Notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
Last updated: August 2026
This notice describes how QUALIMED S.r.l. processes personal data in connection with the conclusion and management of the General Supply Conditions (CGF), the electronic signature, the management of the DESIO point-of-sale network, any commercial and promotional communications, and the obligations relating to complaints, vigilance, safety and traceability of medical devices.
The Data Controller is QUALIMED S.r.l., Tax Code/VAT No. 11653721008, with registered office in Rome (RM), Piazza della Radio no. 37. To exercise your rights and for any question relating to the protection of personal data, you can contact Qualimed at the following addresses: certified e-mail (PEC) qualimed@legalmail.it; privacy e-mail: _________
This notice concerns, depending on the case, the owners and legal representatives of the Opticians/Resellers, their directors, employees, collaborators and contact persons, the individuals responsible for the electronic signature of the CGF and, solely for complaint, vigilance and traceability activities, the end users of the Products whose data are communicated to Qualimed:
The data may be collected directly from the data subject or from the Optician/Reseller on whose behalf the data subject acts. The technical subscription data are generated by the platform used for accession to the CGF. The end users' data relating to complaints, incidents, vigilance and traceability are normally received from the Optician/Reseller and, where required by law, may also be obtained from authorities, competent bodies or other parties involved in handling the report.
| Purpose | Data / activity | Legal basis |
|---|---|---|
| Management of the contractual relationship | Negotiations, accession to the CGF, orders, service communications, administrative, accounting and tax management, protection of rights. | Art. 6(1)(b), (c) and (f) GDPR, as concretely applicable. |
| Electronic signature and security | Identification of the signatory, authentication, OTP generation/validation, audit trail, retention of evidence and IT security. | Art. 6(1)(b), (c) and (f) GDPR. |
| Visibility of the DESIO point of sale | Publication and use of the point of sale's identification and business data within websites, social media profiles and informational/promotional materials relating to the DESIO network. | Art. 6(1)(b) and/or (f) GDPR, depending on the role of the data subject and as provided by the CGF. |
| Complaints, vigilance, safety and traceability | Handling of complaints, incidents and serious incidents, post-market surveillance, corrective actions, recalls, withdrawals, identification and traceability of the Products. | Art. 6(1)(c) and, where applicable, (f) GDPR; for health-related data, Art. 9(2)(i) and/or (f) GDPR, as concretely applicable. |
| Marketing and promotional communications | Sending of informational, commercial and promotional communications relating to DESIO products, services and initiatives, including via e-mail and newsletters, as well as, where specifically indicated, detecting the opening of communications and interaction with them, including through tracking pixels or similar technologies, in order to measure the effectiveness of campaigns and improve their content and sending methods. | Consent of the data subject pursuant to Art. 6(1)(a) GDPR and Art. 122 of Italian Legislative Decree 196/2003. |
| Protection and defence of rights | Handling of disputes, litigation, requests from authorities and retention of evidence. | Art. 6(1)(f) GDPR; Art. 9(2)(f) GDPR when special categories of data are involved. |
The provision of the data necessary for the conclusion and management of the relationship, for compliance with legal obligations and for the electronic signature is mandatory; failure to provide such data may make it impossible to conclude or manage the contractual relationship or to comply with regulatory obligations. The communication of end users' data must occur only when necessary for complaint, vigilance, safety or traceability purposes and must be limited to data that is adequate, relevant and strictly necessary.
Consent to marketing, on the other hand, is optional and its refusal or subsequent withdrawal has no consequence on the conclusion or performance of the business relationship.
The data are processed using paper-based and electronic tools by authorised personnel, in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation, integrity and confidentiality. Qualimed adopts technical and organisational measures appropriate to the risk, with particular regard to health-related data and to the evidence generated by the electronic signature systems.
The data may be communicated to or made accessible to, within the limits of their respective functions and purposes:
The data are not communicated to third parties for their own independent marketing purposes, except with specific notice and an appropriate legal basis.
Where personal data, including through service providers, are transferred to countries outside the European Economic Area, Qualimed ensures that the transfer takes place in compliance with Articles 44 et seq. GDPR, on the basis of an adequacy decision or another suitable instrument provided for by the GDPR, including, where applicable, the standard contractual clauses adopted by the European Commission and any necessary supplementary measures.
Once the applicable retention period has elapsed, the data are deleted, anonymised or otherwise rendered no longer usable, save for legal obligations.
Where the data subject has given consent, Qualimed may use the e-mail address provided to send informational, commercial and promotional communications relating to DESIO products, services and initiatives.
The communications may contain tracking pixels, tracked links or similar technologies that allow Qualimed to detect the opening of messages and interaction with them, such as, by way of example, the date and time of opening, clicks on links, IP address and technical information relating to the device or client used. This information is used to measure the effectiveness of communications and improve promotional campaigns.
The use of such tracking tools, where subject to consent, is based on the same consent given for commercial and promotional communications.
Consent may be withdrawn at any time, without prejudice to the lawfulness of the processing carried out before the withdrawal. The data subject may choose to withdraw consent to promotional communications entirely or, where technically available, object solely to the use of tracking tools while continuing to receive communications, using the link or preference management area contained in the communications received or in accordance with the other methods indicated in this notice.
In the cases provided for by the GDPR, the data subject may exercise the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as withdraw at any time any consent given. In particular, the data subject has the right to object at any time to the processing of personal data carried out for direct marketing purposes.
Requests may be sent to the contact details indicated in point 1. The data subject also has the right to lodge a complaint with the Data Protection Authority, in accordance with the procedures indicated on the Authority's website.
Within the scope of the processing described in this notice, Qualimed does not make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them. Any further automated processing or profiling activities will be subject, where necessary, to specific notice and an appropriate legal basis.
Qualimed may update this notice to bring it into line with regulatory or organisational changes or changes to the processing actually carried out. The updated version is made available through the platform used for accession to the CGF and/or on the company website.