In this privacy policy, CFS Prodotti Medicali S.r.l. describes how it processes personal data collected through the navigation and use of the website www.cfs.it.
Data processing is carried out in compliance with current national and European privacy regulations and the principles of lawfulness, fairness, transparency, data minimization, confidentiality, and protection of the rights of the data subjects.

DATA CONTROLLER

The Data Controller is CFS Prodotti Medicali S.r.l., in the person of its legal representative pro tempore, with registered office in Via G.B. Guarini, 58 - 57121 Livorno (LI), VAT no. 01883060491.
For requests regarding the processing of personal data, you may write to the e-mail address privacy@cfs.it.

TYPES OF DATA COLLECTED

Through the site, the following may be collected:

• navigation data, such as IP address, technical browser data, time of request, resources consulted, and other parameters related to the user's operating system and IT environment, used to enable site functionality, obtain statistical information, and ensure system security;

• data provided for registration and account creation, such as first name, last name, customer type, tax code, PEC, telephone number, e-mail, and residential or business address;

• data provided via e-mail addresses, contact forms, chat, or other communication channels, including any data spontaneously entered in communications or attachments;

• data provided for newsletter subscription, such as first name, last name, and e-mail address;

• data related to purchases made through e-commerce, such as billing, payment, shipping, order, and delivery data;

• data transmitted for reviews, technical support, complaints, tickets, returns, refunds, replacements, or withdrawal requests;

• data provided through the form dedicated to exercising the right of withdrawal and/or managing returns, such as first name, last name, e-mail, order number, items being returned, confirmation of having read the privacy policy, and any further information provided by the user;

• any special categories of personal data pursuant to Art. 9 of the GDPR, such as health-related data, if provided spontaneously or necessary to benefit from tax relief or other benefits provided by law.
  

The user is invited not to provide data that is irrelevant, excessive, or belonging to special categories, unless necessary for the specific request.
In the context of B2B relationships, the personal data processed may refer to owners, partners, directors, company contacts, employees, and collaborators of the client company or firm.

PURPOSE OF PROCESSING AND LEGAL BASIS

Personal data is processed to:

• enable account creation and management and the use of related services. The legal basis is the performance of a contract or pre-contractual measures, pursuant to Art. 6, par. 1, lett. b), of the GDPR;

• respond to requests made via forms, e-mail, chat, or other contact channels. The legal basis is the performance of pre-contractual or contractual measures, or the legitimate interest of the Data Controller to respond to received requests, pursuant to Art. 6, par. 1, lett. b) and f), of the GDPR;

• manage orders, payments, billing, shipping, delivery, after-sales support, and service communications. The legal basis is the performance of a contract and compliance with legal obligations, pursuant to Art. 6, par. 1, lett. b) and c), of the GDPR;

• manage requests for withdrawal, returns, replacement, or refunds, including online forms, sending automated confirmation e-mails, opening and managing tickets, subsequent communications, and logistical, administrative, and accounting tasks. The legal basis is the performance of a contract, compliance with legal obligations and, where necessary, the legitimate interest in managing disputes and protecting rights, pursuant to Art. 6, par. 1, lett. b), c) and f), of the GDPR;

• manage tickets, complaints, and support requests. The legal basis is the performance of a contract or the legitimate interest of the Data Controller in the correct management of requests, pursuant to Art. 6, par. 1, lett. b) and f), of the GDPR;

• send communications about products or services similar to those already purchased, within the limits of so-called "soft spam" and unless the data subject objects;

• send newsletters and promotional communications, subject to the consent of the data subject. The legal basis is consent, pursuant to Art. 6, par. 1, lett. a), of the GDPR;

• gauge satisfaction, carry out statistics, and conduct aggregate analysis to improve products, services, and the site. The legal basis is the legitimate interest of the Data Controller or, where required, the consent of the data subject;

• enable the application of tax relief or other benefits. The legal basis is the performance of a contract and/or compliance with legal obligations; for any special categories of data, processing may be based on the explicit consent of the data subject or another condition applicable under Art. 9 of the GDPR.

