1. Scope of this notice
This notice applies to browsing indiretto.com, voluntarily submitting Contact requests or pharmacist pilot applications, and the communications needed to handle them.
It does not cover the authenticated platform, other Network onboarding or activities, campaigns, profiling or Rewards.
2. Data controller
The data controller is Monsoon S.r.l., sole-shareholder company. Indiretto is a trademark and service of Monsoon S.r.l.
- Monsoon S.r.l., sole-shareholder company
- Registered office: Via Gaudenzio Fantoli 28/15, 20138 Milan (MI), Italy
- Italian tax code and VAT number: 11353620963
- Registered with the Milan Monza Brianza Lodi Companies Register
- REA economic and administrative index: MI-2597735
- Share capital: €10,000.00, fully paid up
- The company is not subject to the direction and coordination of another company and is not in liquidation.
No Data Protection Officer (DPO) has been appointed.
3. Data we process
The Contact form may collect the data that the person chooses to provide:
The Contact form is not intended to collect health data or other special categories of personal data under Article 9 GDPR. Do not include such information in the message.
- contact type;
- first and last name;
- organisation, if provided;
- role or profession;
- email address;
- telephone number, if provided;
- country;
- area of interest;
- message content.
- for applications: professional role, municipality, province and an optional short motivation.
The website and its infrastructure may also process technical data strictly necessary for security, transmission and operation. Indiretto does not currently record IP addresses or user agents in the Contact form database.
4. Purposes and legal bases
- Responding to requests about projects or services and taking pre-contractual steps at the data subject’s request: Article 6(1)(b) GDPR, where applicable.
- Managing general enquiries, partnerships and organisational communications: the controller’s legitimate interest in organising and following up incoming communications, Article 6(1)(f) GDPR.
- Complying with legal obligations: Article 6(1)(c) GDPR, where applicable.
- Protecting the website, preventing abuse and safeguarding the controller’s rights: legitimate interest under Article 6(1)(f) GDPR.
- Assessing and managing a voluntary pilot application and contacting the applicant: requested pre-contractual steps under Article 6(1)(b) GDPR and organisational legitimate interests under Article 6(1)(f), depending on context.
- Sending marketing communications only after separate optional consent under Article 6(1)(a) GDPR.
Acknowledging this notice is not consent, and consent is not the legal basis used to respond to a request.
5. Required and optional information
Fields marked as required are necessary to understand and handle the request. Organisation and telephone number are optional. The form cannot be submitted without the required information.
6. Recipients
Where necessary, data may be accessed by the following categories of recipients:
- personnel authorised by Monsoon S.r.l.;
- website hosting and infrastructure providers;
- backend and database providers;
- email and communications providers when needed to follow up a request;
- technical or professional advisers when necessary;
- public authorities where required by law.
Providers processing data on the controller’s behalf are appointed as processors where required.
7. International transfers
The use of technology providers may involve transfers outside the European Economic Area. Where applicable, transfers rely on an adequacy decision or appropriate safeguards, including standard contractual clauses and any necessary supplementary measures.
Information about the safeguards applied or, where applicable, a copy of them may be requested by writing to:
8. Retention
Requests that do not lead to a contractual relationship are retained for no more than 12 months after the last interaction. Data may be retained longer only where necessary to meet legal obligations or to establish, exercise or defend legal claims.
9. Marketing, profiling and automated decisions
Submitting a form or application does not automatically subscribe the sender to marketing. Marketing consent is separate, optional and may be withdrawn at any time by emailing privacy@indiretto.com. Communications needed to confirm or manage an application are transactional and are not recorded as marketing. Form data is not used for solely automated decisions or profiling.
10. Your rights
Where provided by the GDPR, data subjects may request access, rectification, erasure, restriction of processing, data portability and object to processing. They may also withdraw consent for any processing that may rely on it, without affecting the lawfulness of processing carried out before withdrawal.
11. Complaint to a supervisory authority
Data subjects may lodge a complaint with the Italian Data Protection Authority, without prejudice to any other available administrative or judicial remedy.
12. Changes to this notice
This notice may be updated to reflect legal, technical or organisational changes. The version and date shown on this page identify the current text.