Privacy and cookies

Who handles your data

The data controller is Herborea Srl, Via Emilia Ponente 380/C, 40024 Castel San Pietro Terme (BO), Italy — VAT IT03402991206, REA BO 516489.

For any question about your data, or to exercise your rights, write to privacy@herborea.eu. We have not appointed a data protection officer: our business does not fall into the cases where one is required.

What we collect and why

Contact form. We collect your name, email address, country, enquiry type and the message you write, in order to reply and follow up (Art. 6.1.b and 6.1.f GDPR). We keep enquiries for 24 months from the last contact, then they are deleted automatically.

Newsletter. We collect your email address and, if you wish, country and business type; we also record the language and the date and time of your consent. Subscription uses double confirmation: you receive an email and until you click the link you are not subscribed. The legal basis is your consent (Art. 6.1.a), which you can withdraw at any time from the link at the bottom of every email. We keep the data while you stay subscribed, and the proof of consent for 12 months after you unsubscribe.

Retailer area. For the access request and for orders we collect company name, VAT or registration number, contact person, phone, email, billing and shipping addresses, products and quantities requested. They are needed to verify the business, open the account and manage orders and quotations (Art. 6.1.b). We keep this data for the duration of the relationship and, for documents with tax relevance, for the ten years required by law.

Site visits. The server records IP address, date and time, requested page and browser type, for security and troubleshooting (Art. 6.1.f). These logs are kept for about five weeks, then overwritten.

How we protect them

The site works only over an encrypted connection. Passwords are stored as hashes and two-factor authentication is mandatory for administrator accounts. Company details and queued messages are encrypted in the database. Every night we run an encrypted backup, kept for 31 days on the same server. Access to the data is limited to the people at Herborea who need to handle it.

Who else sees them

We do not sell or disclose your data. Only these suppliers process it on our behalf, as processors:

• Hetzner Online GmbH — the server hosting the site and the database, in Germany.
• Sendinblue SAS (Brevo) — sending and managing the newsletter, based with servers in the European Union.
• Google Ireland Limited — company mailboxes and relay of the emails sent by the site.

Google may also process some data in the United States: the transfer relies on the safeguards provided by the GDPR, namely standard contractual clauses and participation in the Data Privacy Framework.

Your rights

You can ask what data we hold, have it corrected or deleted, restrict its use, receive it in a machine-readable format and object to processing; where processing is based on consent, you can withdraw it at any time.

Write to privacy@herborea.eu: we reply within one month. If you believe your data is not handled properly, you can contact the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Cookies

The public pages of herborea.it use no cookies: no statistics, no advertising pixels, no profiling. Fonts are hosted on our own servers too, so no request goes out to external services while you browse.

Only one cookie is used, in the retailer area, and it is technical: it keeps you signed in after you enter your credentials.

Technical cookies do not require consent under the law: that is why you see no banner. You can still block or delete cookies in your browser settings; if you block the retailer area one, signing in will not work.

When you click a link to WhatsApp, Faire or Ankorstore you leave our site: from that point their own privacy notices apply.

Updates

If we change tools or purposes we update this page and the date shown above. Changes apply from the moment they are published.