Privacy Policy

Basic information on data protection

This Privacy Policy has been drafted to comply with the transparency duty regarding the processing of personal data that PromoFarma Ecom S.L. (hereinafter, “PromoFarma”) and Helena Abreu Unipessoal, Lda. (hereinafter, “Farmacia Central”) may carry out as independent data controllers or as joint controllers, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”).

Below is an executive summary of the data processing carried out on www.promofarma.com.

Data controller
  • PromoFarma
  • Joint controllership: PromoFarma and Farmacia Central
  • Farmacia Central
Main processing purposes

When PromoFarma acts as an independent data controller:

  • Order management for PromoFarma.
  • Customer service management for PromoFarma.
  • Commercial prospecting by PromoFarma.
  • Management of legal proceedings and compliance.

When PromoFarma and Farmacia Central act as joint controllers:

  • Creation and management of your Portal account.
  • Service quality management.
  • Management of recommendation/loyalty programs.
  • Web statistics.
  • Portal improvement.
  • Personalization of your Explora experience.

When Farmacia Central acts as an independent data controller:

  • Order management for Farmacia Central.
  • Customer service management for Farmacia Central.
  • Commercial prospecting by Farmacia Central.
  • Management of legal proceedings and compliance.
Main legal bases
  • Consent.
  • Performance of a contract.
  • Legitimate interest.
  • Compliance with legal obligations.
Main recipients
  • PromoFarma and Farmacia Central, and their authorized personnel.
  • Companies in the group to which PromoFarma belongs.
  • Companies in the group to which Farmacia Central belongs.
  • Payment service providers of PromoFarma and Farmacia Central.
  • Delivery service providers of PromoFarma and Farmacia Central.
  • Other subcontractors (data hosting providers, IT services, etc.).
  • Administrative and judicial authorities.
Your rights regarding personal data

You have, among others, the right of access, rectification, erasure, objection, restriction, and data portability; the right to object at any time, for reasons related to your particular situation, where processing is based on legitimate interest; and the right to withdraw consent.

You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): www.aepd.es.

Source of personal data collected
  • Data provided directly by you on the Portal or through interactions with PromoFarma and/or Farmacia Central.
  • Data collected automatically via cookies and similar tracking technologies.
Additional information on the protection of your personal data

The website www.promofarma.com and the application (jointly, the “Portal”) are controlled by PromoFarma Ecom S.L. and Helena Abreu Unipessoal, Lda.

The Portal is intended for the online sale of pharmaceutical, parapharmaceutical, cosmetic, and hygiene products.

To access, browse, and use the Portal and its services, you need to provide personal data to PromoFarma and Farmacia Central.

Under “For what purposes do we process your data and on what legal basis?” you will find the processing activities carried out by PromoFarma and Farmacia Central, jointly or independently.

EXPLORA

Within the application, you will find the “Explora” section, which includes information on products and services offered in the app.

Explora allows users to personalize publications and receive communications tailored to their interests, based on user activity.

This functionality involves profiling. As stated in this policy, the legal basis is your consent given in the app environment.

You may withdraw your consent at any time. However, if you do so, you will no longer be able to access personalized content and may lose some Explora features.

This policy complements the Terms of Use (“TU”) and General Terms and Conditions (“GTC”) of PromoFarma.com (https://www.promofarma.com/es/legal/contract), as well as any document or notice referring to this policy.

For any questions and to exercise your rights, you may contact:

Who is the data controller?

PromoFarma Ecom, S.L.

  • Registered office: Av. Diagonal 534, 6º, 08006, Barcelona, Spain.
  • Tax ID: B65130122.
  • Public Registry: Registered in the Mercantile Registry of Barcelona; volume 40,021, folio 13, section 8, sheet number B-310,366, 1st entry.

Farmácia Central (Helena Abreu, Unipessoal Lda.)

  • Registered office: MONTEMOR-O-NOVO, Rua 5 de Outubro, 69.
  • Tax ID: 514910224.
  • Public Registry: Registered in the permanent commercial registry certificate with Av.1 AP. 150/20190417.

PromoFarma and Farmacia Central act as joint controllers in relation to the administrative and operational management of the Portal.

PromoFarma acts as an independent data controller regarding the management of orders for parapharmaceutical, cosmetic, and hygiene products sold on the Portal.

Farmacia Central acts as an independent data controller regarding the management of orders for pharmaceutical, parapharmaceutical, cosmetic, and hygiene products sold on the Portal.

For what purposes do we process your data and on what legal basis?

When PromoFarma acts as data controller:

  • Order management for PromoFarma: process orders, delivery, invoicing, payments, and relationship follow-up. Legal basis: performance of the applicable GTC.
  • Customer service management: queries, complaints, claims, returns, and virtual assistant support. Legal basis: performance of the applicable GTC.
  • Commercial prospecting to existing customers: similar or analogous commercial communications, unless you object. Legal basis: legitimate interest.
  • Commercial prospecting to potential customers: communications about the Portal and products sold on it. Legal basis: consent.
  • Dispute/incident management: breach management and legal defense. Legal basis: legitimate interest.
  • Legal compliance: compliance with legal/regulatory obligations and rights requests. Legal basis: legal obligation.

