Omegor.com Privacy Policy

Who is the Data Controller?

How can I contact the Controller?

1. Introduction

Under the European General Data Protection Regulation (GDPR), legal entities are not considered data subjects and the European regulation therefore does not apply to them. However, if personal data relating to a natural person are included when company data are collected, that person is to be considered a data subject within the meaning of the aforementioned regulation, and the relevant legislation consequently applies.

2. What processing activities are carried out through the website? What are the legal bases, purposes and retention periods?

REGISTRATION	PURPOSE	The purpose of the data processing is to register on the website and to make purchases more easily.
	LEGAL BASIS	Consent.
	RETENTION PERIOD	If the account remains inactive for 3 years, we will send you an email to ask whether you still wish to keep it active; otherwise the account will be deleted. Data will be processed for a longer period in the event of a dispute.
	OTHER INFORMATION	Registration is not mandatory in order to make purchases, as it is also possible to proceed in "guest" mode.
	REGISTRATION VIA SOCIAL MEDIA	The website offers the option to register via social media. The data will therefore not be provided directly by the Data Subject but imported from Shop and processed pursuant to Art. 14 GDPR. The data processed are: personal details and email address.

PURCHASE	PURPOSE	The main purpose of the data processing is to enable the User to purchase and receive the requested product; the data are also necessary to comply with legal obligations (including accounting and tax obligations). The data may be needed in the event of disputes concerning the proper performance of the contract.
	LEGAL BASIS	Performance of a contract and the resulting compliance with legal obligations incumbent on the Controller. In the event of a dispute, the data will be processed to establish, exercise or defend legal claims, which corresponds to the legitimate interest of the Controller.
	RETENTION PERIOD	The data will be deleted 10 years after performance of the contract. They may be retained for longer only in the event of disputes, and therefore to establish, exercise or defend a right on the basis of the Controller's legitimate interest.
	OTHER INFORMATION	Providing the data is mandatory; if you refuse to provide it, you will not be able to purchase the requested products.

PURCHASE WITH EXPRESS CHECKOUT	PURPOSE	The main purpose of the data processing is to enable the User to purchase and receive the product bought. The data are also necessary to comply with legal obligations (including accounting and tax obligations). Finally, they may be needed in the event of disputes concerning the proper performance of the contract.
	LEGAL BASIS	Performance of a contract and the resulting compliance with legal obligations incumbent on the Controller. In the event of a dispute, the data will be processed to establish, exercise or defend legal claims, which corresponds to the legitimate interest of the Controller.
	RETENTION PERIOD	The data will be deleted 10 years after performance of the contract. They may be retained for longer only in the event of disputes, and therefore to establish, exercise or defend a right on the basis of the Controller's legitimate interest.
	SOURCE AND CATEGORIES OF DATA PROCESSED	In the case of a purchase through express checkout, personal details, shipping, billing and contact data will be imported from PayPal, Shop Pay or Google Pay. (Art. 14 GDPR)

NEWSLETTER / DEM	PURPOSE	The purpose of the data processing is to send the User newsletters and DEM (direct email marketing) by traditional or automated means.
	LEGAL BASIS	Consent given by the Data Subject pursuant to Art. 6(1)(a) GDPR and Art. 130(1)-(2) of Italian Legislative Decree 196/03.
	RETENTION PERIOD	1 year from the last mailing or until consent is withdrawn.
	OTHER INFORMATION	Consent may be withdrawn at any time, including limited to the tracking pixel. The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose.

NEWSLETTER / DEM "softspam"	PURPOSE	The purpose of the data processing is to send the User newsletters and DEM.
	LEGAL BASIS	Art. 130(4) of Italian Legislative Decree 196/03.
	RETENTION PERIOD	1 year from the last mailing or until consent is withdrawn.
	OTHER INFORMATION	Subscription is automatic following a purchase on the e-commerce site. However, consent may be withdrawn at any time, including limited to the tracking pixel.

