not store the CV: the application is forwarded by e-mail to Farmacie Lombardi S.r.l., the recipient of applications, which handles the selection. The data are kept for 12 months from receipt of the application and then deleted; the applicant may ask for earlier deletion and withdraw consent using the contact details in section 2.
4. Purposes and legal bases
| Processing | Legal basis | Retention |
|---|---|---|
| Reply to the contact form | Pre-contractual measures / legitimate interest (art. 6.1.b and f GDPR) | Until the request is handled, 24 months at most |
| Registration and account management | Performance of a contract (art. 6.1.b GDPR) | Lifetime of the account |
| Management of wholesale orders | Performance of a contract (art. 6.1.b GDPR) | Duration of the relationship + 10 years |
| Invoicing and accounting | Legal obligation (art. 6.1.c GDPR; art. 2220 Italian Civil Code; art. 39 Presidential Decree 633/1972) | 10 years |
| Medicine traceability | Legal obligation (art. 6.1.c GDPR; Ministerial Decree of 15 July 2004) | As required by sector regulations |
| Management of company contacts | Legitimate interest (art. 6.1.f GDPR) | Duration of the business relationship |
| Browsing and security data | Legitimate interest (art. 6.1.f GDPR) | A few months |
| Recruitment (applications from «Work with us») | Pre-contractual measures at the data subject's request and consent (art. 6.1.b and a GDPR) | 12 months from receipt of the application |
| Card payment of orders | Performance of a contract (art. 6.1.b GDPR) | Same as orders: duration of the relationship + 10 years |
| Protection of forms against automated submissions and abuse | Legitimate interest (art. 6.1.f GDPR) | The time needed for the check |
| Technical cookies | Performance of the service requested (art. 122 Italian Legislative Decree 196/2003) | Session / technical duration |
| Statistics on the use of the site (Google Analytics 4) | Consent (art. 6.1.a GDPR; art. 122 Italian Legislative Decree 196/2003) | Until consent is withdrawn; cookies up to 2 years |
| Marketing to company contacts | Consent or legitimate interest (art. 6.1.a/f GDPR; Recital 47) | Until consent is withdrawn or an objection is made |
5. Recipients and external processors
Personal data may be disclosed, as data processors pursuant to art. 28 GDPR, to the following providers of technology services, with which a specific data processing agreement (Data Processing Agreement) has been entered into:
- Vercel Inc. (hosting, content delivery network and aggregate measurements of use and speed of the site: Vercel Web Analytics and Speed Insights)Purpose: to deliver the site, ensure its security and performance, and measure its use and speed in aggregate form.Data: IP address and technical data of each request; for the aggregate measurements, only the address of the page, without parameters or identifiers.Legal basis: performance of the service requested and legitimate interest (art. 6.1.b and f GDPR).Location: infrastructure distributed globally (CDN); the functions of the site run in Dublin (EU).Safeguard for transfers outside the EU: certified under the EU-U.S. Data Privacy Framework; the transfer to the USA is covered by the European Commission adequacy decision of 10 July 2023 (art. 45 GDPR).
- Supabase (database and authentication)Purpose: to store account, order and uploaded-document data; to authenticate users.Data: registry and contact data, access credentials (in encrypted form), orders, documents uploaded by users.Legal basis: performance of a contract and legal obligations (art. 6.1.b and c GDPR).Location: the database of the site is located in the European Union (Ireland).Safeguard for transfers outside the EU: the transfer outside the EU is guaranteed by the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR).
- Resend (sending of transactional e-mail communications)Purpose: to send confirmations, notifications, invitations and access links, and documents (for example the pro forma of the order).Data: e-mail address and name of the recipient, references of the order or request, and attached documents (for example the pro forma or the CV sent with an application).Legal basis: performance of a contract and pre-contractual measures (art. 6.1.b GDPR).Location: provider based in the United States.Safeguard for transfers outside the EU: the transfer outside the EU is guaranteed by the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR).
- Google Ireland Limited (statistics on the use of the site: Google Analytics 4, only with the user's consent)Purpose: to measure the use of the site in aggregate form in order to improve it.Data: address of the page and of the referring site without parameters, identifiers of the statistics cookies, technical data of the browser and IP address, which Google receives as with any request. Advertising and personalisation features are disabled.Legal basis: consent (art. 6.1.a GDPR; art. 122 Italian Legislative Decree 196/2003), which can be withdrawn at any time.Location: Ireland (EU), with possible transfer to Google LLC in the United States.Safeguard for transfers outside the EU: Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023, art. 45 GDPR).
