Find your store
🚚 Free delivery on all orders over €49🚚
Research and quality by ESI for your natural well-being
Subscribe to the site and newsletter
Sign up and get 15% off

Privacy Policy

PRIVACY POLICY

This Privacy Policy is provided pursuant to art. 13 of European Regulation no. 679/2016 and applies exclusively to all Data collected through the website www.esi.it This Privacy Policy is subject to updates that will be promptly published on the Website. This Privacy Policy and the Cookie Policy establish the bases on which the personal data of the data subject will be processed.

Data Controller

The Data Controller of the Data collected from this website is Esi Srl, Corso Ferrari n.74/6, 17011 Albisola Superiore (SV) email: privacypolicy@sodalisgroup.com

Data Protection Officer (DPO)

In compliance with the provisions of the Regulation, the Data Controller has appointed, pursuant to articles 37-39 of the GDPR, a Data Protection Officer (DPO), with the task of overseeing compliance with the Regulation and acting as a point of contact with the data subjects and with the Data Protection Authority. The DPO, Dr. Stefano Modena, can be contacted at the email address: stefano.modena@howdengroup.com

Web platform

The website is built with platforms that host and operate its key components. These platforms can provide analytical tools, for user registration management, comment and database management, e-commerce, payment processing, etc. The use of such tools involves the collection and processing of Personal Data.

Some of these services operate through servers located geographically in different places, making it difficult to determine the exact location where Personal Data is stored.

Personal Data Processed

Personal Data means any information relating to an identified or identifiable natural person (Data Subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical identity.

Category of Personal Data processed
Among the Personal Data processed by this website, autonomously or through third parties, there are Common Data such as:

  • Personal data (such as name, surname, date of birth, age, gender, etc.);

  • Contact details (e-mail, address, telephone number);

  • Geolocation data (including "IP" addresses);

  • Internet browsing data (including data derived from the use of social icons and social login buttons - e.g. Facebook, Instagram, TikTok, etc. -) collected through cookies installed on the computer or mobile device (for more information consult the Cookie Policy);

  • Bank details such as payment method or credit card information;

  • Domicile/residence and shipping data, billing address;

  • Login and account information, including username, password and unique user ID;

  • Personal data, including purchase history;   

  • Data relating to your interactions with the data controller's websites, such as, but not limited to, data relating to participation in questionnaires, initiatives, contests, promotions, events (including through our social channels);   

  • If a request is sent through the "Contacts" section of the Site, the provision of certain Personal Data is necessary for the Data Controller to fulfill the requests, so the relevant fields of the registration form are marked as mandatory;  

  • In addition to the aforementioned categories of Personal Data, further data directly provided by the Data Subject (the so-called "Contributions") and shared on social network pages, such as likes, comments, images, and generally any content and information you may publish on the Data Controller's social network pages, may be processed;  

  • Cookies and Usage Data;  

  • Personal preferences including your wish list, as well as marketing and cookie preferences.   

  

Methods of Personal Data Processing  

The Personal Data provided or acquired will be processed in accordance with the principles of fairness, lawfulness, transparency, and protection of confidentiality in compliance with current regulations. The Data Controller processes Users' Personal Data by adopting appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data. Processing is carried out using computerized and/or telematic tools, with organizational methods and logic strictly related to the stated purposes.   

  

Purposes of Personal Data Processing and Legal Basis   

Personal Data may be collected independently by the Data Controller or through third parties. In this case, the computer systems and software procedures used to operate this website acquire certain technical-informatic Personal Data of Users (e.g., IP address, type of browser used, operating system, domain name and addresses of websites from which access or exit occurred, etc.), the transmission of which is inherent to the normal functioning of the internet. Such data may be processed solely for the purpose of obtaining anonymous statistical information on the use of the site and/or to check its correct functioning and will be deleted immediately after processing.  

The Data that the Data Subject chooses to provide spontaneously will be processed in compliance with the lawfulness conditions ex art. 6 GDPR and will be processed to allow the website to provide its services, as well as for the Purposes indicated below, and will be retained for the time necessary to fulfill the aforementioned Purposes. Specifically, the purposes of the processing are:  

  

1) Respond to requests and provide information   

The Data will be processed to be contacted or to follow up on specific requests addressed to the Data Controller by the Data Subject for communications of a nature related to the Data Controller's Services and/or Content, via email messages or other communication tools such as phone or WhatsApp Business instant messaging.  

