Skip to Content

Privacy Policy

Last updated: September 2026

1. Data Controller

The Data Controller of the personal data collected through the GrowClinica site is:

HEMPATHY SRL

Strada Marchesane 174

36061 Bassano del Grappa (VI) – Italy

VAT / Tax Code 04159400243

REA VI-383699

Tel. +39 327 204 8259

E-mail: info@hempathy.it

This notice describes how Hempathy SRL processes the personal data of users who visit the GrowClinica site, use the related services, create an account, make a purchase, or contact customer service, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.

2. Categories of data processed

Depending on how the site is used, the following categories of personal data may be processed.

Personal and contact data

Name, surname, address, shipping and billing address, phone number, email address, and any additional data necessary for order management.

Order data

Selected and purchased products, quantities, amounts, payment methods, shipping methods, order status, returns, refunds, support requests, and information related to the purchase.

Tax and billing data

Data necessary for the issuance and retention of tax and accounting documents required by law.

Payment data

Information necessary for managing transactions.

When payment is processed through an external payment service provider, Hempathy SRL does not acquire or store the complete credit or debit card details used by the Customer.

Account data

Registration data, credentials and information related to orders and activities associated with any personal account created on the site.

Data provided voluntarily

Information transmitted by the user via email, contact forms, support requests, complaints, return requests, withdrawal or other communications.

Technical and browsing data

IP address, information about the browser and device used, technical data related to the connection, system logs, information on site usage and other data necessary for the operation, security and analysis of the site.

For detailed information on the use of cookies and similar technologies, please refer to the Cookie Policy.

3. Purposes and legal bases of processing
3.1 Management of orders and the contractual relationship

Personal data is processed for:

  • manage the cart and checkout;
  • process and confirm orders;
  • manage payments;
  • organise the preparation and shipping of products;
  • provide information on the status of the order;
  • manage returns, refunds and the right of withdrawal;
  • handle requests related to the legal warranty;
  • provide assistance related to purchases.

Legal basis: execution of a contract or pre-contractual measures requested by the data subject, pursuant to art. 6, par. 1, lett. b) GDPR.

Providing the data necessary for managing the order is essential to allow the purchase and execution of the contract.

3.2 Administrative, accounting, tax and legal obligations

The data is processed to comply with the obligations set out by tax, accounting, corporate, consumer and other applicable regulations.

Legal basis: compliance with a legal obligation, pursuant to art. 6, par. 1, lett. c) GDPR.

3.3 Assistance and contact requests

The data provided by the user is used to respond to requests for information, assistance, complaints or other communications.

Legal basis: execution of pre-contractual or contractual measures requested by the data subject or, depending on the nature of the communication, legitimate interest of the Data Controller in the proper management of relationships with users and customers, pursuant to art. 6, par. 1, lett. b) or f) GDPR.

3.4 Creation and management of the account

If the user creates an account on the site, the related data is used to provide the functionalities of the personal area, allow the consultation of orders and simplify subsequent purchases.

Legal basis: execution of the service requested by the user, pursuant to art. 6, par. 1, lett. b) GDPR.

3.5 Recovery of abandoned carts

When a user initiates a purchase procedure and provides their email address or uses the site after logging into their account, GrowClinica may use this information to remind them of the presence of an incomplete cart.

To this end, a single automated email may be sent, approximately 10 hours after the cart abandonment, regarding the previously selected products.

This communication is closely related to the purchasing procedure initiated by the user and does not result in automatic registration for newsletters or other commercial communications.

Legal basis: legitimate interest of the Data Controller in managing and completing the purchasing procedures voluntarily initiated by the user, pursuant to art. 6, par. 1, lett. f) GDPR.

The data subject may object at any time to such processing by contacting info@hempathy.it.

La base del legittimo interesse per le e-mail di recupero del carrello abbandonato è stata espressamente ricondotta dal Garante all’art. 6, par. 1, lett. f) GDPR, distinguendola dal regime del cosiddetto “soft spam”. (Garante Privacy [1])

3.6 Statistical analysis of the site via Google Analytics

The site uses Google Analytics to obtain statistical information about the use of the site and to understand its functioning, navigation methods, and user interaction with the pages.

Information such as pages visited, events and interactions with the site, approximate traffic origin, technical information related to the browser and device, and other browsing data may be processed.

