Privacy Policy
Last reviewed: 25 July 2026
1. Controller and Data Protection Officer
Controller: Hartington Pharmaceutical S.L.U., Company Tax Code B63437735, registered in the Company Register of Barcelona, Volume 36349, Folio 196, Page B-285983.
Address: Avda. Ernest Lluch 32, Tecnocampus Mataró – Torre TCM3, Floor 6, Door 3, 08302 Mataró, Barcelona, Spain.
Data Protection Officer: Antonio Tradacete Casas, antonio@hartington.org.
2. Data, purposes and legal bases
| Activity | Data used | Purpose | Legal basis |
|---|---|---|---|
| Orders and customer accounts | Name, contact details, billing and delivery address, account credentials, order contents, price, payment status and transaction reference | Create and administer the account and order, provide order communications and support | Performance of the contract or steps requested before entering into it |
| Payment | Order amount, currency, transaction reference and the information required by the selected payment provider | Authorise, evidence, refund and reconcile payment | Performance of the contract and compliance with accounting and tax obligations |
| Delivery | Recipient, delivery address, telephone, order contents, delivery method and tracking information | Arrange and evidence delivery and handle loss, delay or damage | Performance of the contract |
| Returns, complaints and enquiries | Email, optional name, order number, request type and message | Respond to the request, administer statutory rights and establish, exercise or defend legal claims | Performance of the contract, legal obligations and legitimate interests in resolving requests and claims |
| Invoices and legal compliance | Order, billing, invoice and transaction records | Accounting, tax, regulatory and lawful-authority requirements | Compliance with legal obligations |
| Security and abuse prevention | Internet Protocol address, user agent, request and login data, timestamps, security events and form-risk signals | Protect accounts, payments, forms, infrastructure and the website against fraud, spam and abuse | Legitimate interests in maintaining a secure service and, where applicable, legal obligations |
| Newsletter | Email address and consent status | Send the optional newsletter and maintain unsubscribe choices | Consent |
| Analytics and advertising measurement | Consent state, online identifiers, device/browser data, page and event data, ad attribution, order identifier, value and currency | Measure aggregate website use and completed-purchase campaign performance | Consent for non-essential analytics and advertising technologies |
Hartington does not use the website data described above to make decisions based solely on automated processing that produce legal or similarly significant effects. Google ad personalization is disabled. Advertiser-curated health audiences, customer lists and remarketing are not part of the approved advertising use.
3. Health information
The current order, return and general-contact forms do not request symptoms, diagnoses, treatment outcomes, side effects or other health information and instruct users not to submit it. The former specialist-consultation service is discontinued. If health information is nevertheless submitted, Hartington will restrict access and assess whether a valid Article 9 General Data Protection Regulation condition exists; otherwise it will be deleted, subject to any specific legal obligation or legal-claims requirement.
4. Recipients
Data is not sold. Depending on the selected transaction and consent choices, recipients may include:
- Google Cloud for website hosting and Google reCAPTCHA for form security and spam prevention;
- Redsys / 3D Secure or PayPal for the selected payment method;
- MRW and other delivery providers offered for the destination;
- Google Analytics, Google Tag Manager and Google Ads after the applicable consent;
- Mailchimp for the optional newsletter and synchronisation of existing Mailchimp contacts;
- email, information-technology, accounting and professional advisers used to operate the service or handle legal obligations and claims; and
- public authorities where disclosure is required by law.
Microsoft Clarity and Mailchimp connected-site browser tracking were disabled on 25 July 2026. Previously consented data may remain only for the applicable provider retention period.
5. International transfers
The production website is hosted in the European Union. Some providers or their subprocessors may process data outside the European Economic Area. Transfers must be covered by an applicable European Commission adequacy decision or safeguards under Chapter V of the General Data Protection Regulation, such as the European Commission’s Standard Contractual Clauses.
As of this review date, the European Commission recognises United States commercial organisations participating in the EU–US Data Privacy Framework as providing adequate protection. Google states that Google LLC and its covered United States subsidiaries participate in that framework. Mailchimp states that The Rocket Science Group LLC is covered by Intuit’s framework certification and that its Data Processing Addendum is incorporated into its standard terms. Provider participation and safeguards are reviewed against the service in use. Contact the Data Protection Officer for information about the mechanism relevant to a specific transfer.
6. Retention
- Orders, invoices and accounting records: six years from the last relevant accounting entry, reflecting the Spanish Commercial Code, or longer where an interrupted statutory period, active dispute or specific legal obligation requires it.
- Customer account profile: while the account is active, followed by review for deletion or anonymisation after three years without account or order activity. Legally required order and accounting records remain separately restricted for their applicable period.
- Returns, complaints and enquiries: five years after the case is closed, unless a dispute, product-safety matter or legal obligation requires longer. Messages that contain unnecessary health information are assessed for earlier deletion or restriction.
- Newsletter: until consent is withdrawn. A minimal suppression record may be retained while necessary to honour the unsubscribe request and demonstrate compliance.
- Consent evidence: while the related processing continues and for up to five years afterwards where needed to demonstrate the consent and handle legal claims.
- Analytics and advertising data: according to the configured provider retention setting and the cookie/storage durations in the Cookie Policy. These settings are subject to at least annual review.
