Privacy and Cookie Notice

Notice pursuant to Article 13 of Regulation (EU) 2016/679

In order to provide its services, this website collects and processes data supplied by users. This page provides data subjects with information on the processing of their personal data, as required by the EU General Data Protection Regulation 2016/679 ("GDPR").

The Data Controller

The data subject's personal data are used by the data controller in compliance with the principles of Regulation (EU) 2016/679.

The Data Controller is Holistik Line Srl - COE SM22754, registered office: Via XXV Marzo, 19B - 47895 Domagnano (Republic of San Marino). Contact details: Tel. 0549906690 - email: info@vet-line.sm

Representative in the European Union

As the Controller is established outside the European Union and offers goods to data subjects located in the Union, the following has been designated as Representative in the European Union pursuant to Art. 27 GDPR: Avv. Piero Favaretto, registered with the Venice Bar Association under no. 3348, VAT No. 04183570270, Corso Del Popolo 14, 30172 Mestre, info@studiopierofavaretto.it. Data subjects may contact either the Controller or the Representative regarding any matter relating to the processing of their data.

The categories of data collected by the data controller vary according to how the user uses the website.

This notice is made up of the following sections:

1. Browsing the website
2. Contact requests
3. Newsletter/marketing communications sign-up
4. Registered users
5. Usage statistics and advertising measurement (Google Analytics and Meta Pixel)
6. Rights of the data subject
7. Cookie policy

This Privacy Policy may be updated. Last published: 02/11/2026.

1. Browsing the website

Categories of data

If the user simply browses the website, the data controller collects browsing data. Although these data are not collected in order to be associated with identified data subjects, by their very nature they could allow users to be identified and therefore constitute personal data. This category includes, for example, the IP addresses or domain names of the computers used by users connecting to the website, the URI addresses of the resources requested, the time of the request and other parameters relating to the user's operating system and IT environment.

Purposes and legal basis of processing

These data are processed for the purposes of technical and functional access to the website, analysis of traffic data in aggregate form, and IT security. They are processed in order to obtain technical information on the use of the website, to check that it is functioning correctly and to ensure network and information security.

The legal basis for processing is the controller's legitimate interest in the correct and secure operation of the website (Art. 6(1)(f) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR). The provision of internet traffic data is technically necessary, as it is essential for browsing.

Usage statistics collected through Google Analytics and advertising measurement through the Meta Pixel are separate processing operations, based on the user's consent, described in section 5.

Recipients of the data

Without prejudice to any disclosures that may be made at the request of the competent authority for security investigations, the data may be processed solely by authorised internal staff and by technical service providers (e.g. hosting), appointed as data processors pursuant to Art. 28 GDPR.

Processing methods

The controller processes internet traffic data only to the extent strictly necessary and proportionate to ensure the correct functioning of the website and network and information security. The data are processed using automated tools solely for the purposes indicated above and for no longer than is strictly necessary to achieve the purposes for which they were collected. The technical and organisational security measures necessary to prevent data loss, unlawful or incorrect use and unauthorised access have been adopted.

Data retention period

Browsing logs are kept for no longer than 12 months, unless required by the authorities for the investigation of computer crimes or unless otherwise required by law.

2. Contact requests

Categories of data

In the contact section, website visitors may request information by sending an email or by completing the contact form. In this case, the data controller receives the following information: email address, first name, surname and telephone number.

Purposes and legal basis of processing

The data are processed solely in order to respond to the data subject's request. The legal basis is the performance of pre-contractual measures taken at the data subject's request and/or the controller's legitimate interest in responding to requests received (Art. 6(1)(b) and (f) GDPR). Any marketing communications will be sent only with the data subject's separate and specific prior consent, as described in section 3.

Recipients of the data

The data provided by the data subject may be disclosed, solely for the purpose of handling the request, to authorised internal staff and to any technical service providers appointed as data processors under Art. 28 GDPR.

Processing methods

Processing will be carried out using manual and electronic tools, with organisational logic strictly related to the purposes themselves.

Data retention period

The data will be kept for as long as necessary to deal with the request and, thereafter, for a maximum of 12 months for the purpose of handling any related requests.

3. Newsletter/marketing communications sign-up

Categories of data

Website visitors may sign up to the newsletter. In this case, the data controller receives the following information from the data subject: first name, surname and email address.

Purposes and legal basis of processing

The legal basis for processing is the data subject's consent (Art. 6(1)(a) GDPR); the provision of data is optional and takes place through explicit approval, solely for the following purposes:

• Sending marketing and promotional communications about products and services;
• Newsletter.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal, by using the unsubscribe link at the bottom of each communication or by contacting the controller using the details provided.