In the configuration currently adopted by GrowClinica, Google Analytics is blocked until the user expresses their consent through the cookie preference management system.

Legal basis: consent of the data subject, pursuant to art. 6, par. 1, lett. a) GDPR.

Consent is optional and may be refused or revoked at any time through the cookie settings available on the site.

Failure to provide consent does not prevent the use of the essential functionalities of the site.

Google dichiara inoltre che, per gli utenti nell’Unione europea, gli indirizzi IP utilizzati per determinare informazioni geografiche approssimative vengono eliminati prima della registrazione dei dati in Analytics. (Google Support [2])

3.7 Site security and abuse prevention

Technical data and logs may be processed for:

  • ensure the operation and security of IT systems;
  • prevent unauthorised access;
  • detect anomalies, fraud or illegal use;
  • protect the site, users and the Owner.

Legal basis: legitimate interest of the Data Controller in the security of systems and the protection of their rights, pursuant to art. 6, par. 1, lett. f) GDPR.

4. Cookies and tracking tools

The site uses technical cookies necessary for its operation and, with prior consent when required, cookies and statistical measurement tools.

The cookie management system allows the user to accept or refuse optional categories and to subsequently modify their preferences.

Non-essential services subject to consent, including Google Analytics in the configuration used on the site, are blocked until the user's choice is expressed.

Detailed information on the cookies used, their respective purposes, duration, and how to manage preferences is available in the Cookie Policy.

Il Garante distingue i cookie tecnici, per i quali non è necessario il consenso, dagli strumenti di profilazione e tracciamento non tecnico, utilizzabili solo alle condizioni previste dalla normativa. (Garante Privacy [3])

5. Processing methods and security

Personal data is processed mainly through IT and telematic tools and, when necessary, through manual procedures.

Hempathy SRL adopts technical and organisational measures appropriate to the risk to protect personal data from loss, destruction, alteration, unauthorised access, disclosure or unlawful processing.

Access to personal data is limited to those who need to use it for the performance of their respective activities.

6. Recipients of the data

Personal data may be communicated, solely to the extent necessary for the purposes described in this notice, to subjects such as:

  • suppliers of the e-commerce and management platform, including Odoo;
  • providers of IT services, hosting, infrastructure and maintenance;
  • providers of payment services available during checkout;
  • GLS and other logistics operators responsible for shipping and delivery;
  • Google, for the Google Analytics service when the user has given their consent;
  • administrative, tax, accounting and legal consultants;
  • providers of technical and security services;
  • banks and entities involved in payment management, where necessary;
  • public, administrative or judicial authorities and other parties when communication is provided for or imposed by law.

Where provided for by law, suppliers processing personal data on behalf of Hempathy SRL operate as data processors pursuant to Article 28 GDPR.

Some parties, such as certain payment service providers or other suppliers, may process the data as independent data controllers according to their respective privacy notices.

Personal data is not disclosed.

7. Payments

Payments made on the site are managed through the payment service providers available during checkout.

Depending on the method chosen by the user, the data necessary for the transaction is transmitted to the relevant provider.

Hempathy SRL does not acquire or store complete credit or debit card data directly when such information is collected and managed directly by the payment service provider.

The relevant provider may process the data according to its own privacy notice and, where applicable, as an independent data controller.

8. Shipments

To enable the execution of the order and delivery of the products, the necessary data is communicated to GLS or any other logistics operators used by GrowClinica.

The communicated data may include:

  • first name and surname;
  • delivery address;
  • telephone number;
  • email address;
  • information necessary for the management and monitoring of the shipment.

The communication of such data is necessary for the execution of the sales contract.

9. Data retention

Personal data is retained for a period not exceeding that necessary for the purposes for which it was collected, subject to legal obligations and the need to protect the rights of the Data Controller.

In particular:

  • data relating to orders and contractual relationships are retained for the period necessary for the management of the relationship and subsequently for the time required by legal obligations or necessary to protect the rights of the parties;
  • documents and tax, accounting and administrative data are retained for the periods provided for by applicable regulations, normally equal to 10 years, unless further retention is necessary due to audits or disputes;
  • data associated with the account are retained as long as the account remains active and subsequently for the period that may be necessary to fulfil legal obligations or protect the rights of the Data Controller;
  • data relating to assistance requests and complaints are retained for the time necessary to manage the request and any protection of the rights of the parties;
  • data used for recovering abandoned carts are processed for the time necessary to manage the related procedure and to send the only communication provided, without prejudice to any data that must be retained for other legitimate purposes;
  • data collected through Google Analytics are retained according to the retention period configured in the service and within the limits necessary for the described statistical purposes;
  • the logs and technical security data are kept for the period necessary to ensure the security and proper functioning of the systems and to manage any anomalies or incidents.

