Privacy Policy

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Website www.zuccatohc.it

ZUCCATO HC S.r.l., with registered office at Via della Consortia No. 2 – 37127 Verona (VR), Tax Code and VAT No. 01725500233 (hereinafter “ZUCCATO HC” or the “Controller”), recognises the importance of protecting personal data and considers their protection one of the principal objectives of its business activities.

This Privacy Policy relates to www.zuccatohc.it (hereinafter the “Website”), the corporate website of ZUCCATO HC S.r.l., which presents the Company, its products and services, its activities in the medical sector, clinical information and any platforms and restricted areas intended for customers and authorised users.

Before providing any personal data, ZUCCATO HC asks users to read this information notice carefully (also referred to as the “Privacy Policy”), as it contains important information on personal data protection and the security measures adopted to safeguard confidentiality, in full compliance with Regulation (EU) 2016/679 (hereinafter “GDPR” or “Applicable Law”), Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (the “Italian Privacy Code”), and the measures issued by the Italian Data Protection Authority.

This Privacy Policy applies exclusively to the Website and not to other websites that users may access through external links; those websites are governed by their own privacy policies.

It is provided pursuant to Article 13 GDPR to all individuals who access and interact with the Website.

ZUCCATO HC has also chosen to comply with Recommendation No. 2/2001 concerning the minimum requirements for collecting personal data online in the European Union, adopted by the Article 29 Working Party on 17 May 2001, and with the European Data Protection Board (EDPB) guidelines on consent, transparency and cookies.

ZUCCATO HC informs users that personal data processing is based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation, accuracy, integrity and confidentiality, in accordance with Applicable Law.

1. Data Controller and Data Protection Officer (DPO)

The Data Controller of personal data collected through the Website is:

ZUCCATO HC S.r.l., with registered office at Via della Consortia No. 2 – 37127 Verona (VR), Italy – Tax Code and VAT No. 01725500233 – email: privacy@zuccatohc.it – certified email (PEC): pec@pec.zuccatohc.it.

The Controller may be contacted at any time to obtain information concerning personal data processing, exercise the rights granted by Applicable Law or report any issues.

The Controller has appointed a Data Protection Officer (DPO), namely Avv. Enrico Sinigaglia, who may be contacted at the dedicated email address dpo@zuccatohc.it.

Any request or report concerning personal data processing may be addressed to the DPO, including requests to exercise the rights set out in Articles 15–22 GDPR.

2. Categories of personal data processed

“Personal Data” means any information relating to an identified or identifiable natural person, including identifiers such as a name, an identification number, location data, an online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

ZUCCATO HC may collect the following categories of personal data through the Website.

2.1. Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain information whose transmission is inherent in the use of Internet communication protocols.

This information is not collected for the purpose of associating it with identified data subjects. Nevertheless, by its nature, it could enable users to be identified through processing and matching with data held by third parties.

This category includes the IP addresses or domain names of devices used to connect to the Website, URI/URL addresses of requested resources, the time of requests, the method used to submit requests to the server, the size of files returned, numerical server response status codes and other parameters relating to the user’s operating system and IT environment.

These data are used solely to obtain anonymous statistics about Website use, check its proper operation, ensure system security and establish responsibility in the event of computer-related offences committed against the Website or third parties.

Browsing data are retained only for as long as strictly necessary for the purposes described above and, as a rule, for no longer than seven days, without prejudice to any requirement for criminal investigations by judicial authorities.

2.2. Data provided voluntarily by users

Through the Website, users may voluntarily provide personal data including, for example, first and last name, professional qualification, organisation or institution, email address, telephone number and any other information contained in communications sent through contact forms or to the email addresses published on the Website.

ZUCCATO HC will process these data in compliance with Applicable Law, on the understanding that they concern the user or third parties who have expressly authorised the user to provide them on an appropriate legal basis.

In such cases, the user acts as an independent data controller of the third parties’ data, assumes all statutory obligations and responsibilities, and hereby undertakes to indemnify ZUCCATO HC against any dispute, claim or request for compensation brought by third parties whose personal data have been processed through the Website in breach of Applicable Law.

Users are expressly requested not to communicate special categories of personal data under Article 9 GDPR, particularly health-related data or data identifying patients, through the Website or contact channels, except where strictly necessary for the medical device vigilance purposes described in section 2.5 below.

If such data are submitted, the sending user remains responsible for the lawfulness of the disclosure, including identifying any applicable legal bases and fulfilling information obligations towards the data subject.

2.3. Data concerning restricted areas and online services

The Website may provide access to services and platforms reserved for customers or authorised users, including Zuccato HC On Web, a platform for managing and monitoring orders, rentals, movements, documentation, maintenance, and checks on the products and services supplied.

Such services may involve processing the following information:

• users’ identification details;
• professional qualifications and the organisation to which they belong;
• login credentials and account information;
• access data and technical logs;
• information on requests, orders or services managed through the platform;
• any other data necessary for the proper provision of the service.

The data are processed solely to enable access to the requested services, protect platform security and perform existing contractual relationships with the customer or the user’s organisation.

2.4. Data collected through cookies and similar technologies

The Website uses cookies and similar technologies.

