Personal data processing notice

1. Data controller

The controller of the personal data collected through this website is:

2. Scope and protection of minors

This notice covers the blastimincomplex.com website only. It does not apply to third-party websites reachable through the links on these pages — for example the PubMed, PMC and DOI scientific databases and the European Patent Office publication server — for which the Controller is not responsible and to which the respective notices apply.

Processing follows the principles of lawfulness, fairness and transparency set out in Article 5 GDPR: data are collected for specified, explicit and legitimate purposes, and are adequate, relevant and limited to what is necessary for those purposes (data minimisation).

The contact forms on this website are reserved for adults. The Controller does not knowingly collect data relating to minors; should it become aware of such data, it will erase them without undue delay.

3. Legal bases for processing

The processing of data collected through the website relies on the following legal bases set out in Article 6 GDPR:

• Consent of the data subject (Art. 6(1)(a)): given freely, specifically and on an informed basis through the dedicated checkbox in the contact form.
• Steps taken prior to entering into a contract (Art. 6(1)(b)): where the enquiry is aimed at assessing a supply, distribution or commercial partnership relationship.
• Legal obligation (Art. 6(1)(c)): for obligations imposed by law or by requests from the authorities.
• Legitimate interest (Art. 6(1)(f)): for the security of the website and the prevention of abuse, limited to the server's technical logs.

4. Personal data processed

The website has a single point of personal data collection: the contact form, available in three versions (commercial partnerships, physicians and healthcare professionals, pharmacies). Depending on the version used, the following ordinary data are processed:

• identification data: first and last name, or company name;
• contact data: email address, telephone number (optional), company website (optional);
• professional data: role within the company, medical specialisation, company profile, markets of interest;
• general location data: province or country of reference;
• content of the enquiry: the request type selected and the free-text message;
• record of consent: evidence that this notice has been accepted.

The website does not request, and must not be used to transmit, special categories of data within the meaning of Article 9 GDPR, in particular health data. Please do not enter such information in the free-text field. Any special category data volunteered will be processed solely in order to respond to the enquiry and erased as soon as they are no longer necessary.

Technical logs. For the operation and security of the service, the web server automatically records certain browsing data, such as IP address, browser and operating system type, date and time of the request and the page requested. These data are not associated with identified users, are used in aggregate form for statistical and security purposes, and are kept for a maximum of seven days, unless their retention is necessary for the authorities to investigate computer-related offences.

5. Provision of data

Providing the data marked as mandatory in the contact form is necessary in order to act on the enquiry: without them no reply can be given. Providing the remaining data is optional and serves only to make the reply more relevant.

The website offers no account registration, no restricted area, no online purchasing and no newsletter subscription. Apart from the contact form there is no other point of personal data collection.

6. Purposes of processing

Data collected through the contact form are processed exclusively in order to:

• receive, manage and act on the enquiry submitted by the data subject;
• provide the scientific, technical or commercial information requested about BlastiMin Complex^®;
• assess any proposals for collaboration, distribution or commercial partnership;
• comply with legal obligations connected to the communications received.

Data are not used to send promotional communications or newsletters, are not subject to profiling or to automated decision-making within the meaning of Article 22 GDPR, and are not transferred or sold to third parties.

7. Means of processing and retention periods

Data are processed by electronic means, by staff authorised and instructed by the Controller, applying technical and organisational measures appropriate to ensure their security, integrity and confidentiality, and for no longer than is necessary for the purposes stated.

Data submitted through the contact form are transmitted by email to the Controller's institutional mailbox: the website does not store them in any database. They are kept for as long as is necessary to handle the enquiry and, thereafter, for a maximum of twelve months, unless the correspondence gives rise to a contractual relationship, a different retention period is imposed by law, or retention is necessary to establish, exercise or defend a legal claim.

The server's technical logs are kept for a maximum of seven days, as stated in section 4.

8. Recipients of the data

Data may be accessed by the Controller's authorised staff and disclosed to the parties providing services instrumental to the operation of the website, appointed as processors pursuant to Article 28 GDPR:

• the hosting and email service provider on whose infrastructure the website and the destination mailbox are hosted;
• the consultants and professionals assisting the Controller, within the limits of their respective remits.

Data may also be disclosed to the competent authorities where required by a legal obligation. Outside these cases they are neither disseminated nor disclosed to third parties.

9. Place of processing and transfers outside the EU

Processing takes place at the Controller's office and at the data centres of its service providers, located within the territory of the European Union.

The website uses the Google Fonts service to load its typefaces: displaying the pages therefore triggers a request to Google's servers, which may involve the transmission of the user's IP address and a transfer of data to the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, on the basis of the adequacy decision adopted by the European Commission on 10 July 2023. Apart from this case, no data are transferred to third countries.

10. Cookies and tracking technologies

This website does not use profiling cookies, third-party advertising cookies, statistical analytics tools or user behaviour tracking of any kind.

No prior consent is therefore required under Article 122 of Italian Legislative Decree 196/2003 or under the cookie guidelines issued by the Italian Data Protection Authority on 10 June 2021. The user's browser may store website resources in its local cache, for purely technical performance purposes.

11. Rights of the data subject

In relation to the processing described above, the data subject may at any time exercise the rights set out in Articles 15-22 GDPR:

• access: obtain confirmation that processing is taking place and a copy of the data concerning them (Art. 15);
• rectification: correct inaccurate data or complete incomplete data (Art. 16);
• erasure: obtain the erasure of the data in the cases provided for, the so-called right to be forgotten (Art. 17);
• restriction: request the suspension of processing in the cases provided for (Art. 18);
• portability: receive the data in a structured, commonly used and machine-readable format (Art. 20);
• objection: object to processing based on the Controller's legitimate interest (Art. 21);
• withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3)).

Requests may be sent to privacy@mivell.it or by ordinary mail to the Controller's office indicated in section 1. The Controller replies without undue delay and in any case within one month of receiving the request, a period that may be extended by two further months where the request is particularly complex.

A data subject who considers that the processing of their data infringes the Regulation has the right to lodge a complaint with the Italian Data Protection Authority — Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it) pursuant to Article 77 GDPR, or to bring proceedings before the competent courts.

12. Changes to this notice

The Controller reserves the right to update this notice to reflect changes in legislation, in its organisation or in the services offered through the website. The version published on this page is the one in force: please consult it periodically. The date of the last update is shown at the top of the page.