Privacy & Cookie Policy (English)
Last updated: September 2026
1. Data controller
The data controller is Farmacie della Salute 360 S.r.l., the company operating Farmacia Scoccianti, with registered office at Via Franco Pallucchi 29, 06049 Spoleto (PG), Italy, VAT no. 03227060542. Contact: phone +39 0743 223242, email info@farmaciascoccianti.com, certified email (PEC) farmaciedellasalute360srl@pec.it.
2. What data we process
Through this website we may collect: contact details you enter in our forms (name, phone, email, Italian tax code for product requests only); health-related data (art. 9 GDPR) only if you provide it, such as the service you wish to book, the NRE codes of electronic prescriptions or notes describing health conditions — please do not include health information that is not needed to handle your request; and minimal technical browsing data required for the website to work.
No file or image uploads are possible on this website. To send a photo of a prescription you may use WhatsApp, as described in section 5.
3. Purposes and legal bases
We process your data to handle bookings and product requests (pre-contractual measures, art. 6.1.b GDPR); to process the health data needed for a booking or prescription (your explicit consent, art. 9.2.a GDPR, given through a dedicated checkbox); to answer your messages (legitimate interest, art. 6.1.f GDPR); to send an automatic confirmation email and an internal notification to our staff (art. 6.1.b GDPR); to send an SMS reminder of your appointment (consent, art. 6.1.a GDPR, optional and revocable); to send, the day after a service, an SMS inviting you to leave a Google review (only if you accepted SMS, at most 3 times a year, and you may ask us to stop at any time: legitimate interest, art. 6.1.f GDPR, with right to object); and to comply with legal obligations (art. 6.1.c GDPR).
The "I declare that I have read the Privacy Policy" checkbox in our forms confirms that you have read this notice; it is not a consent. The legal bases are those listed above. Providing the data marked as required is necessary to handle your request. You may withdraw your consents at any time, without affecting the lawfulness of prior processing.
4. How data is handled and who receives it
Form submissions pass through the Netlify Forms anti-spam service and are immediately recorded in our private archive, hosted on servers in the European Union (Frankfurt); the transient copy at Netlify is deleted right after recording. The archive is accessible only to authorised pharmacy staff, through a private area with personal access, and requests are deleted when no longer needed (section 7).
Data may be processed, as processors or independent controllers, by: Netlify, Inc. (hosting and form transit); Supabase, Inc. (private archive of the agenda and requests, EU servers); the pharmacy's email service provider (automatic confirmation email, only if you provide an email address, and internal staff notification); Skebby / BSP S.r.l. (SMS reminders and review invitations, only if you accepted SMS); Google Ireland Ltd. (internal staff calendar with name, phone and booked service; interactive map only if you consent to loading it); OpenStreetMap Foundation (route calculation for home visits: only the address is sent, never the name). Confirmation emails and staff notifications never repeat the sensitive content of your request.
5. Sending prescriptions and documents via WhatsApp
If you choose to send us a photo of a prescription (or another document) via WhatsApp, we process the images you send, which contain health-related data (prescriptions, medicines), for the sole purpose of handling your product request. The controller is Farmacie della Salute 360 S.r.l. (Farmacia Scoccianti); the images are visible only to the authorised staff handling the request.
Messages are sent through the WhatsApp application of Meta Platforms Ireland Ltd., which processes them under its own privacy policy and with the safeguards provided by the vendor (including end-to-end encryption of chats): by choosing this channel you accept that the message passes through Meta's systems, also outside the European Union, with the safeguards described in section 6.
Images are deleted from the chat right after the request is fulfilled and in any case within a few days; they are never stored on the website or in the private archive. You may exercise the rights described in section 8 at any time, including early deletion. You can always hand in the prescription in person at the pharmacy instead.
6. Transfers outside the EU
Some providers (Netlify, Meta Platforms for WhatsApp) are based or have servers in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-U.S. Data Privacy Framework. The private archive of the agenda is located in the European Union.
7. Retention
Completed booking and product requests, messages and feedback (product collected or request handled): automatically deleted after 90 days; requests not yet completed: after 180 days; appointments in the agenda: as long as needed for continuity of service (treatment cycles) and no longer than 180 days after the appointment date, cancelled appointments after 30 days; images received via WhatsApp: deleted once the request is fulfilled (section 5); technical logs: as per the hosting provider's terms.
8. Your rights
Under articles 15-22 GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data. Write to info@farmaciascoccianti.com. You may also lodge a complaint with the Italian supervisory authority (www.garanteprivacy.it).
9. Cookies and similar tools
This website follows a minimisation approach. Technical cookies / local storage (always active) only remember your cookie choice and, in the staff area, the working session. Google Maps loads only after your click or consent in the banner; Google may set its own cookies according to the Google privacy policy. If enabled, visit statistics use GoatCounter, a cookie-free tool that does not identify visitors. Statistics and marketing (Google Analytics / Google Tag Manager), only with your consent: if enabled, Google Analytics 4 or Google Tag Manager with the tools it loads (Google Ireland Ltd.) measure visits and may set measurement or marketing cookies; without your consent, given in the banner under "Statistics and marketing", nothing is loaded and consent signals stay denied (Google Consent Mode). See the Google privacy policy. Fonts are self-hosted: no request is sent to Google Fonts.
You can change your choice at any time with the button below or the "Manage cookies" link in the footer.
10. Changes to this notice
Any changes will be published on this page with an updated date.