Version 2026.10.02
The website https://gditalia.biz/, in its Italian and English versions (the Website), uses Cookies and other Trackers. This Cookie Policy describes which tools are used, for which purposes, for how long and how the User can manage their preferences. The Data Controller is GD Tecnologie Interdisciplinari Farmaceutiche S.r.l., whose contact details are given at the end of this document.
What Cookies and Trackers are
Cookies are small text files stored in the User's browser and, depending on their settings, sent to the server with subsequent requests. Other technologies, including localStorage and sessionStorage, make it possible to store or read information on the device; further tools may recognise a visit or a device even without using Cookies.
In this document the term "Trackers" covers these technologies when used for such purposes. Their use is classified according to the function they actually perform and whether consent is required.
How to manage preferences and give or withdraw consent
On first access to the Website a banner is shown allowing the User to:
- Accept all the optional Trackers described in this notice;
- Reject them by selecting "Necessary only";
- Customise their choices for each category.
Closing the banner with the "X" button keeps only technical tools active. Optional settings are disabled by default. No Tracker subject to consent is activated before the User has consented to the relevant purpose.
How long preferences are kept
Preferences are kept for 6 months in case of refusal and for 12 months in case of acceptance (even partial); when they expire the banner is shown again. The request may be shown again before these periods only in case of significant changes to the processing conditions (including the purposes or the providers involved), or when the previous choice can no longer be known (for example after the Website data has been cleared from the browser). The expiry of 6 months after a refusal allows the request to be shown again, but does not create a legal obligation to do so.
How to change or withdraw consent
The User may change or withdraw consent at any time through the "Cookie Settings" command in the footer of every page of the Website. Withdrawal stops further measurements by the tools concerned. Cookies and other data already stored on the device can also be deleted through the browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Consent record
Choices made through the banner are recorded in order to respect the User's preferences and document any consent given. The record stores:
- Date and time of the choice
- Version of the notice
- Preferences for each category
- Information about the browser used (user agent), associated with a random identifier
The record does not contain the IP address or direct identifiers. The absence of direct identifiers does not in itself mean that the data is not personal data. Records are kept for as long as needed to document the choices and, afterwards, only to the extent necessary to comply with legal obligations or protect rights within the applicable time limits. Retention criteria and legal bases are described in the Privacy Policy; access to the record is restricted to authorised persons only.
Strictly necessary Trackers
These tools are necessary for the operation of the Website or for providing services expressly requested by the User; they do not require consent for storing or accessing information on the device under Article 122(1) of Italian Legislative Decree 196/2003 (Privacy Code). They cannot be disabled through the preferences panel.
For any personal data processed for these purposes, the legal basis is the Data Controller's legitimate interest in making the requested service available and secure, under Article 6(1)(f) GDPR, within the limits described in the Privacy Policy.
- gd-cookie-consent (localStorage, first party) — Stores the preferences expressed in the banner, the date of the choice and the version of the notice, so that the banner is not shown on every visit. Intended duration: 6 months in case of refusal, 12 months in case of acceptance (even partial).
- NEXT_LOCALE (first-party technical cookie) — Stores the Website language chosen by the User (Italian or English). Duration: until the browser is closed.
- payload-token (first-party technical cookie) — Authentication cookie set only for registered Users accessing the area reserved for professionals and the administration panel. Duration: length of the authentication session.
- gd-exit-shown and gd-lead-submitted (sessionStorage, first party) — Prevent the information request window from being shown again during the same visit once it has been displayed or completed. Duration: until the browser tab is closed.
- gd-exit-dismiss (first-party technical cookie) — Remembers that the User closed the information request window, so that it is not shown again. Duration: 7 days.
Optional saving of the Skin quiz profile
- gd-skin-profile (first-party personalisation Cookie) — If the User chooses to save the result of the "Skin quiz", it stores the skin type and needs indicated in order to show results and suggestions again on later visits. Persistent saving is optional and subject to specific consent, separate from consent for statistics. Maximum duration: 90 days, unless withdrawn or deleted earlier. The User can withdraw consent through "Cookie Settings" and delete the data through the browser settings. Not authorising persistent saving does not prevent viewing the quiz result during the current visit.
Statistics Trackers
These tools allow the Data Controller to measure traffic and understand how the Website is used. They are activated only with the User's consent to the "Analytics" category: before consent, no measurement scripts are loaded and no statistical requests are sent to the providers concerned. Consent also covers the cookieless statistics tools described below. Legal references: Article 122(1) of the Privacy Code and Article 6(1)(a) GDPR.
- Google Analytics 4 (Google Ireland Limited; Google LLC) — Statistical analysis service. Data processed: pages visited, referring site, device and browser type, interactions with the pages and approximate location derived from the IP address (country, region and city); the IP address is not stored by GA4. Google Signals and advertising features are disabled. Cookies: _ga and _ga_<ID>, with a configured maximum duration of 13 months. The duration of the Cookies is separate from the retention period of the data collected by the service, described in the Privacy Policy. Processing may involve transfers to the United States.
