Privacy Policies for Users of the Website
This Privacy Policy explains how Novonette Pharma (“Novonette Pharma”, “we”, “us”, or “our”) processes your personal data when you visit www.novonettepharma.com (the “Website”). We process your data in accordance with applicable data protection laws, including EU Regulation 2016/679 (GDPR) and, where applicable, UK GDPR.
1) Identity and Contact Details of the Controller
Controller: Novonette Pharma [legal form, e.g., S.r.l./Ltd./Inc.]
Registered office: [Full registered address]
Company/VAT/Registration No.: [Number]
Email: privacy@novonettepharma.com
If Novonette Pharma is established in the EEA/UK, no representative is required. If not, please insert details for your EU/UK representative here.
2) Data Protection Officer (DPO)
Novonette Pharma [has/has not] appointed a Data Protection Officer pursuant to Article 37 GDPR.
If appointed: DPO contact: [Name/Service], [email or web form]
If not appointed: No DPO has been designated.
3) Data We Process When You Use the Website
To establish and maintain a secure connection to the Website, our systems automatically collect certain log data, such as:
IP address of the device used;
Date and time of access;
Browser type and version;
Operating system and device information.
These data are necessary for the technical delivery of the Website, security, and to prevent abuse.
4) Purposes, Legal Bases, and Whether Provision is Required
Website browsing and security
Purpose: To enable and secure your access to the Website, ensure functionality, and prevent malicious activity.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) to provide the Website/services you request, and legitimate interests (Article 6(1)(f) GDPR) in operating a secure, reliable site.
Required? Yes, these data are necessary to deliver the Website properly.
Responding to enquiries (forms or email)
Purpose: Handling requests you submit via contact forms or email.
Legal basis: Legitimate interests (Article 6(1)(f) GDPR) to respond to your requests, or performance of a contract where your request relates to pre-contractual/contractual steps.
Required? Optional, but we cannot respond without relevant details.
Direct marketing communications
Purpose: Sending newsletters, updates, promotional materials, and conducting market research via email/SMS or similar tools.
Legal basis: Consent (Article 6(1)(a) GDPR).
Required? Optional. Without consent, we won’t send marketing communications.
Profiling for personalization (if enabled)
Purpose: Understanding your preferences to tailor content and offers.
Legal basis: Consent (Article 6(1)(a) GDPR).
Required? Optional. Without consent, no profiling will be performed.
Compliance with legal obligations
Purpose: Meeting obligations under applicable laws (e.g., accounting, regulatory, pharmacovigilance if relevant).
Legal basis: Legal obligation (Article 6(1)(c) GDPR).
Required? Where mandated by law.
5) Automated Decision-Making and Profiling
If you consent to profiling, we may use automated logic to tailor communications, offers, or event invitations to your interests. Under Article 22 GDPR, you have the right to:
obtain human intervention;
express your point of view;
receive an explanation of the decision;
contest the decision.
No solely automated decisions with legal or similarly significant effects will be taken without your explicit consent or a separate lawful basis.
6) Source of Personal Data
We process only the personal data you provide to us (e.g., via forms or emails) and technical data generated by your interaction with the Website. We do not collect personal data from publicly available sources for the purposes described here.
7) Recipients (Categories) of Personal Data
We may share personal data with trusted service providers acting as processors under contracts that require appropriate safeguards, including:
Marketing and communications providers, including platforms supporting newsletters and, where consented, profiling activities;
IT and hosting providers delivering infrastructure, maintenance, and security;
Analytics, survey, and market research providers (where consented or otherwise lawful);
Professional advisers (e.g., legal or compliance) where necessary;
Authorities where required by law.
A detailed list of processors can be requested at privacy@novonettepharma.com.
8) Categories of Personal Data Processed
Browsing/log data needed to establish your connection to the Website;
Identity and contact details you provide (e.g., name, email, phone) via forms or email;
Marketing preferences and contact details where you opt in to receive communications;
Preference data derived from profiling (only if you consent);
Compliance data necessary to meet legal obligations.
9) International Data Transfers
Some recipients may be located outside your country/region (including outside the EEA/UK), for example in the United States. Where we transfer personal data internationally, we rely on adequacy decisions (e.g., EU/UK adequacy), certifications (such as the EU-U.S. Data Privacy Framework where applicable), or Standard Contractual Clauses (SCCs) with supplementary measures as needed to ensure an adequate level of protection.
You may request copies or information about the applicable transfer safeguards at privacy@novonettepharma.com.
10) Retention Periods
We keep personal data only as long as necessary for the purposes collected or as required by law:
Browsing/log data: retained for 6 months from session end (unless longer needed for security/incident investigation).
Enquiry data (forms/emails): retained only as long as needed to handle your request and for a reasonable period to evidence our communications.
Marketing data: retained until you withdraw consent or unsubscribe; we will then cease processing and delete or anonymize marketing data without undue delay, subject to necessary suppression records to honor your opt-out.
Profiling data: retained until you withdraw consent; upon withdrawal, profiling ceases and related personal data are deleted or anonymized without undue delay.
Compliance records: retained in accordance with legal retention periods.
11) Right to Object
You have the right to object at any time:
to processing based on legitimate interests (Article 6(1)(f) GDPR) for reasons related to your particular situation;
to processing for direct marketing, including related profiling. If you object to direct marketing, we will stop processing for that purpose. You may object in whole or in part (e.g., only to automated emails or only to phone calls).
12) Your Other Rights
Subject to conditions under GDPR, you may exercise:
Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction (Art. 18)
Right to data portability (Art. 20)
Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal (Art. 7(3))
Right to lodge a complaint with a supervisory authority (Art. 77)
Supervisory authority:
If in Italy: Garante per la Protezione dei Dati Personali (see contact details at https://www.garanteprivacy.it/home/footer/contatti).
If elsewhere in the EEA/UK: your local authority or the UK ICO.
Please consult the relevant authority’s website for contact details.
13) How to Exercise Your Rights
Please contact us using the details below, stating which right(s) you wish to exercise and providing information to verify your identity:
Email: privacy@novonettepharma.com
Postal address: [Insert full postal address for rights requests]
Phone (if applicable for identity-verified oral requests): [+Country code / number]
14) Accessibility of this Privacy Policy
This Privacy Policy is available at www.novonettepharma.com and at our registered office. Upon verified identity, we can provide the information orally if expressly requested via [phone number(s)].
15) Changes to this Privacy Policy
We may update this Privacy Policy to reflect legal, technical, or business developments. We will post the new version on the Website and notify you via a site pop-up or other appropriate means. If we introduce new purposes and/or process new categories of personal data, we will inform you and, where required, request your consent.
Notes for finalization (please replace before publishing)
[legal form], [address], [registration/VAT], [country of establishment], [phones]
Confirm DPO status and, if appointed, insert DPO contact details.
Review retention periods and international transfer mechanisms to match your vendors and internal policies.
If you use cookies/analytics/ads, publish a Cookie Policy and consent mechanism aligned with ePrivacy/TCF requirements.
If you want, I can also generate a matching Cookie Policy and a short privacy notice for contact forms/newsletter sign-ups.