Notice
Notice on the processing of personal data
Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR).
Last updated: 3 April 2026.
This is a courtesy translation. In the event of any discrepancy, the Italian version shall prevail.
1. Data Controller
The controller of personal data is:
| Company name | Plantamed S.r.l. |
|---|---|
| Registered office | Via Anagnina 491 — 00118 Roma (RM) |
| VAT no. / Tax code | 12974761004 |
| info@plantamed.it |
2. Types of Personal Data Processed
The Website collects personal data through the following forms:
2.1 Contact form
The following data are collected through the contact form:
- First and last name
- Email address
- Message sent by the user
2.2 Reserved Area — Customer Registration
To access the reserved area, which is intended exclusively for business (B2B) customers, the following data are collected:
- First and last name of the contact person
- Business email address
- Company name and/or VAT number
- Telephone number
2.3 Newsletter subscription form
Only the email address is required to subscribe to the newsletter. Subscription uses a double opt-in procedure: after entering their email address, the user receives a confirmation message and the subscription is only completed after clicking the confirmation link it contains.
3. Purposes of Processing and Legal Bases
The table below sets out the purposes for which data are processed, the applicable legal basis and the retention periods:
| Form / Area | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Contact form | Handling users' requests and communications | Art. 6(1)(f) — Legitimate interest of the Controller in responding to requests received | 2 years from receipt of the message |
| Reserved Area (B2B) | Managing customer access and providing technical data sheets and downloadable materials | Art. 6(1)(b) — Performance of a contract or pre-contractual measures at the data subject's request | Until deleted by the customer |
| Newsletter | Sending commercial, informational and promotional communications about products and services | Art. 6(1)(a) — Explicit consent of the data subject (double opt-in) | 2 years from subscription, unless consent is withdrawn earlier |
The processing carried out by the Controller is not subject to automated decision-making.
4. Recipients and Processors
Personal data collected may be disclosed, to the extent strictly necessary for the purposes described, to the following categories of recipients:
- Technical and IT service providers (e.g. hosting, website management, IT consultants/companies);
- Email marketing platform providers used to send the newsletter (e.g. Mailchimp);
- Internal staff authorised to process the data.
These parties act as Processors pursuant to Article 28 GDPR, or as independent Controllers, and are required to process data in accordance with applicable law. An up-to-date list of Processors is available on request by writing to the Controller's email address.
5. Transfer of Data to Third Countries
Some service providers (e.g. email marketing platforms) may process data in countries outside the European Union or the European Economic Area. In such cases, the Controller ensures that the transfer takes place in accordance with the safeguards provided for in Articles 44–49 GDPR (for example, European Commission adequacy decisions, Standard Contractual Clauses, bilateral agreements with the EU). Further information can be requested from the Controller.
6. Data Retention Period
Personal data are kept for no longer than is strictly necessary for the purposes for which they were collected, as set out in the table in section 3. After these periods, data will be permanently deleted or anonymised, unless a longer retention period is required by law.
7. Rights of the Data Subject
Under Articles 15–22 GDPR, the data subject has the right to:
- Access (Art. 15): obtain confirmation as to whether personal data concerning them are being processed and access that information;
- Rectification (Art. 16): obtain the correction of inaccurate data or the completion of incomplete data;
- Erasure (Art. 17): obtain the deletion of their data (the "right to be forgotten") in the cases provided for by law;
- Restriction of processing (Art. 18): obtain the restriction of processing in certain cases;
- Data portability (Art. 20): receive their data in a structured, machine-readable format, where applicable;
- Objection (Art. 21): object to processing based on the Controller's legitimate interest;
- Withdrawal of consent (Art. 7): withdraw consent at any time (e.g. unsubscribing from the newsletter), without affecting the lawfulness of processing carried out before withdrawal.
To exercise these rights, the data subject may contact the Controller at: info@plantamed.it.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) — Piazza Venezia 11, 00187 Rome, Italy.
8. Unsubscribing from the Newsletter
The data subject may withdraw their consent to receive the newsletter at any time, without any negative consequences, using one of the following methods:
- By clicking the unsubscribe link at the bottom of every email received;
- By sending a request to the Controller's email address: info@plantamed.it.
Unsubscription requests will be processed within a reasonable time and in any case no later than 10 working days from receipt.
9. Nature of the Provision of Data
Providing data in the website forms is optional. However, failure to provide mandatory data (marked as such in the forms) may make it impossible to handle the user's request or to provide access to the requested services (e.g. replying to a contact message, access to the reserved area, newsletter subscription).
10. Updates to this Notice
The Controller reserves the right to amend or update this notice at any time, including in response to changes in legislation. The updated version will be published on this page with the date of the latest revision. Please check this section periodically.
Last updated: 3 April 2026.