Legal basis: this processing is optional and based on the consent of the Data Subject; however, the provision of Data is necessary for the stated purpose.  

Data retention period: until the Data Subject revokes consent.  

  

2) Website registration  

The registration procedure, by creating an account or using an existing social network account, is aimed at allowing the use of the website as a "registered user" and accessing a series of services offered through the same applications. The Data will be processed for registration on the Data Controller's site for the purchase of the Data Controller's Products.  

Legal basis: The legal basis for processing is the execution of pre-contractual measures to which the data subject is a party, this processing and the consent of the data subject who can always change their mind; however, the provision of Data is necessary for the stated purpose.  

Data retention period: until the Data Subject revokes consent.  

  

3) Processing necessary within the framework of a contract  

The Data will be processed to fulfill the obligations arising from the contract concluded between the Data Subject and the Data Controller for the sale of Products on the website, to contact the Data Subject regarding the Contract and for its management, for handling legal guarantee requests, assistance, withdrawal requests, and management and termination of the Contract itself.  

Legal basis: this processing is necessary for the performance of the contract to which the Data Subject is a party, for the execution of pre-contractual measures, or to comply with a legal obligation to which the Data Controller is subject.  

Data retention period: the period indicated by law and in any case for a maximum period of 10 years for the purpose of fulfilling related administrative and tax obligations.  

  

4) Compliance with any obligations established by current laws  

The Data will be processed to comply with any type of obligation contemplated and provided for by current laws, regulations, related norms, commercial practices and tax/fiscal matters, including for the purposes provided for by anti-money laundering legislation D.Lgs. 231/2007 and subsequent amendments.  

Legal basis: this processing is necessary to fulfill a legal obligation to which the Data Controller is subject.  

Data retention period: period indicated by law and in any case for a maximum period of 10 years for the purpose of fulfilling related administrative and tax obligations.  

  

5) Soft spam  

The Data will be processed to allow the Controller to send commercial and promotional communications via email to the Data Subject concerning Products similar to those sold, without the need for the Data Subject's express and prior consent, as provided for by art. 130, paragraph 4, of the Privacy Code as amended by Legislative Decree no. 101 of 2018, and provided that the Data Subject does not exercise the right to object.  

Legal basis: this processing is based on the legitimate interest of the Data Controller pursuant to art. 6, letter F and Recital no. 47 of the GDPR.  

Data retention period: until the Data Subject objects.  

  

  

6) Marketing  

The Data will be processed for direct sales of Products, market research, sending promotional, commercial and advertising communications and materials, or related to initiatives and events, via email, Newsletter, SMS, Whatsapp, Chat, Facebook forms, social networks or by phone calls, postal mail and other informational materials.  

Legal basis: this processing is based on the freely expressed consent of the Data Subject pursuant to art. 6, par. 1, letter A of the GDPR.  

Data retention period: until the Data Subject withdraws consent.  

  

7) Statistics  

The Data will be processed to carry out statistical analyses, including on aggregated and anonymous data, to analyze the behavior of the Data Subject in order to improve the products and services provided by the Controller and to satisfy the expectations of the Data Subjects.  

Legal basis: this processing is based on the freely expressed consent of the Data Subject.  

Data retention period: until the Data Subject withdraws consent.  

  

8) Profiling  

The Data will be processed for the analysis and evaluation of interests, habits, consumption choices, including the creation of profiles in order to send personalized informative and promotional material on the Products offered by the Data Controller.  

Legal basis: this processing is based on the freely expressed consent of the Data Subject pursuant to art. 6, par. 1, letter A of the GDPR.  

Data retention period: until the Data Subject withdraws consent.  

  

9) Inclusion in Wish List  

The Data will be processed to follow up on the specific request made by the Data Subject to the Data Controller to be included in the waiting lists for out-of-stock Products and to be contacted when the Product of interest becomes available again.  

Legal basis: this processing is optional and based on the consent of the Data Subject, however the provision of Data is necessary to achieve the indicated purpose.  

Data retention period: until the Data Subject withdraws consent.  

  

10) Customer Reviews  

The Data will be processed for the publication of reviews on the Supplier's Services in order to share experiences on the purchased Services for non-marketing purposes.  