Recipients of the data

The data provided by the data subject may be disclosed, solely for the purpose of providing the requested communication service, to the following categories of recipients:

• Internal staff authorised to process data. Purpose: technical and commercial tasks connected with the requested service.
• Third-party mailing service providers (the Brevo email marketing platform). Purpose: technical provision of the service. This provider is appointed as data processor under Art. 28 GDPR.

Transfer of data outside the European Union

Where, in order to provide the service, data are processed by providers located outside the European Union (including processing by the Controller, which is established in the Republic of San Marino), the transfer takes place only where appropriate safeguards are in place pursuant to Chapter V GDPR, such as an adequacy decision of the European Commission or the standard contractual clauses adopted by the European Commission. Data are not transferred outside the European Union, except for access by the Controller established in San Marino, which is governed by appropriate safeguards. Data subjects may request a copy of these safeguards using the controller's contact details.

Data retention period

Data collected on the basis of consent are kept until consent is withdrawn and, if consent is not withdrawn, for a maximum of 24 months, without prejudice to the rights of the data subject, in particular the right to erasure, as explained in the section "Rights of the data subject".

4. Registered users

Categories of data

If a visitor registers on the website, the data controller receives the following information: first name, surname, title, email address and date of birth (optional).

If an order is placed on the website, the data controller receives the following additional categories of data concerning the data subject: delivery/shipping address(es) (street, town of residence and province, nationality), telephone number (landline and/or mobile) and tax code (codice fiscale).

Bank/postal details: whether these data are collected depends on the payment method used. With electronic payments, the data are acquired directly by the payment service provider and are neither received nor processed by this website.

Purposes and legal basis of processing

The data subject's personal data will be processed in connection with the services and products offered by the e-commerce website, for the purposes described below, which are differentiated according to the legal basis for processing and whether the provision of data is mandatory or optional.

• Steps preliminary to the formation, performance and conclusion of the contract; customer management. Legal basis: performance of a contract and of pre-contractual measures (Art. 6(1)(b) GDPR). The provision of data is mandatory.
• Compliance with obligations under laws, regulations and/or EU legislation or imposed by other competent authorities. Legal basis: legal obligations (Art. 6(1)(c) GDPR). The provision of data is mandatory.
• Administrative and accounting activities and credit management/debt recovery. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR), assessed by balancing the interests of the controller against those of the data subject.

Refusal to provide the mandatory data may make it impossible to provide the requested service.

Categories of recipients

Without prejudice to disclosures made in compliance with legal obligations, the data collected may be disclosed to the following categories of recipients, solely for the purposes described:

• Internal staff authorised to process data. Purpose: commercial, administrative and accounting tasks and tasks connected with the performance of the contract.
• Third-party providers appointed as data processors under Art. 28 GDPR. Purpose: provision of services (support, maintenance, product delivery/shipping, electronic communications network and service providers) connected with the requested service.
• Banks and digital payment institutions. Purpose: management of receipts, payments and refunds connected with the performance of the contract.
• External professionals/advisers and consultancy firms. Purpose: compliance with legal obligations, exercise and protection of contractual rights, debt recovery.

Processing methods

Processing will be carried out using both manual tools (e.g. registration forms, order forms) and electronic/telematic tools (management and accounting software, etc.), with organisational and processing logic strictly related to the purposes themselves and in any case so as to ensure the security, integrity, confidentiality and availability of the data, in compliance with the organisational, physical and logical measures laid down by the regulations in force. The controller requires its providers to apply appropriate security measures, limiting their scope of action to the service requested.

Data retention period

The data required for user registration on the website and contractual data are kept for as long as necessary for the business relationship and, thereafter, for the ordinary limitation period (10 years) for the purpose of protecting contractual rights. Accounting and tax data are kept for the period required by the relevant legal obligations.

5. Usage statistics and advertising measurement (Google Analytics and Meta Pixel)

The website uses two third-party tools: Google Analytics 4, to obtain statistics on the use of the website, and the Meta Pixel, to measure the effectiveness of advertising campaigns on Facebook and Instagram. Both operate fully only with the user's consent, given through the cookie banner ("Measurement" and "Profiling" categories).

Categories of data

Google Analytics 4 (with consent to the "Measurement" category): a pseudonymous online identifier stored in cookies; pages visited and referring website; date and time of the visit; technical characteristics of the device and browser; approximate geographical location, derived from the IP address which, according to Google, is not stored; actions taken on the website: viewing products and product lists, internal searches, visiting the "Stockists" page, submitting the contact form, signing up to the newsletter, registering, clicking on telephone, email and WhatsApp contact details, basket operations and purchases (order number, products and amounts).

For customers who are logged in to their account, the customer's internal numeric code, which contains neither name nor email address, may also be sent to Google Analytics.

