The company alfaMedic.co.uk (hereinafter referred to as “we”) takes the protection of personal data very seriously. This document explains what personal data we process, why we process it, and whether the processing is based on the customer’s consent or another legal basis.

What personal data do we process?

When you use our services, we collect various types of data, including contact information and other preferences. We monitor which products you view in our online shop, which device you use and which of our email offers you show an interest in. Based on the data collected, we can prepare more personalised offers and improve our services and online shop. If you purchase from us, we also process your first and last name and other personal information required to complete the contract and deliver your orders.

We process the following personal data:

2. identification data, particularly your first and last name;
3. contact details that allow us to contact you, particularly your email address, telephone number, delivery address and billing address;
4. information about your orders, particularly details of the products ordered and payment method, including bank account details and information relating to complaints;
5. information about your online behaviour, including when you browse the internet through our mobile application. This particularly includes information about the products and services you search for, links you click, how you browse and scroll through our website, and information about the device used to access the website, such as its IP address and associated location, device ID, technical settings, operating system and version, screen resolution, browser and browser version, and information obtained through cookies and similar technologies used to identify devices;
6. information about how you interact with messages we send you, particularly how long it takes you to open a message and information about the devices used to access the internet, such as the IP address and associated location, device ID, technical settings, operating system and version, screen resolution, browser and browser version;
7. derived data, including personal data relating to your preferences, information about products purchased, online habits and behaviour connected with reading the messages we send you. This mainly includes information about sex, age, purchasing habits and attitudes towards different products and services;
8. data connected with the use of our call centre, particularly recordings of telephone calls, identification details relating to messages sent to us and the associated IP address.

Why do we process personal data, and what gives us the right to do so?

We process your personal data in different situations and for various purposes. If you visit our online shop, where cookies are used, your information will mainly be used to determine the number of visitors and improve our services. If you purchase from us, we use your information to process your order, protect our legal claims and comply with our legal obligations. Using your contact details and other information, we may also display or send you personalised offers. With your consent, we may provide information to third parties so that offers can be displayed on other websites or to give you access to certain additional services. We have the right to process your personal data for the preparation or performance of a contract with you, compliance with legal obligations, protection of our legal claims or on the basis of your consent.

As part of our activities, we process personal data for various purposes and to different extents, particularly:

1. without your consent, on the basis of the performance of a contract, our legitimate interests or compliance with legal or contractual obligations;
2. on the basis of your consent.

The type of data processing that may be carried out without your consent depends on the purpose of the processing and your relationship with us, including whether you are simply visiting our online shop or purchasing from us. Your data may also be processed if you are the recipient of goods or services ordered from us, if you contact us or if you visit one of our collection points.

Use of cookies and other technologies and sharing data with advertising agencies and social networks

When you visit our online shop, we store and subsequently read small files on your device, such as cookies. A cookie is a small collection of letters and numbers stored in your browser or on your computer’s hard drive. Some cookies allow us to monitor your activity while you browse our website, from the moment you open your browser window until you close it. These cookies are deleted when the browser window is closed. Other cookies remain on your device for a defined period and are activated whenever you visit the websites that created them. We also use web signals, commonly known as web beacons. These are small images with a function similar to that of cookies. Unlike cookies stored on your computer’s hard drive, web beacons form part of the website itself. For simplicity, all these technologies are referred to as cookies throughout this document.

Some cookies are stored directly on your device by our websites. These cookies help us to:

• identify you as you move between individual pages on our domain and when you return for another visit. This prevents products placed in your basket from being removed and allows us to remember which version of our website should be displayed when several versions are available;
• determine whether you have given your consent in accordance with this document;
• determine whether, for example, you have chosen to participate in a particular survey;
• ensure security, for example by checking that your connection to our online domain has not been misused and that nobody is carrying out activities using your data;
• identify, investigate and correct errors and defects on our website;
• ensure the operation of our online shop. These cookies and other files are essential. If you disable cookies in your browser, our pages may not function correctly, which may prevent us from offering our products and services to you.

We also store cookies from our website on your device that allow us to:

• monitor the number of visits to our websites or individual content, prepare statistics and reviews, and measure advertising performance;
• display different versions of our webpages when testing new features;
• adapt the content of our website to your needs, for example by prioritising products you have previously searched for and displaying other offers based on your preferences;
• store cookies belonging to other websites that may be used to collect information about your behaviour on our website or other websites and to display personalised offers and advertisements through advertising networks and social networks on websites outside our domain.