Further details of the types of cookies used, their purposes, retention periods and the ways to give, modify or withdraw consent are provided in the dedicated Cookie Policy, to which this Privacy Policy refers in full and which forms an integral part of it.

2.5. Medical device vigilance data

Because of ZUCCATO HC’s activities in the medical device sector, the Controller may receive, including through the Website or the contact addresses published on it, reports of incidents, serious incidents, complaints or field safety corrective actions under Regulation (EU) 2017/745 (MDR) from healthcare professionals, healthcare facilities or other economic operators.

Such reports may involve processing the reporter’s personal data, such as name, qualification, contact details and organisation, and in some cases health-related data concerning patients involved in the incident.

Such processing is carried out to fulfil legal obligations under the MDR and relevant national legislation, including Italian Legislative Decree No. 137 of 5 August 2022 and, where applicable, Legislative Decree No. 46 of 24 February 1997.

The legal basis is found in Article 6(1)(c) GDPR and, where health-related data are concerned, Article 9(2)(i) GDPR.

Data collected in the context of vigilance activities may be disclosed, in fulfilment of legal obligations, to the competent authorities, including the Ministry of Health, national health authorities and EUDAMED, and to the manufacturer of the device concerned, to the extent strictly necessary.

3. Purposes, legal bases and retention periods

Personal data collected through the Website will be processed by ZUCCATO HC for the following purposes, on the corresponding legal bases:

a) responding to contact, information, support, quotation or assistance requests submitted by users through the Website, by telephone or by email;

b) performing a contract to which the user or their organisation is a party or taking pre-contractual measures at the data subject’s request;

c) providing access to restricted areas and digital platforms made available by ZUCCATO HC;

for the purposes under a), b) and c), the legal basis is Article 6(1)(b) GDPR.

Data will be retained until the request has been answered and, if a contractual relationship is established or continues, for no longer than ten years after the relationship ends, unless longer statutory retention periods apply.

d) carrying out research and statistical analyses based on aggregated or anonymous data to assess Website operation, traffic, usability and users’ interests;

where carried out exclusively using anonymous data, this activity does not constitute the processing of personal data;

e) ensuring the security of the Website, restricted areas and IT systems, and preventing misuse, fraud, unauthorised access and cyber incidents;

f) establishing, exercising or defending rights in judicial, administrative or out-of-court proceedings;

for the purposes under e) and f), the legal basis is the Controller’s legitimate interests under Article 6(1)(f) GDPR.

The corresponding data will be retained for the period necessary to pursue the purpose and, except where further needs arise, for no longer than ten years after the last interaction, without prejudice to any longer period necessary to resolve disputes.

g) complying with legal obligations imposed on ZUCCATO HC, including tax, accounting, administrative, corporate, medical device, vigilance and anti-money-laundering obligations;

for this purpose, the legal basis is Article 6(1)(c) GDPR.

Data will be retained for the periods laid down by the relevant legislation, generally ten years, or longer where provided for by the applicable medical device regulations.

h) managing medical device incident reports, complaints and field safety corrective actions;

for this purpose, the legal basis is Article 6(1)(c) GDPR and, where health-related data are processed, Article 9(2)(i) GDPR;

i) installing cookies and similar technologies other than strictly necessary cookies, such as non-anonymised analytics, profiling or third-party cookies, where the user has given consent through the relevant banner;

for this purpose, the legal basis is the data subject’s consent under Article 6(1)(a) GDPR and Article 122 of Italian Legislative Decree No. 196/2003.

Consent may be withdrawn at any time using the methods specified in the Cookie Policy.

Summary table

Purpose	Legal basis	Nature of data provision	Retention period
Responding to requests for contact, information, quotations or assistance	Article 6(1)(b) GDPR	Optional; failure to provide the data prevents a response	Until the response is provided; if the relationship continues, up to ten years
Management of contractual and pre-contractual relationships	Article 6(1)(b) GDPR	Necessary for performance of the relationship	Up to ten years after the relationship ends
Access to restricted areas and online services	Article 6(1)(b) GDPR	Necessary to use the service	Duration of the relationship and subsequent applicable retention periods
Compliance with legal obligations	Article 6(1)(c) GDPR	Mandatory where required by law	Periods specified in the relevant legislation
Medical device vigilance	Article 6(1)(c) GDPR; Article 9(2)(i) where applicable	Mandatory for reporting purposes	Periods specified by applicable legislation
Website and system security	Article 6(1)(f) GDPR	Necessary for secure use of services	Security logs: generally no longer than 12 months; other data as necessary
Defence of the Controller’s rights	Article 6(1)(f) GDPR	Necessary in the event of disputes	Duration of the dispute and applicable limitation periods
Anonymous statistical analyses	Does not constitute personal data processing	—	—
Non-essential cookies and technologies	Article 6(1)(a) GDPR	Optional and withdrawable	Period indicated in the Cookie Policy

Providing personal data is optional unless necessary to comply with legal or contractual obligations.

Failure to provide necessary data may prevent ZUCCATO HC from answering the user’s requests, providing a service or fulfilling obligations arising from the relevant relationship.

