Privacy Policy for Newsletter and Promotional Communications

1. Data Controller

The Data Controller is F.L. Medical s.r.l. Unipersonale, with registered office at Via Enrico Mattei 20, Torreglia (PD), Tax Code and VAT number [insert number], who can be contacted at the email address [address] and certified email address (PEC) [address].

2. Data Processed and Purposes of Processing

The Data Controller processes the email address and any additional data provided by the data subject upon registration, such as first name, last name, and the selected newsletter language or version, in order to:

• manage subscription to the newsletter in Italian or English;

• send newsletters, updates, information on services, initiatives, and promotional communications of the Data Controller;

• manage the data subject’s preferences, including choices regarding open and click tracking;

• record and demonstrate subscriptions, consents, withdrawals, unsubscribes, and subsequent preference modifications;

• prevent further mailings following unsubscription or withdrawal of consent.

Providing an email address is optional. However, failure to provide it will make it impossible to register and receive the newsletter.

Consent to open and click tracking is optional and separate from consent to newsletter subscription: failure to grant consent to tracking does not prevent receipt of the newsletter.

3. Legal Bases

The sending of newsletters and promotional communications is based on the consent of the data subject, pursuant to Article 6(1)(a) of Regulation (EU) 2016/679 (GDPR) and Article 130 of Legislative Decree no. 196 of June 30, 2003, as amended.

Consents are collected through distinct, un-prechecked options and are recorded by the Data Controller. They may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Furthermore, the Data Controller may retain, in a limited form, the information necessary to document the withdrawal or unsubscription and to prevent further mailings, based on its legitimate interest in respecting the data subject’s wishes, preventing unsolicited communications, and establishing, exercising, or defending legal claims, in compliance with the principles of necessity, proportionality, and storage limitation.

4. Open and Click Tracking

Open and click tracking is disabled by default and is activated only after the data subject has granted specific consent.

Data subjects who do not consent to tracking will continue—provided they have consented to receiving communications—to receive the newsletters; however, their opens and clicks will not be recorded and will not feed separate anonymous counts.

When consent has been granted, newsletters may contain a tracking pixel and personalized links. Tracking covers email opens and clicks on links. System identifiers and tokens may be associated with individual recipients via the platform and are therefore processed as pseudonymized, non-anonymous personal data.

The platform database may record identifiers, dates, timestamps, clicked links, interaction counts, and user-agent details in relation to the subscriber and the campaign.

This information is used to analyze content engagement, evaluate campaign effectiveness, and improve communication relevance. Currently used automated and transactional service emails do not contain tracking pixels.

5. Preference Management and Unsubscription

Data subjects can independently manage their preferences on the “Manage Your Subscription” page, accessible via the personal link included in the communications or through other channels provided by the Data Controller.

From the management page, the data subject can:

• maintain or withdraw consent to receive newsletters;

• grant or withdraw consent to open and click tracking;

• update preferences, where available;

• save their selection.

Data subjects can also perform the following directly through the newsletter:

• withdraw consent to receive newsletters via the “Unsubscribe” link;

• disable tracking via the “Disable tracking” link;

• request assistance from the Data Controller using the contact details provided in this privacy notice.

The platform records the choice made, the date, and the origin of the registration to ensure the preference is applied and to document the management of consents and withdrawals. Merely accessing or clicking the link to the management page does not automatically constitute consent to tracking.

6. Processing Methods and Data Recipients

Data is processed using IT tools, backed by appropriate technical and organizational measures designed to protect data against unauthorized access, loss, alteration, or unlawful disclosure.

Data is processed by personnel authorized by the Data Controller and by entities providing technical services necessary for website hosting, newsletter management and delivery, maintenance, and technical assistance, within the limits strictly required to perform their respective duties. Where such entities process personal data on behalf of the Data Controller, they are appointed as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679, where the legal criteria are met. A list of Data Processors can be requested from the Controller using the contact details provided.

7. Data Location and Third-Country Transfers

Subscriber data, consent preferences, and statistics are stored in the website’s database, hosted on servers located in Europe and, in some cases, transferred to the United Kingdom based on an adequacy decision issued by the European Commission.

Based on the current technical setup, no data transfers are planned to additional third countries outside the European Economic Area (EEA). Should this configuration or the supply chain change, the Data Controller will update this privacy notice and provide all required information under Articles 13 and 44 et seq. of the Regulation, specifying the country involved and the relevant transfer mechanism.

Data is not subject to dissemination.

8. Retention Period

Data used for subscription and newsletter delivery is retained until consent is withdrawn or the service is unsubscribed from, subject to limited retention of information necessary to record the withdrawal or unsubscription, prevent further mailings, and demonstrate compliance with the data subject’s intent.

Following withdrawal or unsubscription, the email address and information strictly necessary to manage suppressions may be retained for 12 months, after which they will be erased or anonymized, unless further retention is required to fulfill legal obligations or to establish, exercise, or defend a legal claim.

Individual open and click statistics are retained for 12 months, and in any case no longer than necessary for the declared analytical purposes.

9. Rights of the Data Subject

Data subjects may exercise, within the cases and limits provided under Articles 15–22 of Regulation (EU) 2016/679, the right to:

• obtain confirmation as to whether or not personal data concerning them is being processed, and access such data;

• request the rectification of inaccurate data or the completion of incomplete data;

• request the erasure of data in cases provided for by law;

• request the restriction of processing in cases provided for by law;

• receive their data in a structured, commonly used, and machine-readable format, where the right to data portability applies;

• object to processing in cases provided for by law;

• withdraw granted consents at any time, without affecting the lawfulness of processing based on consent prior to withdrawal.

Data subjects have the right to object at any time to the processing of personal data for direct marketing purposes, including profiling related to such direct marketing, where performed. Upon objection, the data will no longer be processed for those purposes.

Requests can be submitted to the Data Controller using the contact details in this notice or via the preference management tools described above.

Data subjects also have the right to lodge a complaint with the Data Protection Authority (Garante per la protezione dei dati personali), following the instructions available at www.garanteprivacy.it.

10. Absence of Automated Decision-Making

The processing described in this notice does not involve automated decision-making processes, including profiling, that produce legal effects concerning the data subject or similarly significantly affect them.