- Cloudflare, Inc. (Cloudflare Turnstile anti-bot check on the registration forms of customers and suppliers)Purpose: to protect the forms against automated submissions and abuse.Data: IP address, technical data of the browser and verification code.Legal basis: legitimate interest in the security of the forms (art. 6.1.f GDPR).Location: infrastructure distributed globally; provider based in the United States.Safeguard for transfers outside the EU: certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023, art. 45 GDPR).
- iubenda S.r.l. (management of cookie consent)Purpose: to display the banner and to record and respect the user's choices on cookies.Data: the user's choices, IP address and technical data of the browser.Legal basis: legitimate interest in documenting the user's choices (art. 6.1.f and art. 7(1) GDPR).Location: provider based in the European Union (Italy).Safeguard for transfers outside the EU: no transfer outside the EU by Lodifa Srl.
Other parties receive data in the context of specific services, under their own terms:
- Nexi Payments S.p.A. (card payment of orders)Purpose: to allow payment by card when the customer chooses it.Data: the customer enters the card details directly on the Nexi payment page: they do not pass through the systems of Lodifa Srl. Only the order code, the amount and the currency are sent to Nexi.Legal basis: performance of a contract (art. 6.1.b GDPR).Location: provider based in the European Union (Italy).Safeguard for transfers outside the EU: no transfer outside the EU by Lodifa Srl.
- European Commission (VIES VAT number validation service)Purpose: to check the VAT number of a new customer at the time of the invitation.Data: the VAT number only, queried by the operators of Lodifa Srl; the service returns the company name and address.Legal basis: legitimate interest in checking the customer's tax data (art. 6.1.f GDPR).Location: European Union.Safeguard for transfers outside the EU: no transfer outside the EU.
- Farmacie Lombardi S.r.l. (recipient of the applications sent with the «Work with us» form)Purpose: handling recruitment (section 3d).Data: the form data and the attached CV, received by e-mail.Legal basis: pre-contractual measures at the data subject's request and consent (art. 6.1.b and a GDPR).Location: company based in Italy.Safeguard for transfers outside the EU: no transfer outside the EU by Lodifa Srl.
Data are not disseminated or transferred to third parties for the latter's own purposes.
6. Transfers outside the EU
Data are processed mainly within the European Union. Where personal data are transferred to third countries, the transfer is carried out in compliance with the safeguards provided for by arts. 44-49 GDPR (adequacy decision or Standard Contractual Clauses), as specified in the previous section. The database of the site is located in the European Union (Ireland) and the functions of the site run in Dublin.
7. Retention periods
Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected, in compliance with the data minimisation principle (art. 5(1)(e) GDPR), and in any case not beyond the terms indicated in the table in section 4. After the retention period, data are deleted or irreversibly anonymised.
8. Rights of data subjects
Under arts. 15-22 GDPR, data subjects have the right to:
- access their personal data (art. 15);
- obtain the rectification of inaccurate or incomplete data (art. 16);
- obtain the erasure of data (art. 17), in the cases provided for;
- obtain the restriction of processing (art. 18);
- receive the data in a structured, machine-readable format — portability (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw consent at any time, without affecting the lawfulness of the processing carried out before the withdrawal (art. 7(3)).
To exercise their rights, data subjects can send a written request to: info@lodifa.it or lodifasrl@pec.it. The controller replies within 30 days of receiving the request (extendable by a further 60 days in case of particular complexity).
9. Complaint to the supervisory authority
Data subjects also have the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority), Piazza Venezia 11 – 00187 Rome, website: www.garanteprivacy.it.
10. Security measures
Lodifa Srl adopts technical and organisational measures appropriate to guarantee a level of security suited to the risk, pursuant to art. 32 GDPR, including: encrypted transmission of data via the HTTPS/TLS protocol; hashing of access credentials; access control based on the principle of least privilege; periodic data backups; security incident management procedures.
12. Changes to this notice
The controller reserves the right to amend this notice at any time. Changes will be published on this page with an indication of the update date. Users are invited to consult this page periodically.
Last updated: 29 October 2026