Legal basis: this processing is based on the legitimate interest of the Data Controller pursuant to art. 6, letter F and Recital no. 47 of the GDPR.  

Data retention period: until the Data Subject objects.  
 
 

 

 

 

 

Data Communication

In addition to the Data Controller, in some cases, the following may have access to the Data:

a) categories of specifically trained personnel involved in the organization of the Website (administrative, commercial, marketing, legal personnel, system administrators);

b) external parties (such as third-party technical service providers, hosting providers, IT companies, communication agencies) also appointed as Data Processors by the Data Controller pursuant to Article 28 of the GDPR. The updated list of Processors, if appointed, can always be requested from the Data Controller;

c) public or private entities that may access Data in compliance with legal obligations;

d) parties performing ancillary and instrumental tasks to the Data Controller's activities.

Processing Times

As expressly provided for in Article 5, paragraph 1, letter e) of the GDPR, the Data is retained for the time necessary for its processing in relation to the performance of the service requested by the Data Subject, or required by the Purposes described above in this document. At the end of the retention period, the Personal Data will be deleted and therefore, the rights of access, erasure, rectification, and data portability can no longer be exercised.

Cookies

This Website uses cookies. Cookies are small text files that can be used by websites to make the experience more efficient for the Data Subject and to personalize content and ads, provide social network functions, and analyze traffic. Cookie Policy

Place of Processing and Transfer of Data Abroad

The Data is processed at the operational headquarters of the Data Controller. For further information, you can contact the Data Controller. The Data may be processed by natural persons and/or legal entities operating on behalf of the Data Controller and under specific contractual obligations, located in EU or non-EU member countries. In the event that the Data is transferred outside the EEA, the Data Controller will adopt all suitable contractual measures to ensure adequate Data protection.

Exercise of Data Subject Rights

The Data Subject has the right to exercise the faculties provided for in Articles 7, 15-22 of EU Regulation 679/2016. In particular, they have the right to withdraw their consent at any time and, upon simple request to the Data Controller, may request access to their Personal Data, receive the Personal Data provided to the Data Controller and, where possible, transmit it to another Data Controller without hindrance (so-called portability), obtain the update, restriction of processing, rectification of Data and erasure of Data processed in violation of current regulations. They have the right, for legitimate reasons, to object to the processing of their Personal Data and to processing for the purpose of sending advertising material, direct sales, and for carrying out market research. They also have the right to lodge a complaint with the Privacy Guarantor as the supervisory authority for personal data protection or to take appropriate legal action. The Data Subject may exercise their rights by contacting the Data Controller via e-mail at: privacypolicy@sodalisgroup.com

Tools used for Personal Data Processing

CONTACT FORM

By filling in the contact form with their Data, the Data Subject consents to its use to respond to requests for information, or any other purpose indicated in the form's heading. Personal Data collected via the Contact Form: Name and Surname, telephone number, Email.

OTHER CONTACT TOOLS

EMAIL ADDRESS MANAGEMENT

These services allow the management of a database of email contacts, telephone contacts, or contacts of any other type, used for communicating with the Data Subject. These services may also allow the collection of data relating to the date and time of viewing messages by the Data Subject, as well as the Data Subject's interaction with them, such as information on clicks on links included in the messages.

Newsletter

By subscribing to the newsletter, the Data Subject's email address is automatically added to a contact list to which email messages containing information, including commercial and promotional content, related to this Website may be sent. The Data Subject's email address may also be added to this list as a result of registration to this Site or after making a purchase. The Data Subject can choose to unsubscribe from the newsletter at any time by clicking on a specific button found within the emails. After clicking the unsubscribe button, the Data Subject's Data will be immediately deleted from the "email marketing" software. Personal Data collected: email and Name. This Website uses the newsletter service provided by:

Emarsys (SAP SE)
Emarsys is a service that allows you to organize, manage, and analyze the distribution of newsletters and marketing communications. If the Data Subject does not wish for their Personal Data to be processed via Emarsys, they may unsubscribe from the newsletter at any time using the dedicated link present in every communication sent.
Personal Data processed: name and email.
Place of processing: European Union (with possible transfers to third countries in accordance with current regulations).
Privacy Policy: https://www.sap.com/about/legal/privacy.html

WEBSITE REGISTRATION

By registering or authenticating, the Data Subject allows the website to identify them and grant them access to dedicated services.

