Privacy Policy
Who is the Data Controller?
U.G.A. Nutraceuticals S.r.l., with registered office at Via Achille Varisco, 2 – 20900 Monza (MB), Italy (VAT No.: 02801680543) (hereinafter, the "Controller")
How can I contact the Controller?
Email: privacy@uganutraceuticals.com
Address: Via Achille Varisco, 2 – 20900 Monza (MB), Italy
1. Introduction
The ferrolip.com website presents the Ferrolip products. Products are purchased on omegor.com, whose processing activities are described in the relevant privacy notice.
2. What processing activities are carried out through the website? What are the legal bases, purposes and retention periods?
| REGISTRATION | PURPOSE | The purpose of the data processing is to create and manage the personal account on the website. |
| LEGAL BASIS | Consent. | |
| RETENTION PERIOD | If the account remains inactive for 3 years, we will send you an email to ask whether you still wish to keep it active; otherwise the account will be deleted. Data will be processed for a longer period in the event of a dispute. | |
| OTHER INFORMATION | Registration is not mandatory in order to browse the website. |
| CONTACT | PURPOSE | The purpose is to contact the company to request information. |
| LEGAL BASIS | Performance of pre-contractual measures taken at the request of the Data Subject. | |
| RETENTION PERIOD | We will process the data for the time necessary to respond to the requests and will then delete them. Whether the data have become obsolete is checked every 12 months. | |
| OTHER INFORMATION | The User is completely free to provide the requested data, as there is no legal obligation to do so. However, if the User chooses not to provide the data marked as essential, the Controller will not be able to achieve the stated purpose. |
| REVIEWS | PURPOSE | The purpose is to share one's experience of the products by publishing a review on the website. |
| LEGAL BASIS | Consent given by the Data Subject in providing the review. | |
| RETENTION PERIOD | Reviews will be published on the website until they become obsolete and/or until consent is withdrawn. | |
| OTHER INFORMATION | The service for collecting and publishing reviews is provided by Judge.me, which processes the data as a processor. Reviews may be imported to the other websites owned by U.G.A. Nutraceuticals S.r.l. |
| MARKETING AND PROFILING THROUGH DIGITAL PLATFORMS | PURPOSE | The purpose of the data processing is to show marketing content based on your interests, as identified through your interactions on our website or social media. This includes the use of retargeting tools of digital platforms to deliver targeted advertising messages. |
| LEGAL BASIS | Consent, which may be obtained through the cookie settings on the website. | |
| RETENTION PERIOD | The data will be retained until consent is withdrawn through the cookie settings. | |
| OTHER INFORMATION | The User may manage or withdraw consent at any time as described in the Cookie Policy. |
| BROWSING DATA | PURPOSE | Website security. |
| LEGAL BASIS | Legitimate interest of the company in IT security and compliance with legal obligations. The legal basis for the processing of cookies other than necessary ones is consent. | |
| RETENTION PERIOD | 24 months. | |
| OTHER INFORMATION | For the rules on cookies, please refer to the dedicated notice. |
3. What else do I need to know?
The data will be processed lawfully, fairly and with the utmost confidentiality, in compliance with appropriate security measures as provided for by the Code and the Regulation. The processing will be carried out by digital means. The data will not be publicly disseminated, with the exception of reviews. Furthermore, the user will not be subject to automated decision-making such as profiling unless they consent to it by installing cookies or other tracking tools, for the rules on which reference is made to the dedicated notice.
4. To whom will my data be disclosed?
The Controller may disclose the data to all parties to whom disclosure is mandatory by law for the purposes provided for by law.
The Controller also uses certain companies or IT tools that carry out processing activities on data subjects' personal data solely in the interest of the Controller, all duly appointed as processors pursuant to Art. 28 GDPR.
The list of processors is available at the Controller's premises.
The Company uses persons designated as System Administrators, in charge of managing and maintaining the IT systems. The updated list of System Administrators is available at the Controller's office and may be consulted upon request by the data subject.
5. Where are the data stored and transferred?
The management and storage of personal data will take place on servers located inside and outside the EU. The Controller guarantees that transfers outside the EU take place in compliance with Arts. 44-47 of Chapter V of the GDPR, by means of standard contractual clauses and/or EU Commission adequacy decisions.
6. What are my rights and how can I exercise them?
a) Rights of the data subject
The user, in their capacity as data subject, has the rights set out in Art. 15 et seq. of the Regulation, namely:
1. RIGHT OF ACCESS (Art. 15 GDPR)
The data subject has the right to obtain confirmation of whether or not personal data concerning them exist, even if not yet recorded, and to have such data communicated to them in an intelligible form.
2. RIGHT TO RECTIFICATION (Art. 16 GDPR)
The data subject has the right to obtain the rectification of inaccurate personal data concerning them and the completion of incomplete data.
3. RIGHT TO ERASURE (Art. 17 GDPR)
The data subject has the right to obtain the erasure of personal data where particular grounds apply, such as withdrawal of consent, objection to the processing, or where the data are no longer necessary in relation to the purposes for which they were collected and processed, or in the case of unlawful processing. Erasure will not always be possible, but the Controller will in any case be required to provide adequate justification.
4. RIGHT TO RESTRICTION OF PROCESSING (Art. 18 GDPR)
The data subject has the right to obtain restriction of processing in particular cases, such as, for example, where a request for rectification or an objection is made, for the time needed to assess the requests.
5. RIGHT TO DATA PORTABILITY (Art. 20 GDPR)
If the processing is based on consent or on a contract and is carried out by automated means, the data subject may receive the data in a structured, commonly used and machine-readable format or request that they be transmitted to another controller.
6. RIGHT TO OBJECT (Art. 21 GDPR)
The data subject has the right to object, in whole or in part: a) on legitimate grounds, to the processing of personal data concerning them, even where relevant to the purpose of collection; b) to the processing of personal data concerning them for the pursuit of purposes not covered by Art. 2. The user may submit a request to object setting out the reasons that justify the objection: the Controller reserves the right to assess the request, which would not be accepted where there are compelling legitimate grounds for the processing that override the interests, rights and freedoms of the user.
7. RIGHT TO LODGE A COMPLAINT
The data subject has the right to lodge a complaint with the competent supervisory authority under Article 77 GDPR if they consider that the processing of their data infringes the applicable legislation.
b) How to exercise your rights
The data subject may exercise the rights referred to in the preceding article at any time by contacting the Controller at the addresses indicated above.
Latest version: 19/10/2026