Privacy Policy - Information notice on the processing of personal data

This notice explains how Nekua processes your personal data. Here you will find information on what data we use and why, who we share it with, how long we keep it and how you can exercise your rights.

Last updated: 8 October 2026

Summary

Who processes your data
What data we process
Why we process your data and on what basis
The Nekua AI virtual assistant
Commercial communications
Mandatory and optional data
To whom we disclose the data
Transfers outside the European Economic Area
How long we retain the data
Cookies
Your rights
Changes

1. Who processes your data

The controller is Nekua s.r.l., with registered office at Via Sant’Andrea 19, 20121 Milan (MI), VAT No. and Tax Code 04098410162 (hereinafter “Nekua” or “Us” or the “Company”).

Nekua has designated a Data Protection Officer (DPO), who can be contacted for any matter relating to the processing of your personal data and to the exercise of your rights at the address dpo@nekua.com. For requests concerning data protection the Company also makes available the address privacy@nekua.com.

2. What data we process

We process the data you provide to us and the data you generate by using the website and our services. The categories of data are indicated, together with the relevant purposes and legal bases, in the following paragraph. Our chatbot Nekua AI is not designed to collect or process information about your health and we ask you not to enter it.

3. Why we process your data and on what basis

Purpose	Legal basis
Sale and delivery of products: management of orders, payments, shipments, returns, withdrawal, legal guarantee of conformity — Data processed: identification and contact data; order and subscription data; payment data.	Performance of the contract (Art. 6(1)(b) GDPR)
Account, wishlist and subscriptions: registration, access to the account area, management of recurring orders — Data processed: account data; order and subscription data.	Performance of the contract (Art. 6(1)(b) GDPR)
Customer care and pre-sale support: response to requests and assistance on orders sent via contact form, email, WhatsApp or the Nekua AI virtual assistant — Data processed: identification and contact data; content of communications; order data.	Steps taken at your request prior to entering into a contract or performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in managing the communications received (Art. 6(1)(f) GDPR)
Sending of surveys and satisfaction questionnaires on products and services — Data processed: contact data (email); order data.	Legitimate interest in measuring and improving the quality of products and services (Art. 6(1)(f) GDPR)
Newsletter: sending of the newsletter, via email — Data processed: contact data (email).	Consent (Art. 6(1)(a) GDPR)
Promotional communications on Nekua products and services, via email and WhatsApp — Data processed: contact data (email, WhatsApp number).	Consent (Art. 6(1)(a) GDPR)
Emails to customers about products similar to those purchased (“soft spam”) — Data processed: contact data (email); order data.	Legitimate interest, unless you object (Art. 130, para. 4, Legislative Decree 196/2003)
Profiling-based marketing: analysis of purchases and of your preferences to propose personalised offers and communications to you — Data processed: order data and purchase preferences; account data.	Consent (Art. 6(1)(a) GDPR)
Product safety: recalls, withdrawals, management of reports of adverse effects — Data processed: identification data and order data; information on any adverse effect reported.	Legal obligation (Art. 6(1)(c) GDPR; Reg. (EC) 178/2002); for data concerning health, Art. 9(2)(i) GDPR
Accounting and tax obligations — Data processed: identification data, order and payment data.	Legal obligation (Art. 6(1)(c) GDPR)
Website security and prevention of fraud, spam and abuse — Data processed: browsing and device data.	Legitimate interest in the necessary protection of the website and its users (Art. 6(1)(f) GDPR)
This is without prejudice to the possibility for Nekua to process your personal data necessary to comply with a legal obligation to which the Company is subject and/or to adequately protect its rights in judicial or extrajudicial proceedings and/or to follow up on any requests made by the competent authorities.

4. The Nekua AI virtual assistant

Nekua AI is an artificial intelligence system that provides you with information on Nekua products, suggestions based on the needs you describe and assistance on orders. When you use it you interact with an automated system, not with a person.

The suggestions of Nekua AI are of an informative nature regarding the products. They do not constitute medical advice and do not replace the advice of a doctor or pharmacist. Since Nekua AI is not intended to provide health-related information, we ask you not to enter data concerning your health in the conversations. Always consult your doctor during pregnancy, while breastfeeding, in the presence of medical conditions or if you are taking medicines. Food supplements should not be understood as substitutes for a varied and balanced diet and a healthy lifestyle.

The use of Nekua AI is optional: you can purchase all our products without using it.

Nekua AI does not take decisions which produce legal effects concerning you or which similarly significantly affect you.

For further information on Nekua AI, consult the Website Terms of Use.