To display personalised offers and advertisements through advertising networks and social networks on websites outside our domain, we also provide our advertising and social-network partners with information about online behaviour. We do not provide these partners with information that directly identifies you. A list of the advertising and social networks we use appears in the section entitled “Who processes your personal data, and with whom do we share it?”

How can cookies be managed?

Cookies can be managed and controlled in several ways. Please be aware that deleting or blocking cookies may negatively affect your experience and prevent you from accessing certain pages of our online shop.

Most browsers accept cookies automatically, but you can choose whether to accept them through your browser controls, which are normally located in the Tools or browser settings menu. For further information about changing your browser settings or blocking, managing or filtering cookies, visit: www.allaboutcookies.org.

Use of website visitors’ personal data

• If you visit our online shop, we process information about your use of our website on the basis of our legitimate interests, meaning without your consent, for the following purposes:
• preparing statistics and reviews, particularly determining the number of visits to our websites or individual content and measuring the effectiveness of advertisements. Our legitimate interest is to measure the effectiveness of our websites and advertising costs. For this purpose, we may obtain and use additional derived information based on your online behaviour or provide derived information to our partners as described in the section entitled “Who processes your personal data, and with whom do we share it?”;
• testing new features and applications before they are released, to prevent faults that could affect your ability to purchase from our website. Our legitimate interest in this case is ensuring that our services function correctly;
• taking action against attacks on our websites or attempts to disrupt their operation and ensuring information security. Our legitimate interest in this case is ensuring that our services function correctly and that your information remains secure.

Information about your online behaviour is not collected only through cookies. It is also supplemented with the following information:

• the IP address of your device, meaning the address through which it communicates with other devices on the internet;
• your device’s operating system, version and language settings;
• the browser used on your device, its version and language settings;
• the URL of the webpage from which you accessed our website.

For these purposes, we use personal data for a maximum period of 38 months. The data is stored in pseudonymised form.

Information about your behaviour on our website is also processed on the basis of our legitimate interests, meaning without your consent, to prepare personalised offers and advertisements displayed online. Our legitimate interest in this case is to offer promotions that are more relevant to you. The collected data is analysed, and we may use it to classify users into groups and prepare offers that are more closely aligned with their interests. If you subsequently make a purchase, information received with your order may also be used for this purpose.

For this purpose, we use personal data for one month.

If you make a purchase from us

To make a purchase from us, you must visit our online shop, and the processing activities described in the section “If you visit our website” will apply. If you make a purchase through our website, the processing of your data will also include the following:

a) Processing based on the performance of a contract

If a purchase is made by an individual, we process the information received exclusively for the purpose of processing the order. This includes identification data, contact details and information about the order.

If a purchase is made by a legal entity and the contract is concluded between us and a representative of the company, we process the data in the same way, based on the conclusion and performance of the contract with the person representing the company.

Using your data to process your order means that we use it separately for:

• allowing you to complete an online order, for example by ensuring that products added to your basket or information entered while preparing an order are not deleted;
• communicating with you, for example by sending a dispatch confirmation;
• processing payment for the products;
• arranging delivery. In this connection, we may also provide your information to our delivery partners solely for the purpose of delivering the products, as described in the section entitled “Who processes your personal data, and with whom do we share it?”;
• dealing with complaints concerning ordered products or services. In this connection, we may provide your information to the supplier of the products or an authorised service centre, as described in the section entitled “Who processes your personal data, and with whom do we share it?”;
• dealing with other requirements communicated to us through our call centre, as described in the section entitled “If you communicate with us through different channels”.

For these purposes, we use personal data for as long as is necessary to process your order or resolve a complaint.

b) Processing based on legitimate interests

If you purchase from us, we retain your identification details, contact information and order information on the basis of our legitimate interests, meaning without your consent, for the protection of legal claims and for our internal records and audits. Our legitimate interest in this case is the protection of legal claims and supervision of the proper provision of our services.

In addition, on the basis of our legitimate interests, meaning without your consent, we process your identification details, contact information, preferences and order information, if you later make a purchase, for the following purposes:

To create personalised offers and advertisements displayed on webpages, as described in the section “If you visit our website”, we also use information about your orders.

Your satisfaction with our services is measured using an NPS survey sent to you by email through the Judge.me programme. We send the questionnaire to randomly selected users who made a purchase during the previous month. The survey results are used exclusively for our internal purposes.