Meta Pixel (only with consent to the "Profiling" category): browser identifier and, if the user arrives from an advert, click identifier, stored in cookies; IP address; technical characteristics of the device and browser; pages visited and referring website; actions taken on the website: viewing products (product code and name), internal searches including the search term, visiting the "Stockists" page, submitting the contact form, signing up to the newsletter, registering, clicking on telephone, email and WhatsApp contact details. Meta also automatically detects button clicks and some descriptive information about the pages (e.g. title and metadata). If the user is logged in to Facebook or Instagram in the same browser, Meta may associate these data with their account.

Meta's automatic advanced matching feature is active on the website: when the user fills in a form (contact, registration, newsletter), the Pixel may detect email address, first name, surname, telephone number, gender, date of birth, city, province/state, postcode and country, and sends them to Meta after converting them into an unreadable code (hash), which Meta uses to recognise the user among its members. This feature also operates only with consent to the "Profiling" category.

Purposes and legal basis of processing

• Usage statistics (Google Analytics): understanding how the website is used, which content and products are of interest and which channels visitors come from, in order to improve its content and functioning. Legal basis: the data subject's consent (Art. 6(1)(a) GDPR and Art. 122 of Italian Legislative Decree 196/2003).
• Advertising measurement and personalisation (Meta Pixel): measuring the results of campaigns on Facebook and Instagram, showing adverts to people who have already visited the website (remarketing) and identifying audiences with similar interests. Legal basis: the data subject's consent (Art. 6(1)(a) GDPR and Art. 122 of Italian Legislative Decree 196/2003).

Google Consent Mode v2. Until the user consents to the "Measurement" category, or if they refuse it, Google Analytics does not set cookies and does not use persistent identifiers, but receives cookieless signals (page visited, date and time, technical browser data, IP address and consent status), which Google uses in aggregate form to estimate the website's overall traffic. The legal basis for this processing is the controller's legitimate interest in aggregate traffic measurement (Art. 6(1)(f) GDPR); data subjects may object at any time by writing to the controller's contact details. The Meta Pixel, by contrast, is not loaded and transmits no data without consent.

The provision of data is optional: refusing or withdrawing consent does not prevent use of the website. Consent may be changed or withdrawn at any time from the "Cookie preferences" panel, as described in section 7.

Recipients and roles

• Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), provider of Google Analytics, which processes the data on behalf of the controller as data processor pursuant to Art. 28 GDPR. Privacy notice: policies.google.com/privacy; how Google uses data collected on websites that use its services: policies.google.com/technologies/partner-sites.
• Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), which, for the collection and transmission of data through the Pixel, is joint controller together with the controller pursuant to Art. 26 GDPR, under the agreement available at facebook.com/legal/controller_addendum. For processing carried out after receiving the data (e.g. personalised advertising and improvement of its own services), Meta acts as an independent controller: privacy notice facebook.com/privacy/policy. Under the joint controller agreement, data subjects may exercise their rights in relation to this processing directly against Meta; they may nevertheless also contact the controller.

Transfer of data outside the European Union

Google and Meta may transfer the data to their respective parent companies in the United States (Google LLC and Meta Platforms, Inc.). Both participate in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission by decision of 10 July 2023; any transfers not covered by it are subject to the standard contractual clauses adopted by the European Commission.

Data retention period

Cookies have the duration indicated in the tables in section 7. In Google Analytics, user-level and event-level data are kept for the period set by the controller, in any case no longer than 14 months, after which only aggregate statistics remain available. Meta keeps the data as set out in its own privacy notice.

6. Rights of the data subject

In relation to the processing described in this Notice, data subjects may exercise the rights set out in Articles 15 to 22 GDPR, and in particular the following rights:

• to access their personal data;
• to obtain the rectification of inaccurate personal data and/or the completion of incomplete personal data;
• to obtain the erasure of their personal data;
• to obtain the restriction of processing;
• to data portability;
• to object to the processing of their personal data, subject to any overriding legitimate interests of the controller;
• to withdraw consent where applicable (in which case withdrawal does not affect the lawfulness of processing based on consent given before its withdrawal);
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them;
• to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, Piazza Venezia, 11 – 00187 Rome) or with the supervisory authority of the EU Member State in which they reside or are domiciled.

The above rights may be exercised against the data controller (or the EU Representative) by contacting them using the details provided here. Exercising these rights is free of charge. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee, taking into account the administrative costs of handling the request, or refuse to act on the request.

7. Cookie policy

What are cookies?

Cookies are small text files that the websites visited send to the user's device, where they are stored and then sent back to the same websites on the next visit. There are also similar technologies (e.g. web beacons, pixels, local storage) to which the same rules apply. Cookies are used to make the website work efficiently, to improve its performance and the browsing experience and, in some cases, for statistical or marketing purposes.