5. Commercial communications

We send you the newsletter and promotional communications via email only if you have given the relevant consent by ticking the appropriate box. The personalised offers based on your purchases and your preferences require a separate and optional consent.

You can unsubscribe or withdraw your consent at any time via the link present in every email, by writing to us or by using the appropriate form. The withdrawal does not affect the lawfulness of the processing carried out before it.

If you have purchased a product, we may send communications about similar products to the email address provided, unless you object at the time of purchase or at any later time via the appropriate unsubscribe link at the bottom of our communications.

6. Mandatory and optional data

The data marked as mandatory in the purchase, registration and contact forms are necessary to conclude the contract or to reply to you, without this information we cannot process the order or the request. All other data are optional, and refusing the processing based on consent has no consequence on the possibility of purchasing our products and using the website.

7. To whom we disclose the data

The data are processed by Nekua’s authorised personnel and disclosed to the following parties, to the extent necessary.

Categories of recipients	Service
Providers of e-commerce platform, hosting and integrated payment services	Management of the online store, hosting and payment wallets
Providers of the virtual assistant service and of the related artificial intelligence models	Operation of the Nekua AI assistant and of the connected messaging channel
Providers of email marketing and subscription management services	Sending of newsletters and communications and management of subscriptions
Providers of traffic analysis and measurement services	Statistics and measurement of website performance
Providers of security and abuse prevention services	Protection against spam, bots and fraud
Providers of content delivery network (CDN) and consent management services	Delivery of the website and collection and management of consents
Payment service providers	Execution and security of payments
Couriers and logistics operators	Delivery of orders
Tax and legal advisors; competent authorities	Compliance with legal obligations, protection of rights

The updated list of processors is available on request. The identity of the individual recipients is disclosed at your request.

8. Transfers outside the European Economic Area

Some recipients of your data may be established or have servers in countries located outside the European Economic Area. In such case the transfer takes place exclusively where one of the conditions laid down in Chapter V of the GDPR is met: an adequacy decision of the European Commission relating to the country of destination (Art. 45 GDPR); in the absence of adequacy, appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses approved by the European Commission or binding corporate rules (Art. 47 GDPR); as a last resort, one of the derogations provided for by Art. 49 GDPR for specific situations. In any case the transfer is carried out in compliance with the GDPR, with the adoption of measures suitable to ensure for your data a level of protection essentially equivalent to that guaranteed within the European Union. You can obtain information on the safeguards adopted and a copy of the standard contractual clauses by writing to the Company at the contact details indicated above.

9. How long we retain the data

Data	Retention period
Orders, invoices and accounting documentation	10 years (Art. 2220 Italian Civil Code)
Circumstances relating to an order (changes, complaints, returns, disputes)	10 years from the completion of the order, as commercial correspondence (Arts. 2214 and 2220 Italian Civil Code)
Requests for information not connected to an order	The time necessary to handle the request and, subsequently, for the period strictly necessary to document the response provided
Responses to surveys and satisfaction questionnaires	For the time necessary for the analysis, mainly in aggregate form, after which the data are erased or anonymised
Account, wishlist and subscriptions	Until the account is closed, without prejudice to accounting obligations
Conversations with Nekua AI	For the time necessary to provide the service and, subsequently, for a limited period defined in accordance with the principle of data minimisation, after which the conversations are erased
Newsletter and promotional communications	Until consent is withdrawn or an objection is raised and, in the absence of interaction with our communications, for the period necessary to keep the contact list up to date, after which the data are erased
Data for personalised offers	Until consent is withdrawn and, in any case, for the period in which the purchasing profile remains current, in accordance with the principle of data minimisation
Cookies and tracking tools	See the Cookie Policy

In the event of a complaint or litigation, the relevant data may be retained for the time necessary to protect rights. At the end of the periods indicated the data are erased or rendered anonymous.

The website uses technical cookies and, with your consent, measurement and profiling cookies. The details and how to change your choices are in the Cookie Policy.

11. Your rights

At any time you can exercise the rights granted by the GDPR and, in detail:

access your data and receive a copy of it;
request their rectification or erasure;
request the restriction of processing;
receive the data in a structured format and transmit them to another controller;
object to processing based on legitimate interest on grounds relating to your particular situation and, always and without giving reasons, to direct marketing;
withdraw your consent with the same ease with which you gave it, without affecting the lawfulness of the previous processing.

To exercise your rights you can use the Privacy form (DSAR) available in the website footer or write to privacy@nekua.com or to the Data Protection Officer at dpo@nekua.com.

If you believe that the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or bring proceedings before the competent courts.

12. Changes

We may update this information notice. The date of the last update is indicated at the beginning.

Cart [0]