Privacy Policy

PRIVACY POLICY REGARDING THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (“GDPR”) AND LEGISLATIVE DECREE NO. 196/2003

This privacy policy describes how the personal data of users who consult the website are processed https://alfakjn.com/ (hereinafter, the “Website”), fill in the contact forms, apply as distribution partners or register for the areas reserved for distributors and healthcare professionals.

1. Data controller

The data controller is Alfakjn S.r.l., in the person of its legal representative pro tempore, with registered office in Piazza della Repubblica, 22 – 27026 Garlasco (PV) and operational headquarters in Via Carlo Tortrino, 13 – 15048 Valenza (AL), VAT no. and Tax Code 02438220184 (hereinafter, “Alfakjn” or the “Data Controller”).

Contact: email info@alfakjn.com – Certified email (PEC) alfakjn@pec.it – tel. +39 0131 383132.

The updated list of external data processors and persons authorised to process data is kept at the Data Controller's registered office and may be requested using the contact details provided above.

2. Types of data processed

Browsing data. The computer systems and software procedures used to operate the Site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, domain names of the devices used, URI addresses of the requested resources, time of the request, method used, size of the response, status code returned by the server, and characteristics of the browser and operating system. This data is used to ensure the proper functioning and security of the Site and may be used to ascertain liability in the event of cyber crimes.

Data provided voluntarily by the user. Depending on the service used:

• contact forms and information requests: name, surname, email address, optional company or organisation, message content;
• distribution partner application: first name, last name, company, job title, email address, country or region of interest, therapeutic areas of interest, market description;
• registration for restricted areas (Distributors Area and Physicians Area): username, e-mail address, password (stored in encrypted form), country and further information requested in the registration form to verify the professional profile;
• use of restricted areas: log of access and downloaded documents (user, file, date and time, IP address).

The Site is not intended for the collection of health-related data: users are requested not to enter any clinical information regarding themselves or third parties into the forms.

Cookies and similar technologies. For the cookies and third-party tools used by the Site, please refer to the Cookie Policy.

3. Purposes and legal bases of the processing

1. Respond to enquiries sent via the website (information on products, technical or commercial materials) – legal basis: performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR);
2. Evaluate distribution partner applications and manage subsequent business relationships – legal basis: pre-contractual measures and performance of a contract (art. 6, para. 1, point (b), GDPR);
3. Manage registration and access to restricted areas, including profile verification and approval, and making confidential technical documentation available to distributors and healthcare professionals – legal basis: performance of the service requested by the user (Art. 6, para. 1, point (b), GDPR);
4. Keep track of confidential document downloads, to guarantee the security of restricted areas, prevent misuse and document the correct distribution of technical material – legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR);
5. Comply with legal obligations, accounting, tax and regulatory requirements, as well as requests from authorities – legal basis: legal obligation (Art. 6(1)(c) GDPR);
6. Ensure the security and operation of the Website and to protect the Data Controller's rights in legal proceedings – legal basis: legitimate interest (Article 6(1)(f) GDPR);
7. Compile aggregate statistics on Site usage via Google Analytics 4 – legal basis: consent expressed via the cookie banner (Art. 6(1)(a) GDPR), which can be withdrawn at any time;
8. Send commercial communications and newsletters on the Data Controller's products and initiatives – legal basis: consent (Art. 6, par. 1, lett. a, GDPR) or, for existing customers and for similar products, legitimate interest pursuant to Art. 130, paragraph 4, Legislative Decree 196/2003, without prejudice to the right to object.

4. Nature of the contribution

Providing the data marked as mandatory on the forms is necessary in order to respond to requests, evaluate applications and activate access to reserved areas: failing this, the Data Controller will not be able to provide the requested service. The provision of data for statistical and marketing purposes is optional and failure to consent has no consequence on the use of the Site.

5. Method of processing

Data are processed using IT and, where necessary, paper-based tools, with logic strictly related to the stated purposes and by adopting appropriate technical and organisational measures to ensure their security, integrity, availability and confidentiality (including an encrypted HTTPS connection, passwords stored in encrypted form, and access to restricted areas subject to approval). Access to data is permitted exclusively to authorised personnel. No automated decision-making processes or profiling activities are carried out.

6. Data recipients

Data may be disclosed, within the limits necessary for the stated purposes, to:

• hosting service providers for the Site and email (2MHost) and entities in charge of the technical management and maintenance of the Site, appointed as data processors pursuant to Art. 28 of the GDPR;
• Google Ireland Ltd. (Google Analytics), only with prior user consent;
• Vimeo.com Inc. (playback of embedded videos in “do not track” mode, which does not use profiling cookies);
• consultants, professionals and companies providing administrative, accounting, legal and regulatory services to the Data Controller;
• public authorities, supervisory bodies and judicial authorities, in the cases provided for by law.

The data is not subject to dissemination.

7. Transfer of data outside the European Economic Area

Some service providers (in particular Google and Vimeo, as well as hosting service providers if they operate with infrastructure located outside the European Economic Area) may also process data in third countries, including the United States. In such cases, the transfer is based on the European Commission's adequacy decision concerning the EU-U.S. Data Privacy Framework, for certified companies, or on standard contractual clauses approved by the European Commission. The user may request information from the Data Controller regarding the safeguards adopted for each service.

8. Retention period

• requests for information: for the time necessary to handle the request and, subsequently, for 24 months;
• distribution partner applications not followed by a commercial relationship: 24 months from receipt;
• restricted area accounts: until account deletion is requested by the user or ordered by the Data Controller; the download log is kept for 24 months;
• data relating to contractual relationships: for the duration of the relationship and, subsequently, for 10 years for obligations required by law (Article 2220 of the Italian Civil Code);
• data processed for marketing purposes: until the consent is withdrawn or the data subject objects;
• Google Analytics statistical data: for a period not exceeding 14 months, according to the property retention settings.

Once these periods have elapsed, the data shall be deleted or rendered anonymous.

9. Email communications and deletion request

Communications sent by the Data Controller via e-mail and any related attachments are intended solely for the indicated recipients and are not to be considered personal communications: any replies may be read by individuals belonging to the Data Controller's organisation. To no longer receive commercial communications or newsletters, simply write at any time to info@alfakjn.com stating “cancellation” in the subject line.

10. Data subject rights

At any time, the data subject may exercise the rights provided for in Articles 15-22 of the GDPR:

• access to one's personal data;
• rectification or completion of inaccurate or incomplete data;
• erasure of data (“right to be forgotten”), where applicable;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest and processing for marketing purposes;
• withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (cookie consent can be modified via the Cookie Policy).

Requests can be sent to info@alfakjn.com or by certified email (PEC) to alfakjn@pec.it. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali)www.garanteprivacy.it).

11. Changes to this privacy policy

The Data Controller reserves the right to update this privacy policy in response to regulatory changes or modifications to the services offered by the Site. The updated version is always published on this page.

Last updated: 24 September 2026