Types of cookies used and legal basis

Technical and functional cookies. These are essential for the website to function correctly and to provide the services requested by the user (e.g. session management, authentication, basket contents, storing preferences such as language). They are divided into session cookies, which are deleted when the browser is closed, and persistent cookies, which are kept until they expire or are deleted by the user. Consent is not required for these cookies, as the legal basis is the controller's legitimate interest in the functioning of the website.

Analytics cookies. These are used to collect statistical information on the use of the website. They may be set without consent only if they are first-party cookies and are appropriately anonymised in accordance with the criteria laid down by the Italian Data Protection Authority (Garante); in all other cases (e.g. third-party analytics tools that do not meet these criteria) they require the user's consent.

Profiling and third-party cookies (marketing/social). These are used to track browsing, build profiles of the user's tastes and habits and send advertising in line with the preferences expressed, as well as to enable interaction with external platforms (e.g. social networks, embedded videos). These cookies are set only with the user's prior free, specific and informed consent (Art. 6(1)(a) GDPR and Art. 122 of Italian Legislative Decree 196/2003).

Consent management

On the first visit to the website, a banner is displayed allowing the user to accept all cookies, reject them (continuing with technical cookies only) or select, on a granular basis, the categories to which they consent. No non-technical cookies are set before consent has been obtained; without consent to the "Measurement" category, Google Analytics operates without cookies, as described in section 5. Users may change or withdraw their choices at any time by opening the cookie preferences panel by clicking on the "Cookie preferences" icon at the bottom left of every page. Withdrawing consent is as easy as giving it.

List of cookies used

Below is the list of cookies actually used by the website, grouped by category, with their purpose, duration and, for third-party cookies, the party that sets them and a link to its privacy notice.

1. Technical and strictly necessary cookies

These are essential for the website to function and for the security of transactions. They are set automatically and do not require consent.

2. Analytics cookies

These are set only if the user consents to the "Measurement" category via the banner or the preferences panel. If the user refuses, or withdraws consent, they are not set.

Users can also prevent data collection by Google Analytics on all websites by installing the browser add-on provided by Google: tools.google.com/dlpage/gaoptout.

3. Profiling cookies

These are set only if the user consents to the "Profiling" category via the banner or the preferences panel. If the user refuses, or withdraws consent, they are not set.

With consent to the "Profiling" category, the Meta Pixel also stores in the browser's local storage the entries lastExternalReferrer, lastExternalReferrerTime and multiFbc, which record the referring website and the advert click identifiers. These entries do not expire automatically and can be removed by clearing the website's data in the browser settings. If the user is logged in to Facebook or Instagram in the same browser, Meta may also read its own cookies already present on the facebook.com domain (e.g. "fr"), in accordance with its cookie policy.

4. Social media and third-party cookies

The website does not use social media plugins or widgets. The links to the Facebook and Instagram pages in the footer are simple links: they contain no active share buttons or embedded content and do not transmit any data to social networks unless the user chooses to click on them. The website does not embed videos or maps from social media platforms. The Meta Pixel, described in the table above and in section 5, is instead an advertising tool of Meta, the company that operates Facebook and Instagram: it transmits data to Meta only if the user has consented to the "Profiling" category.

However, some pages load resources hosted by external providers which, although they do not set cookies, receive the user's IP address and technical browser data in order to deliver the content:

• Cloudflare Turnstile – anti-spam check on the contact and registration forms. Cloudflare, Inc. – cloudflare.com/privacypolicy
• Google Maps – interactive map on the "Stockists" page. Google Ireland Ltd. – policies.google.com/privacy
• Google Fonts – typefaces used by the map. Google Ireland Ltd. – policies.google.com/privacy
• Google Analytics in cookieless mode – without consent to the "Measurement" category, the website sends Google the cookieless signals described in section 5. Google Ireland Ltd. – policies.google.com/privacy

How to manage cookies in your browser

In addition to the website's preferences panel, users can also manage or disable cookies that have already been stored via their browser settings. However, disabling technical cookies may slow down or prevent access to some parts of the website. Instructions for the most widely used browsers are available at the following pages:

• Google Chrome: support.google.com/chrome/answer/95647
• Mozilla Firefox: support.mozilla.org/it/kb/protezione-antitracciamento-avanzata-firefox-desktop
• Microsoft Edge: support.microsoft.com/it-it/microsoft-edge
• Apple Safari: support.apple.com/it-it/guide/safari/sfri11471/mac

For further information on third-party profiling cookies and how to disable them, please visit www.youronlinechoices.eu

Last updated 02/11/2026 – Document version 1.3