- Routine production database backups and disk snapshots: 14 days. A separately protected backup may be retained for the documented duration of a migration, incident or legal hold and deleted when that purpose ends.
- Security logs: according to the operational security schedule, normally no more than 90 days unless an event is required for investigation, legal claims or a legal obligation.
When the relevant period ends, data is deleted, anonymised or restricted where continued storage is required only for legal obligations or claims.
7. Cookies and consent choices
Necessary cookies support security, consent preferences, language, cart, checkout and account functions. Analytics and advertising-measurement technologies remain disabled unless the applicable consent is granted. Cookie and similar identifiers may be personal data or linked to other information. Consent can be rejected or withdrawn at any time through the persistent Cookie Settings control. Details are in the Cookie Policy.
8. Rights
Where applicable, a person may request access, rectification, erasure, restriction, objection or data portability and may withdraw consent without affecting processing carried out before withdrawal. Requests may be sent to antonio@hartington.org. Hartington may request information needed to verify identity and will respond within the period required by applicable law.
A person may lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.
9. Children
The store is not directed to children. The product page states the applicable age restriction from the Instructions for Use. Hartington does not knowingly invite children to create accounts, subscribe to marketing or submit forms.
10. Security
Hartington applies technical and organisational measures appropriate to the identified risks, including encrypted transport, restricted administrative access, infrastructure monitoring, protected backups and security logging. No Internet service can guarantee absolute security.
11. Changes
This Policy may be updated when the processing activities, providers or legal requirements change. The review date above identifies the current version. Material changes affecting an existing consent will be presented for a new choice where required.
Internal measurement addition / Actualización de medición interna: 18 September 2026 / 18 de septiembre de 2026.
Optional internal campaign measurement
If you accept both analytics and advertising cookies, we use a first-party cookie to associate an eligible campaign visit with an order on nasodren.com. The cookie contains campaign and creative codes and the time of the eligible visit. It expires seven days after that visit. An ordinary return visit does not extend this period. A later eligible campaign visit may replace the association and begin its own seven-day period.
For an eligible checkout, the order’s campaign association is held temporarily in server memory. We normally remove it in the next daily cleanup after eight days, within a maximum period of 30 days from attachment, and retain restricted internal totals. It may be lost earlier, for example after a server restart; we do not reconstruct it from customer or payment records. Your ordinary order, payment and refund records are treated separately as described elsewhere in this privacy notice. Their preservation does not preserve the removed campaign association.
Campaign totals include refunds recorded before the campaign association is removed. A refund recorded later remains in our financial records but cannot be assigned to the removed campaign association. Campaign-specific refund totals may therefore be incomplete after this cutoff.
You can decline these optional cookies or change your choices using the site's cookie controls. Without both permissions, this internal campaign attribution does not operate. Withdrawing either of these permissions clears the attribution cookie on the next relevant request to this site; it does not by itself identify and remove an association already attached to an order. For a request concerning stored order-linked attribution, use the privacy contact and rights process stated in this notice.
This internal measurement component does not send the campaign association, order information or customer information to Meta. This statement describes this component; it must not be presented as a claim about unrelated website integrations without a separate audit.
Medición interna opcional de campañas
Si acepta tanto las cookies de análisis como las publicitarias, utilizamos una cookie propia para asociar una visita procedente de una campaña válida con un pedido en nasodren.com. La cookie contiene los códigos de la campaña y de la pieza publicitaria, así como la hora de la visita válida. Caduca siete días después de esa visita. Una visita posterior ordinaria no amplía ese plazo. Una nueva visita procedente de una campaña válida puede sustituir la asociación e iniciar su propio plazo de siete días.
En una compra que cumpla las condiciones de esta medición, la asociación del pedido con la campaña se guarda temporalmente en la memoria del servidor. Normalmente la eliminamos en la siguiente limpieza diaria después de ocho días, dentro de un plazo máximo de 30 días desde que se incorpora, y conservamos totales internos de acceso restringido. Puede perderse antes, por ejemplo al reiniciar el servidor; no la reconstruimos a partir de los datos del cliente o del pago. Los registros ordinarios del pedido, del pago y de los reembolsos se tratan por separado, según lo descrito en los demás apartados de esta política. Su conservación no mantiene la asociación eliminada con la campaña.
Los totales por campaña incluyen los reembolsos registrados antes de eliminar la asociación con la campaña. Un reembolso registrado después permanece en nuestros registros financieros, pero ya no puede asignarse a la asociación eliminada. Por ello, los totales de reembolsos de cada campaña pueden quedar incompletos después de ese momento.
Puede rechazar estas cookies opcionales o cambiar sus preferencias mediante los controles de cookies del sitio. Sin ambos permisos, esta atribución interna de campañas no funciona. Al retirar cualquiera de estos dos permisos, la cookie de atribución se elimina en la siguiente solicitud pertinente a este sitio; este cambio no identifica ni elimina por sí solo una asociación ya incorporada a un pedido. Para solicitar una actuación sobre una asociación almacenada junto a un pedido, utilice el contacto y el procedimiento de ejercicio de derechos indicados en esta política.
Este componente de medición interna no envía a Meta la asociación con la campaña, los datos del pedido ni los datos del cliente. Esta afirmación describe este componente; no debe presentarse como una afirmación sobre otras integraciones del sitio sin una revisión independiente.