- Vercel Web Analytics (Vercel Inc.) — Website traffic statistics service. Measurements are collected through addresses on the Website's domain and forwarded to Vercel's infrastructure. The service does not use Cookies; it distinguishes visits through a hashed identifier derived from the request, whose session is deleted after 24 hours according to the provider's documentation. Data processed: URL visited, referrer, information about browser, operating system and device, approximate geolocation and time of the event. The information is used for aggregate statistics. The 24 hours refer to the visitor's session and are not the retention period of all statistics. The service may involve processing in the United States.
- Vercel Speed Insights (Vercel Inc.) — Page performance measurement service, activated with Analytics consent. It collects loading and interaction metrics, page URL or path, and information about device, browser, operating system, connection type and country. Measurements are sent to Vercel's infrastructure through addresses on the Website's domain. The service may involve processing in the United States. Information on the retention of measurements is given in the Privacy Policy.
- Internal statistics (Data Controller) — Recording of browsing events, such as visiting a page, viewing a product or article and submitting a form. Events are stored in the Website database, hosted in the European Union, and grouped by visit through gd-session-id (sessionStorage, first party). The identifier is random and contains no direct identifiers; it nonetheless makes it possible to link events from the same visit and does not automatically make the data anonymous. It is sent with statistical events after consent. Duration of the identifier in the browser: until the tab is closed. Events are kept only for as long as needed to compile aggregate statistics and are then deleted or anonymised; aggregate statistics are kept for 12 months.
Marketing and behavioural advertising
The Website does not use remarketing or behavioural advertising tools and does not host third-party advertising banners. Any personalisation linked to saving the "Skin quiz" is described in the relevant section.
No advance consent is collected for tools or purposes not yet described in this notice. Should further marketing or profiling tools be introduced, this document will be updated and new specific consent will be requested before they are activated. Any consent to the newsletter is separate from Cookie preferences and is governed by the Privacy Policy.
External content and technical services
Links to WhatsApp and to the Data Controller's social profiles are plain links: opening them takes the User to the external service, whose data processing is governed by its own notice. The Website does not embed third-party videos, maps or social widgets. Typefaces are hosted directly on the Website's domain and do not require connections to the servers of external font providers.
- Sentry (Functional Software, Inc.) — Application error and technical performance monitoring service, described in the Privacy Policy. It may process information about the error, page URL, browser and device data and IP address within the limits of the configuration adopted. The data is used for the operation and security of the Website, on the basis of the Data Controller's legitimate interest under Article 6(1)(f) GDPR; the service must not be used for profiling or session recording within this technical purpose. Retention: 90 days. Place of processing: United States.
How to control or delete Cookies and similar technologies through the device
In addition to the Website's preferences panel, the User can use the browser settings to view, block or delete Cookies and site data, including localStorage and sessionStorage.
Deleting the Website data may result in losing preferences and being logged out of restricted areas. Browser settings do not replace the purpose-based consent management available on the Website. Official instructions are available for the main browsers (Google Chrome, Mozilla Firefox, Apple Safari).
Consequences of refusing the use of Trackers
- General functionality: Refusing optional tools does not prevent browsing the Website or accessing its content.
- Analytics category: Refusing the Analytics category prevents statistical measurements by the tools subject to that consent; processing strictly necessary for operation and security remains permitted.
- Skin quiz: Refusing to save the Skin quiz profile only prevents its results from being kept for later visits.
Transfers of data to third countries
Google Analytics, Vercel and Sentry may involve transfers of personal data to the United States or other countries outside the European Economic Area.
- Adequacy decisions: For transfers covered by an adequacy decision of the European Commission, Article 45 GDPR applies; for the United States, reliance on the EU-U.S. Data Privacy Framework is limited to recipients with valid certification and to processing covered by the decision.
- Appropriate safeguards: In other cases the safeguards under Article 46 GDPR apply, including the Standard Contractual Clauses adopted by Decision (EU) 2021/914, supplemented by additional measures where necessary.
Information on the safeguards actually applied to each provider and a copy of the relevant clauses can be requested from the Data Controller at web@gditalia.biz.
Data Controller
GD Tecnologie Interdisciplinari Farmaceutiche S.r.l.
Via Augusto Gaudenzi 29, 00163 Rome (RM), Italy
VAT no. 01356041002 — Tax code 05098680589
Email: web@gditalia.biz — Phone: +39 06.66418170
For information on the providers' services, the privacy notices of Google and Vercel and Sentry's privacy documentation are available. These references supplement the information provided by the Data Controller and do not replace its information and control obligations.
The Website's Privacy Policy, available at https://gditalia.biz/privacy, describes further processing, recipients, legal bases, retention periods and the User's rights. Requests for access, rectification, erasure, restriction, portability and objection, where applicable, can be sent to web@gditalia.biz. The right to withdraw consent and to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) remains unaffected.