Gli integratori alimentari non sostituiscono una dieta varia ed equilibrata e uno stile di vita sano. Sono formulati per persone adulte in buona salute. In caso di patologie, gravidanza, allattamento o assunzione di farmaci, consulta sempre il tuo medico o specialista di fiducia.
Privacy policy
Privacy notice
under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR")
Last updated: October 2026
This notice explains how GOFOR360 S.r.l. processes the personal data of people who visit gofor360.it (the "Site"), buy our products, including through marketplaces, sign up for our communications, use our quizzes or our virtual assistant, contact us or apply to work with us.
1. Controller
GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy. Tax code and VAT number 10816840960, REA MI 2796807.
Email: supporto@gofor360.it. Certified email (PEC): pec@pec.gofor360.it.
2. Data we process
2.1 Data you give us
- name, email, phone number, shipping and billing addresses;
- orders, purchase history, subscriptions, returns and refunds;
- payment data, processed directly by the payment providers: we do not store card details;
- messages you send us by email, WhatsApp, phone or through the forms on the Site;
- reviews and any photos;
- quiz answers (section 2.3) and questions to the virtual assistant (section 2.4);
- if you apply through the "Work with us" pages, your CV and the data you send us.
2.2 Data collected automatically
IP address, device and browser type, language, pages visited, products viewed, cart content, date and time, session identifiers. Only with your consent, collected through the cookie banner, we use analytics and marketing cookies and identifiers (see the Cookie Policy).
2.3 Quizzes on the Site
The Site offers two optional quizzes that suggest products based on your answers: the "Discover your protocol" quiz, developed by us, and a quiz built with the RevenueHunt app. You can buy on the Site without taking any quiz.
In the "Discover your protocol" quiz the first questions concern data that are not health data (name, gender, age range, type of work, general goal). Before the questions on health and wellbeing (for example stress, sleep, symptoms, diet, physical activity, supplements already taken) we ask for your explicit consent to the processing of these data, under Article 9(2)(a) GDPR.
- If you do not consent, the quiz does not ask these questions, gives you general suggestions and we do not record any information about your health.
- If you consent, your answers and the resulting profile are linked to your email address in our email platform (Klaviyo), to send you the results and the suggested protocol. We record your consent and its date.
- You can withdraw your consent at any time by writing to supporto@gofor360.it: we will delete the health answers from your profile. Withdrawal does not affect the lawfulness of processing carried out before it.
In the RevenueHunt quiz explicit consent is collected before the health questions; the answers are kept by RevenueHunt in identifiable form for 30 days and then anonymised.
Health information collected through the quizzes is not used for advertising on Meta, TikTok or Google and is not disclosed to them. We have carried out a data protection impact assessment (Article 35 GDPR) for the processing of quiz data.
2.4 Virtual assistant
On the home page and on the "Assistant" page you can ask questions to a virtual assistant based on artificial intelligence, which answers on products and ingredients: you are talking to an automated system, not to a person. The text of your questions is sent to our server and to the provider of the artificial intelligence model to generate the answer. We do not send your name, your email or identifiers of your account or device.
Please do not write data that identify you or information about your health. The answers are indicative and do not replace the advice of a doctor or pharmacist.
2.5 WhatsApp and pharmacist advice
We use WhatsApp for order communications and customer support. For cash-on-delivery orders we send an automatic message asking you to confirm the order before shipping. If you ask us to (for example by leaving your number at the end of the quiz), or if you qualify through the spending thresholds offered, our pharmacist or our team may contact you on WhatsApp to give you advice on the suggested protocol.
If in your messages you share information about your health to ask for advice, we use it only to answer you and we do not add it to our marketing tools.