Using your contact details and other information, we may display and send you personalised offers. To protect legal claims and maintain records for internal audits, we process data for a period of three years and for one additional year in relation to claims made before the end of the limitation period. In the event of legal, administrative or other proceedings, we process your personal data for as long as necessary for those proceedings and for the remainder of the applicable limitation period after they have ended.

For other purposes, we use personal data for a maximum of six months.

You have the right to object to this type of processing when it is carried out on the basis of our legitimate interests.

c) Processing for compliance with legal obligations

We must also comply with certain obligations imposed by law. If we process data for the purposes described above, we do not require your consent. On this legal basis, we process your identification details, contact information and order information in accordance with the laws in force when this memorandum was prepared, particularly:

• the Code of Obligations;
• the Consumer Protection Act;
• the Value Added Tax Act;
• the Fiscal Verification of Invoices Act;
• the Accounting Act;
• the Electronic Communications Act;
• the Prevention of Money Laundering and Terrorist Financing Act.

For this purpose, we use personal data for a maximum of ten years, plus the current year, calculated from the date of the most recent document issued in connection with your order.

If you are the recipient of goods or services ordered from us

If you are the recipient of goods or services ordered from us, we process your identification details and contact information:

• on the basis of our legitimate interest in preparing, concluding and performing a contract with our customer. The performance of this contract is also our legitimate interest;
• on the basis of our legitimate interest in obtaining information that allows us to improve our services for you in the future or prepare internal statistics and reviews. Our legitimate interest in this case is improving our services for customers;
• for compliance with legal obligations, particularly those arising under the applicable laws listed in the previous section of this memorandum;
• to protect legal claims and maintain internal records and audits. Our legitimate interest in this case is protecting legal claims and supervising the proper performance of our services.

For the preparation, conclusion and performance of a contract with our customer, we use personal data for as long as is strictly necessary to process the order. At the end of this period, the data will continue to be retained on the basis of our legitimate interests in protecting legal claims and maintaining internal records and audits. It will be retained for a limitation period of five years and, where necessary, for one additional year after that period expires in relation to claims made at the end of the limitation period. If legal, administrative or other proceedings are initiated, we process your personal data for as long as is strictly necessary for those proceedings and until the remaining limitation period expires after the proceedings have ended. Our legitimate interest in this case is protecting legal claims and supervising the proper performance of our services. To comply with legal obligations, we use personal data for a maximum of ten years for each order.

If you communicate with us through different channels

If you communicate with us through different channels, particularly through our call centre, email, chat or social networks, we process your identification details, contact information and records of our communications on the basis of our legitimate interests, meaning without your consent, for the following purposes:

• handling your requests. If you have purchased from us and your request relates to your order, we may process it on the basis of the performance of the contract;
• recording your requests so that we can monitor whether they are dealt with properly and promptly;
• demonstrating that we received and processed your request, for example if goods are ordered or a complaint is submitted through one of these channels;
• analysing customer requirements to improve the quality of our services.

For these purposes, we store personal data for three months. If an order is placed through one of our channels, we may retain the data to protect legal claims for the five-year limitation period and for one additional year in relation to claims made at the end of that period. In the event of legal, administrative or other proceedings, we process your personal data to the extent necessary for the duration of those proceedings and for the remainder of the limitation period after they have ended.

Who processes your personal data, and with whom do we share it?

In most cases, we process your data for our own purposes as the data controller. We may provide your information to partners that supply payment, delivery and other services connected with your order. We also provide information to our analytics providers, which process it in accordance with our instructions. With your consent, we may also provide information to advertisers and social networks so that personalised advertisements can be displayed on other websites.

We process personal data as the data controller. This means that we determine the purposes for which your personal data is collected and the methods used to process it, and we are responsible for ensuring that it is processed correctly.

Your personal data may also be provided to other organisations acting as data controllers:

• the supplier of the products or the relevant manufacturer’s service centre in connection with complaints concerning ordered products or services;
• with your consent, advertising networks and social networks, as described in the section “Use of cookies and other technologies”, including:
• Google Ireland Limited (company registration number 368047), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. The company’s privacy policy is available here: https://policies.google.com/technologies/ads
• BRT S.p.A., Via G. Marinoni 1, 33057 Palmanova UD, Italy.

From which sources do we obtain personal data?

