Privacy Policy

Last updated: October 13, 2026

This Privacy Policy explains how erboristerianaturalmente.com (“we”, “us”) collects and uses personal data of visitors and customers of erboristerianaturalmente.com (the “Website”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended.

1. Data Controller

The data controller is the operator of erboristerianaturalmente.com (the “Controller”), who can be contacted for any privacy matter at info@caramellanaturale.com

2. Data we collect

  • Identification and contact data: name, surname, email address, phone number, shipping and billing address, tax code or VAT number where required for invoicing.
  • Order and payment data: products purchased, order history, payment method. Card details are processed directly by our payment providers and are never stored by us.
  • Account data: username and encrypted password, if you register.
  • Health-related information you choose to share: for example allergies or conditions mentioned when asking for product advice. Please share only what is necessary; we process it solely to answer your request and with your explicit consent (Art. 9(2)(a) GDPR).
  • Navigation data: IP address, browser type, pages visited and similar technical data, collected through cookies and server logs (see the Cookie Policy).

Purpose

Legal basis

Retention

Processing orders, shipping, customer service

Performance of a contract (Art. 6(1)(b))

Duration of the relationship, then 10 years for accounting and tax records

Invoicing and legal obligations

Legal obligation (Art. 6(1)(c))

10 years

Managing your customer account

Performance of a contract (Art. 6(1)(b))

Until you delete the account

Answering enquiries and product advice requests

Pre-contractual measures / consent for health data

Time needed to answer, max 12 months

Newsletter and marketing emails

Consent (Art. 6(1)(a))

Until you withdraw consent

Emails about products similar to those purchased (soft spam)

Legitimate interest, Art. 130(4) Privacy Code

Until you object

Website security and fraud prevention

Legitimate interest (Art. 6(1)(f))

6 months for logs

Analytics and profiling cookies

Consent

As stated in the Cookie Policy

Providing data marked as required at checkout is necessary to complete an order. Marketing consent is optional and refusing it has no consequence on your purchases.

4. Recipients

Your data may be shared with service providers acting as processors under Art. 28 GDPR, including: hosting and e-commerce platform providers, payment providers, couriers, email marketing services, accountants and IT consultants. Data may also be disclosed to public authorities when required by law. We never sell your personal data.

5. Transfers outside the EU

Some providers may process data outside the European Economic Area. Where this happens, transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission.

6. Your rights

Under Articles 15-22 GDPR you may at any time request access to your data, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interest or for direct marketing, and withdraw consent without affecting earlier lawful processing. Write to info@caramellanaturale.com; we will reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of your EU country of residence.

7. Security

We use appropriate technical and organisational measures, including HTTPS encryption and restricted access, to protect your data against loss, misuse and unauthorised access.

8. Minors

The Website is not intended for people under 18. We do not knowingly collect data from minors.

9. Changes

We may update this Policy. The current version is always published on this page with its date of last update.