NATURE OF DATA PROVISION

The provision of data indicated as mandatory is necessary to provide the requested services and manage purchases, orders, support requests, complaints, returns, refunds, replacements, and withdrawals.
With reference to the withdrawal/return form, the mandatory data is necessary to identify the request, associate it with the order, send the automated confirmation, open and manage the ticket, and carry out related duties.
Failure to provide mandatory data makes it impossible to fulfill the request or provide the service. The provision of additional data is optional.
The provision of data for newsletters or promotional communications based on consent is always optional.

METHODS AND PLACE OF PROCESSING

Data is processed for the indicated purposes, mainly using electronic, computerized, and telematic tools and, where necessary, manually as well.
Processing is carried out at the Data Controller’s premises and/or by external parties providing services on behalf of the Data Controller.
Data is processed by authorized and trained personnel, as well as, where necessary, by external parties appointed as data processors pursuant to Art. 28 of the GDPR.
For the management of support, complaints, withdrawals, returns, replacements, or refunds, data may also be processed via e-commerce platforms, ticketing systems, automated e-mail sending systems, and other technical tools.
The Data Controller adopts technical and organizational measures appropriate to protect data from unauthorized access, loss, destruction, modification, or unauthorized processing.

RETENTION PERIOD

Data is kept for the time strictly necessary to achieve the purposes for which it was collected.
Data related to the performance of the contract is kept for the duration of the relationship and, subsequently, for the period provided by civil, tax, accounting, and administrative obligations.
Data related to requests for information, support, complaints, withdrawals, returns, replacements, or refunds, including requests managed via forms, automated e-mails, and tickets, is kept for the time necessary to manage the request and, subsequently, for the period necessary to protect the rights of the Data Controller or fulfill legal obligations.
Data processed for newsletters is kept until consent is withdrawn or an unsubscription request is made.
Data processed for soft spam is kept until the data subject objects.

RECIPIENTS AND DISCLOSURE OF DATA

Personal data is not disseminated.
Data may be disclosed to professionals, suppliers, collaborators, and third-party companies that perform technical, IT, organizational, logistical, administrative, accounting, tax, payment, shipping, customer service, and technical support services on behalf of the Data Controller.
With reference to withdrawals, returns, replacements, and refunds, the data may be processed by personnel in charge of customer care, administration, logistics, warehouse, and after-sales support, as well as by technical suppliers of the platform, the automated e-mail system, and the ticketing system.
External parties that process personal data on behalf of the Data Controller are appointed, where necessary, as data processors pursuant to Art. 28 of the GDPR.
The updated list of processors is available from the Data Controller.
Data may also be disclosed to parties, bodies, or authorities where required by law, by court orders, or to protect the rights of the Data Controller.

DATA TRANSFER

Personal data is, as a rule, processed within the European Economic Area.
Should it be necessary to transfer data to countries outside the EU, the transfer will take place in compliance with Art. 44 et seq. of the GDPR, based on an adequacy decision, Standard Contractual Clauses, or other guarantees provided by applicable law.

USER RIGHTS

The data subject may exercise the rights under Art. 15 et seq. of the GDPR and, in particular, may request access to data, rectification, erasure, restriction of processing, data portability, where applicable, and may object to processing in the cases provided for by law.
The data subject may also withdraw consent previously given, object to receiving promotional communications, and lodge a complaint with the Data Protection Authority or take legal action.
Rights may be exercised by contacting the Data Controller at the mailing address indicated in this policy or by writing to privacy@cfs.it.

COOKIES

The site uses cookies and other tracking tools to enable the proper functioning of the site, improve the browsing experience, and, where provided and subject to consent, carry out analysis or marketing activities.
Users can manage cookie preferences via the banner or management panel provided on the site and through browser settings.
For more information on the use of cookies and other tracking tools, please refer to the site’s cookie policy.

CHANGES TO THE PRIVACY POLICY

CFS Prodotti Medicali S.r.l. reserves the right to modify or update this Privacy Policy at any time.
We therefore recommend checking this page frequently.

Last updated on 18/06/2026