The Data Subject can register directly on the website by filling out the Form and providing their Data.

Registration and authentication services may also occur with the help of third parties. In this case, the application may access some Data stored by the third-party service used for registration and identification. Some of the services indicated below may also collect Personal Data for targeting and profiling purposes.

This website uses:

Facebook Connect (Facebook Ireland Ltd)

Facebook Connect is a service provided by Facebook Ireland Ltd that facilitates and integrates the connection of the website with the social network. This website may request certain permissions from Facebook that allow it to perform actions with the Data Subject's Facebook account and collect information, including Personal Data, from it. For more information on the following permissions, the Data Subject can refer to Facebook's Privacy Policy (https://www.facebook.com/privacy/explanation).

Google Account Access (Google Ireland Limited)

This service, offered by Google Ireland Limited, allows this Website to connect with the Data Subject's Google account. Personal Data collected: Various types of Data as specified by the service's Privacy Policy. Place of Processing: Ireland – Privacy Policy (link to activate https://policies.google.com/privacy?hl=it)

STATISTICS

Statistical services allow the Data Controller to exclusively monitor and analyze traffic data and track the Data Subject's behavior. This Website uses the following services:

Facebook Pixel Conversion Tracking (Meta Platforms, Inc.)

Facebook Conversion Tracking (Facebook Pixel) is a statistics service provided by Facebook. The Facebook Pixel monitors conversions that can be attributed to Facebook ads. Personal Data collected: Cookies; Usage Data. Place of processing: Ireland - Privacy Policy. (link to activate https://www.facebook.com/about/privacy/)

Instagram Pixel Conversion Tracking (Meta Platforms, Inc.)

Instagram Conversion Tracking (Instagram Pixel) is a statistics service provided by Meta Platforms, Inc. The Instagram Pixel monitors conversions that can be attributed to Facebook ads. Personal Data collected: Cookies; Usage Data. Place of processing: Ireland - Privacy Policy (link to activate https://help.instagram.com/519522125107875)

TikTok Pixel Conversion Tracking (TikTok Ireland)

TikTok conversion tracking is a statistics service that allows the Data Controller to monitor customer conversions. Personal Data collected: Cookies; Usage Data. Place of processing: Ireland – Privacy Policy (link to be activated https://www.tiktok.com/legal/page/eea/privacy-policy/it)

SOCIAL NETWORK INTERACTION

These services allow interaction with social networks directly from the pages of this website. The interactions and information acquired from this website are in any case subject to the privacy settings of the Data Subject relative to each social network. If a social network interaction service is installed, it is possible that, even if Users do not use the service, it may collect traffic data relating to the pages on which it is installed.

Facebook (Meta Platforms, Inc.)

Facebook buttons are services for interacting with the Facebook social network, provided by Meta Platforms, Inc. Personal Data collected: Cookies and Usage Data. Place of processing: Ireland – Privacy Policy (link to be activated https://www.facebook.com/privacy/explanation)

Instagram (Meta Platforms, Inc.)

Instagram buttons are services for interacting with the Instagram social network, provided by Meta Platforms, Inc. Personal Data collected: Cookies and Usage Data. Place of processing: Ireland – Privacy Policy (link to be activated https://help.instagram.com/519522125107875)

Tik Tok (TikTok Technology Limited)

TikTok buttons are social network interaction services provided by TikTok Technology Limited. Personal Data collected: Cookies and Usage Data. Place of processing: Ireland – Privacy Policy (link to be activated https://www.tiktok.com/legal/page/eea/privacy-policy/it)

REMARKETING AND RETARGETING

These services allow this website to communicate, optimize and serve advertisements based on the past use of this website by the Data Subject. This activity is carried out through the tracking of Usage Data and the use of Cookies. This website uses the following services:

Facebook Remarketing (Meta Platforms, Inc.)

Facebook Remarketing is a Remarketing and Behavioral Targeting service provided by Facebook, which connects the activity of this website with the Facebook advertising network. This website uses the Facebook Pixel tool to measure conversions. Thanks to the Facebook Pixel, we can understand the actions that people perform on the website. The data collected can be used to:

- ensure that ads are shown to the right people;

- create audience groups to target ads;

- leverage additional advertising tools on the platform where advertising is done.