TRANSACTIONAL EMAILS	PURPOSE	The purpose of the data processing is to send the User information relating to the purchase made or to complete the registration.
	LEGAL BASIS	Performance of a contract.
	RETENTION PERIOD	Until the order is delivered or the registration is completed.
	OTHER INFORMATION	Transactional emails are sent to allow better management of orders and to provide the Customer with confirmation of the purchase, shipment and registration.

BACK IN STOCK	PURPOSE	The purpose of the data processing is to give the user the option of being contacted when a product becomes available again.
	LEGAL BASIS	Performance of pre-contractual measures taken at the request of the Data Subject.
	RETENTION PERIOD	The data will be processed until the product becomes available again, after which they will be deleted, and in any case after a maximum of 6 months.
	OTHER INFORMATION	The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose.

ASK THE PHARMACIST	PURPOSE	The purpose of the data processing is to ask the pharmacist for information about supplements, nutrition and health.
	LEGAL BASIS	Performance of a contract.
	RETENTION PERIOD	The data will be processed for the time necessary to respond to the requests, after which they will be deleted.
	OTHER INFORMATION	The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose.

ABANDONED CART	PURPOSE	The purpose of the data processing is to be able to send 1 email inviting the user to complete a purchase left unfinished on the website.
	LEGAL BASIS	Legitimate interest of the Controller in the completion of the purchase.
	RETENTION PERIOD	72 hours.
	OTHER INFORMATION	The data are provided automatically as a result of the cart being partially filled in.

QUIZ	PURPOSE	The purpose of the data processing is to enable the User to identify the supplements best suited to their lifestyle through a guided series of questions.
	LEGAL BASIS	Consent of the Data Subject.
	RETENTION PERIOD	The data will be processed for the time necessary to complete the quiz, after which they will be deleted.
	OTHER INFORMATION	The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose.

MARKETING AND PROFILING THROUGH DIGITAL PLATFORMS	PURPOSE	The purpose of the data processing is to show marketing content based on your interests, as identified through your interactions on our website or social media. This includes the use of retargeting tools of digital platforms to deliver targeted advertising messages.
	LEGAL BASIS	Consent, which may be obtained through: (a) the cookie settings on the website; (b) explicit consent for Custom Audience CRM campaigns (prospecting and retargeting); (c) interaction with social media pages, in accordance with the User's social media privacy settings.
	RETENTION PERIOD	The data will be retained until consent is withdrawn through the cookie settings.
	OTHER INFORMATION	The User may manage or withdraw consent at any time as described in the Cookie Policy. Consent for Custom Audience CRM campaigns allows the data to be processed to identify lookalike audiences and show targeted ads. In the case of simple segmentation, consent is not required.

CONTACT	PURPOSE	The purpose is to contact the company to request information.
	LEGAL BASIS	Performance of pre-contractual measures taken at the request of the Data Subject.
	RETENTION PERIOD	We will process the data for the time necessary to respond to the requests and will then delete them. Whether the data have become obsolete is checked every 12 months.
	OTHER INFORMATION	The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose.

REVIEWS	PURPOSE	The purpose is to share one's experience and to promote the company.
	LEGAL BASIS	Legitimate interest of the Controller in requesting the review and the consent given by the Data Subject in providing it.
	RETENTION PERIOD	Reviews are requested 10 days after purchase and will be published on the website until they become obsolete and/or until consent is withdrawn.
	OTHER INFORMATION	The data are provided automatically for the purpose of the request following the purchase of the product. In addition, reviews may be imported to the other websites owned by U.G.A. Nutraceuticals S.r.l.

BROWSING DATA	PURPOSE	Website security.
	LEGAL BASIS	Legitimate interest of the company in IT security and compliance with legal obligations. The legal basis for the processing of cookies other than necessary ones is consent.
	RETENTION PERIOD	24 months.
	OTHER INFORMATION	For the rules on cookies, please refer to the dedicated notice.

Tracking of email communications

Promotional communications sent by the Controller through the Klaviyo platform may contain tracking tools that make it possible to detect the recipient's interactions with the message received, such as opening the email and clicking on the links it contains.