Once the applicable period has elapsed, the data is deleted, anonymised or otherwise made non-attributable to the data subject, unless further retention obligations are provided by law.

10. Transfer of data outside the European Economic Area

Some technology service providers may process personal data even outside the European Economic Area.

When an international transfer of personal data occurs, it is carried out in compliance with Chapter V of the GDPR, based on, as applicable:

  • of an adequacy decision by the European Commission;
  • of the EU-US Data Privacy Framework, when applicable;
  • of the Standard Contractual Clauses approved by the European Commission;
  • of the other guarantees provided by the applicable legislation.

Per Google Analytics, il soggetto di riferimento per i dati trattati in Europa è Google Ireland Limited; Google prevede inoltre specifici meccanismi per la gestione degli eventuali trasferimenti internazionali dei dati. (Google Support [4])

Further information on the guarantees used can be requested by writing to info@hempathy.it.

11. Nature of data provision

The provision of the data required to complete a purchase is necessary to allow GrowClinica to manage the order, payment, shipping and the resulting obligations.

Failure to provide the necessary data may make it impossible to complete the purchase or provide the requested service.

The provision of data for purposes based on consent, such as the use of Google Analytics in the adopted configuration, is instead optional.

12. Automated decision-making processes

Hempathy SRL does not use the data collected through GrowClinica to make decisions based solely on automated processing that produces legal effects on the user or similarly significantly affects their person under Article 22 GDPR.

Payment service providers may independently use automated security and fraud prevention systems as provided in their respective notices.

13. Rights of the data subject

In the cases provided for by the regulations, the data subject may exercise the rights recognised by Articles 15 and following of the GDPR and, in particular:

  • to obtain confirmation whether or not personal data processing concerning them is ongoing;
  • to obtain access to their personal data;
  • to request the rectification of inaccurate data or the completion of incomplete data;
  • to request the deletion of data when the conditions are met;
  • to request the restriction of processing;
  • to obtain, in the cases provided, the portability of data;
  • to object to processing based on legitimate interest for reasons related to their particular situation;
  • to withdraw at any time the consent possibly given;
  • to object to communications regarding the recovery of abandoned carts;
  • to lodge a complaint with the competent supervisory authority.

The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.

To exercise their rights, the data subject may contact:

HEMPATHY SRL

E-mail: info@hempathy.it

Tel. +39 327 204 8259

Requests are handled within the timeframes provided by the GDPR.

14. Right to object

When the processing is based on the legitimate interest of the Controller, the data subject has the right to object to the processing in the cases provided for by Article 21 GDPR.

In particular, the user may object to the use of their data for sending the email related to the recovery of the abandoned cart by contacting info@hempathy.it.

15. Withdrawal and modification of consent related to cookies

The user may refuse optional cookies at the time of the first access to the site and may subsequently modify or withdraw their preferences through the specific cookie management function available on the site.

The withdrawal of consent does not compromise access to the essential functionalities of the site.

16. Complaint to the Authority

The data subject who believes that the processing of their personal data is occurring in violation of the GDPR or applicable regulations may lodge a complaint with the:

Data Protection Authority

according to the methods indicated by the Authority on its official website.

The right of the data subject to refer to the competent judicial authority is also preserved.

17. Links to third-party services

The site may contain links to sites or services managed by third parties.

Hempathy SRL does not control the methods of processing personal data carried out independently by such parties.

The user is invited to consult the relevant privacy notices before providing personal data through external services.

18. Services not currently active

At the time of publication of this notice, tools such as Meta Pixel, Google Ads tracking, newsletters or mailing lists, marketing automation or live chat services aimed at users are not active on the site.

Should such services be activated in the future and involve new processing of personal data or the use of additional tracking tools, this Privacy Policy and, when necessary, the Cookie Policy and the consent collection system will be updated prior to or at the same time as their activation.

19. Changes to the Privacy Policy

Hempathy SRL may update this Privacy Policy as a result of regulatory, technical, organisational changes or the services offered through the site.