The information collected is anonymous to the operators of this Site and cannot be used to identify the identity of a single Data Subject. However, the information is saved and analyzed by Facebook, which could link the action to a single profile and use this information for internal advertising purposes on Facebook, as outlined in Facebook's privacy policy. This will allow Facebook to show ads both on Facebook and on third-party sites. The Site Owner has no control over how this data is used. For more information on how users can protect their privacy, please refer to Facebook's Privacy Policy. (link to activate https://www.facebook.com/about/privacy/)

Instagram Remarketing (Meta Platforms, Inc.)

Instagram Remarketing is a Remarketing and Behavioral Targeting service provided by Meta Platforms, Inc., which connects the activity of this Website with the Instagram advertising network. This Website uses the Pixel tool to measure conversions and understand the actions people take on the Website. The information collected is anonymous to the operators of this Website and cannot be used to identify a single Data Subject. However, the information is saved and analyzed by Facebook, which could link the action to a single profile and use this information for Facebook's internal advertising purposes, as outlined in Facebook's privacy policy. For more information on how users can protect their privacy, please refer to Instagram's Privacy Policy. (link to activate https://help.instagram.com/519522125107875)  

  

TikTok Ads (TikTok Technology Limited)  

TikTok Ads is a Remarketing and Behavioral Targeting service provided by (TikTok Technology Limited) which connects the activity of this Website with the TikTok advertising network. This Website uses the Pixel Tracking tool to measure conversions and understand the actions people take on the Website. For more information on how users can protect their privacy, please refer to TikTok's Privacy Policy. (link to activate https://www.tiktok.com/legal/page/eea/privacy-policy/it)  

  

Microsoft Bing ADS (Microsoft Corporation)  

Bing ADS is a service provided by Microsoft Corporation that connects this Website with the Microsoft advertising network. This service allows the display of advertisements based on the personal interests of the Data Subject, identified through an analysis of the Data Subject's behavior on the web, whether on a mobile device or other devices, through the Bing search engine. Personal Data collected: Cookies and Usage Data. Place of Processing: Europe – Privacy Policy (link to activate https://privacy.microsoft.com/it-it/privacystatement)  

  

Facebook Forms (Meta Platforms, Inc.)  

Facebook Forms is a service provided by Facebook. The service allows the creation of a campaign with the advertising objective of Leads in Ad Manager, where interactive forms can be selected as the conversion location. Interactive forms are designed to help generate and qualify leads by asking people to fill out a form. The Website Owner has no control over how this data is used. For more information on how users can protect their privacy, please refer to Facebook's Privacy Policy. (link to activate https://www.facebook.com/about/privacy/)  

  

PAYMENT MANAGEMENT  

Payment management services allow this Website to process payments via credit card, bank transfer, or other instruments. The data used for payment is acquired directly by the requested payment service provider without being processed in any way by this Website. Some of these services may also allow the scheduled sending of messages to the Data Subject, such as emails containing invoices or payment notifications. This Website uses the following services:  

PayPal (PayPal Europe S.à.r.l. et Cie, S.C.A Inc.)  

PayPal is a payment service provided by PayPal Europe S.à.r.l. et Cie, S.C.A Inc., which allows the Data Subject to make online payments using their PayPal credentials. Personal data collected: Cookies and various types of data as specified by the service's privacy policy. Place of processing: Luxembourg - Privacy Policy (link to activate https://www.paypal.com/it/webapps/mpp/ua/privacy-full)  

  

  

Changes to this Privacy Policy  

The Data Controller reserves the right to make changes to this Privacy Policy at any time by giving notice to Users on this page. Therefore, please consult this page frequently, referring to the last modification date indicated at the bottom. In case of non-acceptance of the changes made to this Privacy Policy, the Data Subject is required to cease using this Website and may request the Data Controller to remove their Personal Data. Unless otherwise specified, the previous Privacy Policy will continue to apply to Personal Data collected until then. The Controller is not responsible for updating all links displayed in this Privacy Policy; therefore, whenever a link is not working and/or updated, Users acknowledge and accept that they must always refer to the document and/or section of the websites referenced by such link.  

  

Privacy Policy updated as of April 2026

Seleziona i tuoi campioni (Seleziona )

XX di YY selezionato