Privacy Policy

Privacy Policy of coohesion.com

This policy describes how we process the personal data of users who visit the coohesion.com website, purchase products offered, sign up to receive promotional communications, or contact the Data Controller. It is provided pursuant to Art. 13 of EU Regulation 2016/679 (hereinafter "GDPR" or "Regulation").

1. Data controller

Data controller is Coohesion Pharma Soc. Coop., with registered office in Via Toledo, 156 – 80134 Naples (NA), VAT number 02890230648, represented by its legal representative Dr. Susanna Marchese. Contact details: email info@coohesion.com (general and product information), ordini@coohesionpharma.it (orders), tel. +39 333 939 8245.

2. Types of data processed

In relation to the use of the site, the following categories of data may be processed:

  • Navigation data: technical data collected automatically during navigation (e.g., IP address, browser type, pages visited, system logs), necessary for the operation and security of the site;
  • Registration and account data: name, surname, email and login credentials, if the user creates an account;
  • Purchase data: personal and contact details, billing information, shipping address, order information;
  • Payment details: The data required for payment are processed directly by the payment service providers (PayPal); the Owner neither gains knowledge of nor retains complete card details;
  • Data provided via contact forms: name, email and any other information entered to request information or assistance;
  • Data for signing up for promotional communications: name and email provided by the user to receive newsletters, offers and discount codes;
  • Data relating to withdrawal requests: data provided by the user to exercise the right of withdrawal.
3. Purposes and legal bases of the processing
  • a) Execution of purchases and contractual obligations (order management, shipping, customer service, returns and refunds). Legal basis: performance of a contract (Article 6, paragraph 1, letter b, GDPR).
  • b) Account management. Legal basis: performance of a contract or pre-contractual measures (Article 6, paragraph 1, letter b).
  • c) Response to requests sent via contact forms. Legal basis: execution of pre-contractual measures and legitimate interest (Article 6, paragraph 1, letters b and f).
  • d) Sending promotional communications (newsletters, offers, product discount codes, and informative content) via the Mailchimp email marketing platform. Legal basis: user consent (Article 6, paragraph 1, letter a), which can be revoked at any time, including via the unsubscribe link included in each communication.
  • e) Legal obligations (tax, accounting, regulatory). Legal basis: legal obligation (Article 6, paragraph 1, letter c).
  • f) Management of withdrawal requests. Legal basis: performance of the contract and legal obligation (Article 6, paragraph 1, letters b and c).
  • g) Statistics and marketing through cookies and tracking tools (see point 4). Legal basis: user consent (Article 6, paragraph 1, letter a).
  • h) Security and correct functioning of the site. Legal basis: legitimate interest of the Data Controller (Article 6, paragraph 1, letter f).
4. Cookies and tracking tools

The site uses technical cookies necessary for its operation and, with the user's consent provided via the appropriate banner, statistical and marketing cookies and tools, including Google Analytics (via Google Site Kit), Google Tag Manager, and the Meta/Facebook pixel. For a detailed description of the cookies used and to manage your preferences, please refer to the site's Cookie Policy, accessible from the relevant banner and footer.

5. Method of treatment

Processing is carried out using computerized and electronic tools and, where necessary, manually, adopting appropriate technical and organizational measures to protect the data, in accordance with the principles of lawfulness, fairness, data minimization, and security set forth in the Regulation. The Data Controller does not perform processing based on automated decision-making processes.

6. Data recipients and data controllers

Data may be disclosed, to the extent necessary, to: IT, hosting, and website maintenance service providers; payment service providers (PayPal); couriers and shipping agents; the email marketing platform provider (Mailchimp – Intuit Inc.); providers of statistics and marketing tools (Google, Meta), within the limits of the consent given; consultants and professionals of the Data Controller; and competent authorities, where required by law. These entities, where they process data on behalf of the Data Controller, are appointed as Data Processors pursuant to Art. 28 of the Regulation. The data will not be disclosed.

7. Transfer of data outside the European Union

Some providers (e.g., Google, Meta, and Mailchimp) may process data outside the European Union. These transfers are carried out in compliance with the guarantees set forth in Articles 44 et seq. of the Regulation (adequacy decisions or standard contractual clauses). Users can request further information on the guarantees adopted by contacting the Data Controller.

8. Retention period

Data is retained for the time strictly necessary for the purposes for which it was collected. Specifically: purchase data and fiscal and accounting data are retained for the time required by applicable law; account data until it is deleted or the interested party requests it; contact form data for the time necessary to process the request; subscription data for promotional communications until consent is revoked (unsubscribe) or, in the absence of interaction, for a period not exceeding 24 months; data and logs of withdrawal requests for the time required for evidentiary and legal purposes.

9. Rights of the interested party

At any time, the user may exercise the rights provided for in Articles 15-22 of the Regulation: access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection, and withdrawal of any consent given (without prejudice to the lawfulness of processing based on consent before its withdrawal). To exercise these rights, the user may write to: info@coohesion.comThe user also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

10. Management of withdrawal requests

When the user exercises the right of withdrawal, also through the digital function "Right of withdrawal” available on the site, the Data Controller processes the data necessary to manage the request (name and surname, address, email, telephone number, order number, products, date and time of the request), for the purposes and according to the legal bases indicated in point 3, letter f).

11. Changes to this Policy

The Data Controller reserves the right to modify or update this policy to reflect regulatory or organizational changes. Any changes will be posted on this page, indicating the update date.

Last update: 19 June 2026