Personal data is collected directly from you through our online shop or through communications with you. Some additional information may also be obtained from our partners, such as banks or delivery companies.

We mainly process personal data that you provide directly when purchasing products and services, creating or using an account or communicating with us, for example through a call centre. We also collect personal data directly from you by monitoring your online behaviour while you browse our online shop or read our messages.

If you purchase from our shop, we may receive additional information about your order from banks, partners operating payment systems and delivery partners in connection with the performance of the sales contract. This may include information about bank account numbers, payments made and delivery of the products.

Transfer of data outside the EU

In certain cases, we may transfer your personal data to countries outside the European Economic Area.

When providing data to the recipients listed in the section “Who processes your personal data, and with whom do we share it?”, we may also transfer your information to countries outside the European Economic Area that do not necessarily provide an adequate level of personal-data protection. Such transfers will be made only if the relevant recipient agrees to comply with the standard contractual clauses issued by the European Commission, available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2004:385:0074:0084:CS:PDF

What rights do you have in relation to the processing of personal data?

You have several rights in connection with your personal data. These include the rights of access, rectification, erasure, restriction of processing, data portability, objection and complaint. Just as we have rights and obligations regarding the processing of your personal data, you also have the following rights:

Right to be informed

In simple terms, you have the right to know what information we collect, why we collect it, how long we retain it, where we obtain your personal data, to whom we provide it, who processes it in addition to us and what rights you have in relation to the processing of your personal data. You can find this information in the section entitled “Protection of customers’ personal data”. However, if you are unsure what personal data we collect about you, you may ask us to confirm whether we process personal data relating to you. If we do, you have the right to receive information about that data. Under your right of access, you may request a copy of the data being processed, and the first copy will be provided free of charge.

Right to rectify data

Everyone makes mistakes. If you discover that personal data relating to you is inaccurate or incomplete, you have the right to ask us to correct it as soon as possible.

Right to erasure

In certain circumstances, you have the right to request the deletion of your personal data. We will delete your data as soon as possible if one of the following conditions applies:

• we no longer require the data that was processed;
• you have withdrawn your consent to the processing of personal data where consent was required, and we have no other legal basis for continuing to process the information;
• you have exercised your right to object to the processing of personal data that we process on the basis of our legitimate interests. Further information appears below in the section on the right to object;
• please note that even if one of the conditions described above applies, this does not mean that all your personal data will be deleted immediately. This right cannot be exercised where the continued processing of personal data is necessary for compliance with our legal obligations or for the establishment, exercise or defence of legal claims. Please refer to the section “Why do we process personal data, and what gives us the right to do so?”

Right to restrict the processing of data

• In certain circumstances, you may exercise the right to restrict the processing of personal data in addition to the right to erasure. This right allows you to request that your personal data be specifically marked and excluded from certain processing activities. Unlike erasure, the effect of restriction is temporary. We must restrict the processing of personal data:
• if you dispute the accuracy of the personal data, until we have established which information is correct;
• if your personal data is being processed without an appropriate legal basis and you request that its use be restricted rather than having it deleted;
• if we no longer require your personal data for the purposes described above;
• if you object to the processing of your data. The right to object is described in greater detail below under the heading “Right to object to the processing of data”.

Right to data portability

You have the right to obtain from us all personal data that you have provided and that we process on the basis of a contract. Your personal data will be provided in a structured, commonly used and machine-readable format. This right applies to data processed automatically in our electronic databases.

Right to object to the processing of data

For reasons relating to your particular situation, you have the right to object to the processing of personal data based on Article 6(1)(e) or Article 6(1)(f) of Regulation (EU) 2016/679. You also have the right to object to processing for direct-marketing purposes. Please refer to the section “Why do we process personal data, and what gives us the right to do so?” Processing of your data for direct-marketing activities will be stopped immediately. The same procedure will also apply in other relevant cases.

Right to lodge a complaint

Exercising the rights listed above does not affect your right to lodge a complaint with the appropriate supervisory authority. You may exercise this right if you believe that your personal data is being processed without justification or in breach of generally binding legal requirements.

How can you exercise your rights?

To exercise any of the rights described in this document, you can contact us by email at info@alfamedic.co.uk or send us a message by clicking this link.

We will consider your request as soon as possible and no later than one month after receiving it. In exceptional circumstances, particularly where more complex procedures are involved, we have the right to extend this deadline by a further two months. If an extension is necessary, we will notify you in writing and explain the reasons for it.