When PromoFarma and Farmacia Central act as joint controllers:

  • Account creation and management: account setup, access, order tracking, history, updates, and security. Legal basis: performance of TU/GTC and legitimate interest (account security).
  • Service quality management: product ratings/opinions and satisfaction surveys. Legal basis: legitimate interest.
  • Recommendation/loyalty programs: participation and discount management. Legal basis: performance of applicable GTC; where relevant, recipient consent must be obtained by the referring user.
  • Web personalization and statistics: aggregated analytics and browsing facilitation. Legal basis: consent.
  • Explora personalization: behavior-based personalization (visits, likes, follows). Legal basis: consent provided in the app.
  • Portal improvement: maintenance, support, development, and security. Legal basis: legitimate interest.

When Farmacia Central acts as data controller:

  • Order management for Farmacia Central. Legal basis: performance of applicable GTC.
  • Customer service management for Farmacia Central. Legal basis: performance of applicable GTC.
  • Commercial prospecting (existing/potential customers). Legal basis: legitimate interest / consent.
  • Dispute/incident management and legal compliance. Legal basis: legitimate interest and legal obligation.
  • Where health data are involved, processing may rely on Article 9(2)(h) GDPR, where applicable.
What categories of personal data are collected and used?
  • Identification data: name, surname, date of birth, customer number.
  • Contact data: email address, postal address, telephone number.
  • Banking/financial data: payment method, billing address.
  • Order and return data: order number, date/time, status, products, value, voucher usage, discounts, delivery details, return reasons, refunded amount.
  • Commercial relationship data: order history/frequency, requests, interactions.
  • Portal contribution data: reviews/opinions.
  • Recommendation program data: referred person’s email, issued voucher/certificate.
  • Explora behavior data: visits, likes, follows, etc.
  • Health data (processed only by Farmacia Central): details of pharmaceutical consultations and, where applicable, transaction-related data for non-prescription medicine purchases.

Certain data are collected automatically via cookies and similar technologies, including connection and browsing data (date/time, IP, geolocation, device, browser, OS, viewed pages) for technical operation, security, and analytics.

Cookie Policy: https://www.promofarma.com/es/legal/cookies.

Who are the recipients of your data?
  • PromoFarma and Farmacia Central, and authorized personnel.
  • Group companies of PromoFarma and Farmacia Central (administrative/operational/commercial purposes).
  • Payment and delivery service providers.
  • Technical and logistical subcontractors.
  • Administrative or judicial authorities where legally required.
  • External advisors for potential litigation/legal matters.
  • Third parties in corporate transactions (restructuring, merger, acquisition, insolvency, etc.).
Virtual assistant

Our virtual assistant provider is Zowie, Inc. (8 The Green, Dover, DE 19901, USA), acting as a processor and certified under the U.S. Data Privacy Framework (DPF). The virtual assistant is operated in a private cloud environment located in the European Union.

It is used to provide automated responses and support, including general order status information with a tracking number, without requiring account login.

If you use chat, we retain your IP address for 30 days and store exchanged messages to verify and improve response behavior.

The virtual assistant does not provide medical or pharmaceutical advice. You may end the conversation at any time and request human customer support.

Will international transfers of your personal data be made?

As far as possible, personal data are processed within the European Economic Area (EEA).

If the recipient country does not provide an equivalent level of protection, PromoFarma and Farmacia Central will implement appropriate safeguards (including Standard Contractual Clauses), following a prior assessment and in the absence of an adequacy decision.

Currently, transfers may take place to the United States due to certain providers/subprocessors involved in the services described in this policy, under the safeguards required by GDPR.

For more information:

How long do we keep your personal data?

In general, personal data are retained only for as long as necessary for the purposes for which they were collected, or to comply with legal/regulatory retention obligations.

Main retention periods:

  • Account data (including order data): until account deletion or 3 years of inactivity.
  • Request-related data (contact/returns/complaints): until fully processed.
  • Commercial communications data: until you unsubscribe/object.
  • Connection and navigation data: 13 months.

Additional retention:

  • 3 years from account cancellation/inactivity for commercial prospecting data.
  • 5 years from account cancellation/inactivity for evidentiary purposes.
  • 2 years for data related to pharmaceutical care by Farmacia Central.
  • 2 years for medicine order register data managed by Farmacia Central.
  • 6 years from end of relevant accounting year for accounting/commercial records.

After contract termination or deletion request, data may be blocked and retained for legal limitation periods, generally up to 5 years, or longer where legally required.

What rights do you have over your personal data?
  • Right of access.
  • Right to rectification.
  • Right to erasure (right to be forgotten).
  • Right to object.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to withdraw consent at any time.

The scope of each right depends on the legal basis of processing.

To exercise your rights:

You may also lodge a complaint with the Spanish Data Protection Agency: https://www.aepd.es.

What is the origin of data when it was not provided by the data subject?

In addition to data provided directly by you, we may collect information about your browsing habits where you have provided consent.

If you provide third-party personal data, you declare that you have informed such persons and obtained prior consent where required by law.

What security measures do we implement to protect your data?

PromoFarma and Farmacia Central process personal data confidentially and apply appropriate contractual, technical, and organizational safeguards against accidental or unlawful destruction, loss, alteration, unauthorized access, or disclosure.

They also ensure that employees and service providers are bound by data protection and confidentiality obligations, including written commitments where applicable.

Changes to this Data Protection Policy

PromoFarma and Farmacia Central reserve the right to amend this policy at any time to adapt it to changes in the Portal, its services, or applicable regulations. Updated versions will be communicated in due course.

Laatst bijgewerkt: 06/02/2026