When such interactions occur, information such as the date and time of the interaction, the IP address and the type of device used (user-agent) may be collected and associated with the recipient, as well as, in the case of a click, the message concerned and the link selected.

This information is used to measure the effectiveness of campaigns and may also be used to segment recipients, trigger automations and communication flows, and personalise subsequent mailings on the basis of the interactions carried out.

The processing is carried out on the basis of the data subject's consent, collected together with the consent to receive promotional communications.

The data subject may withdraw consent to tracking at any time, even while continuing to receive promotional communications, through the preference management link included in the emails. It also remains possible at all times to withdraw consent to receive promotional communications altogether.

Withdrawal does not affect the lawfulness of processing carried out before it.

3. What else do I need to know?

The data will be processed lawfully, fairly and with the utmost confidentiality, in compliance with appropriate security measures as provided for by the Code and the Regulation. The processing will be carried out by digital means. The data will not be publicly disseminated, with the exception of reviews. Furthermore, the user will not be subject to automated decision-making such as profiling unless they consent to it by installing cookies or other tracking tools, for the rules on which reference is made to the dedicated notice.

4. To whom will my data be disclosed?

The Controller may disclose the data to all parties to whom disclosure is mandatory by law for the purposes provided for by law.

The Controller also uses certain companies or IT tools that carry out processing activities on data subjects' personal data solely in the interest of the Controller, all duly appointed as processors pursuant to Art. 28 GDPR.

The data will also be disclosed to payment gateways as independent controllers.

The list of processors is available at the Controller's premises.

The Company uses persons designated as System Administrators, in charge of managing and maintaining the IT systems. The updated list of System Administrators is available at the Controller's office and may be consulted upon request by the data subject.

5. Where are the data stored and transferred?

The management and storage of personal data will take place on servers located inside and outside the EU. The Controller guarantees that transfers outside the EU take place in compliance with Arts. 44-47 of Chapter V of the GDPR, by means of standard contractual clauses and/or EU Commission adequacy decisions.

6. What are my rights and how can I exercise them?

a) Rights of the data subject

The user, in their capacity as data subject, has the rights set out in Art. 15 et seq. of the Regulation, namely:

1. RIGHT OF ACCESS (Art. 15 GDPR) The data subject has the right to obtain confirmation of whether or not personal data concerning them exist, even if not yet recorded, and to have such data communicated to them in an intelligible form.

2. RIGHT TO RECTIFICATION (Art. 16 GDPR) The data subject has the right to obtain the rectification of inaccurate personal data concerning them and the completion of incomplete data.

3. RIGHT TO ERASURE (Art. 17 GDPR) The data subject has the right to obtain the erasure of personal data where particular grounds apply, such as withdrawal of consent, objection to the processing, or where the data are no longer necessary in relation to the purposes for which they were collected and processed, or in the case of unlawful processing. Erasure will not always be possible, but the Controller will in any case be required to provide adequate justification.

4. RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR) The data subject has the right to obtain restriction of processing in particular cases, such as, for example, where a request for rectification or an objection is made, for the time needed to assess the requests.

5. RIGHT TO DATA PORTABILITY (Art. 20 GDPR) If the processing is based on consent or on a contract and is carried out by automated means, the data subject may receive the data in a structured, commonly used and machine-readable format or request that they be transmitted to another controller.

6. RIGHT TO OBJECT (Art. 21 GDPR) The data subject has the right to object, in whole or in part: a) on legitimate grounds, to the processing of personal data concerning them, even where relevant to the purpose of collection; b) to the processing of personal data concerning them for the pursuit of purposes not covered by Art. 2. The user may submit a request to object setting out the reasons that justify the objection: the Controller reserves the right to assess the request, which would not be accepted where there are compelling legitimate grounds for the processing that override the interests, rights and freedoms of the user.

7. RIGHT TO LODGE A COMPLAINT The data subject has the right to lodge a complaint with the competent supervisory authority under Article 77 GDPR if they consider that the processing of their data infringes the applicable legislation.

b) How to exercise your rights

The data subject may exercise the rights referred to in the preceding article at any time by contacting the Controller at the addresses indicated above.