4. Processing methods and security measures

Personal data are processed using manual, IT and electronic means, in ways strictly related to the stated purposes and, in all cases, designed to ensure data security and confidentiality in accordance with Articles 5 and 32 GDPR.

ZUCCATO HC adopts appropriate technical and organisational measures, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the risks to the rights and freedoms of data subjects.

These measures may include, for example, encryption of data in transit, authentication and access-control systems, individual credentials, backups, disaster recovery, segregation of environments, training of authorised personnel, access logging and procedures for managing security incidents and data breaches.

The Company presents Zuccato HC On Web as a platform for managing in real time processes and information relating to the services provided to its customers.

Data are processed exclusively by authorised personnel duly instructed under Article 29 GDPR and Article 2-quaterdecies of the Italian Privacy Code, and by external parties who may be appointed as processors under Article 28 GDPR.

ZUCCATO HC declares that it does not carry out solely automated decision-making through the Website, including profiling, that produces legal effects concerning data subjects or similarly significantly affects them within the meaning of Article 22 GDPR.

5. Recipients of personal data

Within the limits strictly necessary for the purposes set out above, personal data may be disclosed to the following categories of recipients:

• providers of hosting, cloud services, email, IT maintenance, software, platforms and technological infrastructure;
• providers of technical, logistical and organisational services necessary for ZUCCATO HC’s activities;
• consultants, accountants, lawyers, auditors, privacy advisers and other professionals;
• manufacturers, suppliers, industrial partners and other economic operators in the distribution chain, to the extent necessary to fulfil contractual or legal obligations;
• persons authorised to process personal data under the direct authority of the Controller;
• public authorities, healthcare authorities, the Ministry of Health, judicial authorities, the Italian Data Protection Authority, notified bodies and other competent authorities where required by law.

Personal data will not be publicly disclosed, except where expressly provided by law.

An updated list of data processors may be requested from the Controller at privacy@zuccatohc.it or from the DPO at dpo@zuccatohc.it.

6. Transfers of personal data outside the European Economic Area

Some personal data may be transferred to recipients located outside the European Economic Area (EEA), particularly through the use of cloud, software, email or technical services provided by international operators.

In such cases, ZUCCATO HC ensures that transfers comply with Articles 44 et seq. GDPR and are based, as applicable, on:

• an adequacy decision of the European Commission;
• Standard Contractual Clauses (SCCs);
• Binding Corporate Rules (BCRs);
• the EU–U.S. Data Privacy Framework, where applicable;
• other safeguards or derogations under Articles 46–49 GDPR.

Where necessary, ZUCCATO HC adopts supplementary technical, organisational or contractual measures to provide a level of protection essentially equivalent to that guaranteed in the European Union.

Data subjects may request information on the applicable safeguards by writing to privacy@zuccatohc.it or dpo@zuccatohc.it.

7. Rights of data subjects

Under Articles 15–22 GDPR, data subjects have the right to:

• access their personal data and obtain a copy;
• request rectification of inaccurate data and completion of incomplete data;
• request erasure of data in the circumstances set out in Article 17 GDPR;
• obtain restriction of processing;
• receive their data in a structured, commonly used and machine-readable format in the circumstances set out in Article 20 GDPR;
• object to processing based on the Controller’s legitimate interests;
• not be subject to decisions based solely on automated processing in the circumstances set out in Article 22 GDPR;
• withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Requests may be submitted free of charge to the Controller at privacy@zuccatohc.it or to the Data Protection Officer at dpo@zuccatohc.it.

ZUCCATO HC will respond without undue delay and in any event within one month of receiving the request, unless an extension is permitted under Article 12 GDPR.

Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority, Piazza Venezia No. 11 – 00187 Rome – www.garanteprivacy.it, and to bring proceedings before the competent judicial authority.

8. Content reserved for healthcare professionals

Some sections of the Website containing technical information about medical devices are intended exclusively for healthcare professionals and professionally qualified persons.

The Website currently informs users expressly of this restriction and requires anyone wishing to continue browsing to declare, under their own responsibility, that they have the necessary qualifications.

Any declaration, selection or interaction used to grant access to this content may be processed solely to manage access to the relevant sections, demonstrate compliance with applicable obligations and ensure that the content is consulted appropriately.

9. Changes to this Privacy Policy

ZUCCATO HC reserves the right to amend this Privacy Policy at any time, publishing notice of changes on the Website.

Users are therefore encouraged to consult this page periodically and refer to the last updated date shown below.

Any material changes significantly affecting ongoing processing activities will be communicated to data subjects by appropriate means.

10. Contact details

For any questions, information requests or exercise of rights under Articles 15–22 GDPR, please contact:

Data Controller:
ZUCCATO HC S.r.l.
Via della Consortia No. 2 – 37127 Verona (VR)
Tax Code and VAT No. 01725500233
Email: privacy@zuccatohc.it
Certified email (PEC): pec@pec.zuccatohc.it

Data Protection Officer (DPO):
Avv. Enrico Sinigaglia
Email: dpo@zuccatohc.it

Medical device vigilance reports:
vigilanza@zuccatohc.it

Last updated: May 2026