Privacy Policy
Last reviewed: 25 July 2026
1. Controller and Data Protection Officer
Controller: Hartington Pharmaceutical S.L.U., Company Tax Code B63437735, registered in the Company Register of Barcelona, Volume 36349, Folio 196, Page B-285983.
Address: Avda. Ernest Lluch 32, Tecnocampus Mataró – Torre TCM3, Floor 6, Door 3, 08302 Mataró, Barcelona, Spain.
Data Protection Officer: Antonio Tradacete Casas, antonio@hartington.org.
2. Data, purposes and legal bases
| Activity | Data used | Purpose | Legal basis |
|---|---|---|---|
| Orders and customer accounts | Name, contact details, billing and delivery address, account credentials, order contents, price, payment status and transaction reference | Create and administer the account and order, provide order communications and support | Performance of the contract or steps requested before entering into it |
| Payment | Order amount, currency, transaction reference and the information required by the selected payment provider | Authorise, evidence, refund and reconcile payment | Performance of the contract and compliance with accounting and tax obligations |
| Delivery | Recipient, delivery address, telephone, order contents, delivery method and tracking information | Arrange and evidence delivery and handle loss, delay or damage | Performance of the contract |
| Returns, complaints and enquiries | Email, optional name, order number, request type and message | Respond to the request, administer statutory rights and establish, exercise or defend legal claims | Performance of the contract, legal obligations and legitimate interests in resolving requests and claims |
| Invoices and legal compliance | Order, billing, invoice and transaction records | Accounting, tax, regulatory and lawful-authority requirements | Compliance with legal obligations |
| Security and abuse prevention | Internet Protocol address, user agent, request and login data, timestamps, security events and form-risk signals | Protect accounts, payments, forms, infrastructure and the website against fraud, spam and abuse | Legitimate interests in maintaining a secure service and, where applicable, legal obligations |
| Newsletter | Email address and consent status | Send the optional newsletter and maintain unsubscribe choices | Consent |
| Analytics and advertising measurement | Consent state, online identifiers, device/browser data, page and event data, ad attribution, order identifier, value and currency | Measure aggregate website use and completed-purchase campaign performance | Consent for non-essential analytics and advertising technologies |
Hartington does not use the website data described above to make decisions based solely on automated processing that produce legal or similarly significant effects. Google ad personalization is disabled. Advertiser-curated health audiences, customer lists and remarketing are not part of the approved advertising use.
3. Health information
The current order, return and general-contact forms do not request symptoms, diagnoses, treatment outcomes, side effects or other health information and instruct users not to submit it. The former specialist-consultation service is discontinued. If health information is nevertheless submitted, Hartington will restrict access and assess whether a valid Article 9 General Data Protection Regulation condition exists; otherwise it will be deleted, subject to any specific legal obligation or legal-claims requirement.
4. Recipients
Data is not sold. Depending on the selected transaction and consent choices, recipients may include:
- Google Cloud for website hosting and Google reCAPTCHA for form security and spam prevention;
- Redsys / 3D Secure or PayPal for the selected payment method;
- MRW and other delivery providers offered for the destination;
- Google Analytics, Google Tag Manager and Google Ads after the applicable consent;
- Mailchimp for the optional newsletter and synchronisation of existing Mailchimp contacts;
- email, information-technology, accounting and professional advisers used to operate the service or handle legal obligations and claims; and
- public authorities where disclosure is required by law.
Microsoft Clarity and Mailchimp connected-site browser tracking were disabled on 25 July 2026. Previously consented data may remain only for the applicable provider retention period.
5. International transfers
The production website is hosted in the European Union. Some providers or their subprocessors may process data outside the European Economic Area. Transfers must be covered by an applicable European Commission adequacy decision or safeguards under Chapter V of the General Data Protection Regulation, such as the European Commission’s Standard Contractual Clauses.
As of this review date, the European Commission recognises United States commercial organisations participating in the EU–US Data Privacy Framework as providing adequate protection. Google states that Google LLC and its covered United States subsidiaries participate in that framework. Mailchimp states that The Rocket Science Group LLC is covered by Intuit’s framework certification and that its Data Processing Addendum is incorporated into its standard terms. Provider participation and safeguards are reviewed against the service in use. Contact the Data Protection Officer for information about the mechanism relevant to a specific transfer.
6. Retention
- Orders, invoices and accounting records: six years from the last relevant accounting entry, reflecting the Spanish Commercial Code, or longer where an interrupted statutory period, active dispute or specific legal obligation requires it.
- Customer account profile: while the account is active, followed by review for deletion or anonymisation after three years without account or order activity. Legally required order and accounting records remain separately restricted for their applicable period.
- Returns, complaints and enquiries: five years after the case is closed, unless a dispute, product-safety matter or legal obligation requires longer. Messages that contain unnecessary health information are assessed for earlier deletion or restriction.
- Newsletter: until consent is withdrawn. A minimal suppression record may be retained while necessary to honour the unsubscribe request and demonstrate compliance.
- Consent evidence: while the related processing continues and for up to five years afterwards where needed to demonstrate the consent and handle legal claims.
- Analytics and advertising data: according to the configured provider retention setting and the cookie/storage durations in the Cookie Policy. These settings are subject to at least annual review.
- Routine production database backups and disk snapshots: 14 days. A separately protected backup may be retained for the documented duration of a migration, incident or legal hold and deleted when that purpose ends.
- Security logs: according to the operational security schedule, normally no more than 90 days unless an event is required for investigation, legal claims or a legal obligation.
When the relevant period ends, data is deleted, anonymised or restricted where continued storage is required only for legal obligations or claims.
7. Cookies and consent choices
Necessary cookies support security, consent preferences, language, cart, checkout and account functions. Analytics and advertising-measurement technologies remain disabled unless the applicable consent is granted. Cookie and similar identifiers may be personal data or linked to other information. Consent can be rejected or withdrawn at any time through the persistent Cookie Settings control. Details are in the Cookie Policy.
8. Rights
Where applicable, a person may request access, rectification, erasure, restriction, objection or data portability and may withdraw consent without affecting processing carried out before withdrawal. Requests may be sent to antonio@hartington.org. Hartington may request information needed to verify identity and will respond within the period required by applicable law.
A person may lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.
9. Children
The store is not directed to children. The product page states the applicable age restriction from the Instructions for Use. Hartington does not knowingly invite children to create accounts, subscribe to marketing or submit forms.
10. Security
Hartington applies technical and organisational measures appropriate to the identified risks, including encrypted transport, restricted administrative access, infrastructure monitoring, protected backups and security logging. No Internet service can guarantee absolute security.
11. Changes
This Policy may be updated when the processing activities, providers or legal requirements change. The review date above identifies the current version. Material changes affecting an existing consent will be presented for a new choice where required.