3. Purposes, legal bases and retention
We process data for the purposes below. When the periods indicated expire, the data are deleted or anonymised.
| Purpose | Legal basis | Data | Retention |
|---|---|---|---|
| Handling orders, shipping, payments, invoicing and order communications (including by WhatsApp or SMS) | Performance of the contract (Art. 6(1)(b)); tax and accounting obligations (Art. 6(1)(c)) | Identification and contact data, addresses, order data, tax data | 10 years from the order |
| Confirmation of cash-on-delivery orders by WhatsApp and fraud prevention | Performance of the contract (Art. 6(1)(b)); legitimate interest in preventing fraud (Art. 6(1)(f)) | Name, phone, order number, confirmation status | Until shipping, then 3 years for any complaints |
| Subscriptions | Performance of the contract (Art. 6(1)(b)) | Identification data, renewals, payment method (held by the payment provider) | Duration of the subscription, then 10 years for tax obligations |
| Customer support. Replies may be prepared with artificial intelligence tools and are checked by our staff | Performance of the contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); legitimate interest in handling requests (Art. 6(1)(f)) | Contact data, content of messages, order data | 3 years from closing the request |
| Marketing emails and SMS, newsletters, automations and segmentation | Consent (Art. 6(1)(a)) | Email, phone, name, order and browsing history, interactions with emails | Until consent is withdrawn |
| "Discover your protocol" quiz: results and suggested protocol | Provision of a requested service (Art. 6(1)(b)); for health answers, explicit consent (Art. 9(2)(a)) | Name, email, general answers; with consent, answers on health and wellbeing and the resulting profile | Health answers: no more than 24 months from collection, or until consent is withdrawn |
| RevenueHunt quiz | Explicit consent (Art. 9(2)(a)); provision of a requested service (Art. 6(1)(b)) | Name, email, quiz answers | 30 days in identifiable form, then anonymised |
| Virtual assistant | Pre-contractual steps at your request (Art. 6(1)(b)) | Text of questions and answers, language | Conversations are not linked to your profile and are not used for other purposes; server technical logs are kept only as long as needed for the operation and security of the service, and in any case for no more than 12 months |
| Personalised product recommendations on the Site | Consent (Art. 6(1)(a)), collected through the cookie banner | Browsing and purchases | 12 months or until consent is withdrawn |
| Collecting and publishing reviews | Performance of the contract (Art. 6(1)(b)); consent for photos (Art. 6(1)(a)) | Name, email, review, photos | Until a request for deletion |
| Club 360 (community and loyalty programme) | Consent to join (Art. 6(1)(a)) | Name, email, activity, points and rewards | Duration of membership, then 2 years |
| Pharmacist advice and wellbeing guidance sessions by WhatsApp | Consent (Art. 6(1)(a)); for health information, explicit consent (Art. 9(2)(a)) | Name, phone, goals, content of messages | 24 months from the last contact or until consent is withdrawn |
| Sales on marketplaces (Amazon, TikTok Shop) | Performance of the contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) | Identification data, address, order data | 10 years from the order |
| Advertising and campaign measurement (Meta, TikTok, Google) | Consent (Art. 6(1)(a)); for Meta, joint controllership (Art. 26) | Browsing and purchase events, email in hashed form | As set out in the Cookie Policy (for example 90 days Meta, 14 months Google Analytics) |
| Statistics and improvement of the Site (Google Analytics, analytics on the quiz page, A/B tests) | Consent for non-technical cookies (Art. 6(1)(a)); legitimate interest for aggregated data (Art. 6(1)(f)) | Browsing events, test variants | 14 months (Google Analytics); duration of the tests |
| Cookie consent management | Legal obligation (Art. 6(1)(c)) | Preferences, truncated IP, date and time | 13 months |
| Internal economic analysis (margins and costs) | Legitimate interest (Art. 6(1)(f)) | Order data, customer identifier | Same as the source data |
| Recruitment | Pre-contractual steps (Art. 6(1)(b)) | CV, contact data, experience | 12 months from receipt, unless hired |
| Handling requests on data subject rights (Arts. 15-22) | Legal obligation (Art. 6(1)(c)) | Identifiers, content of the request | 5 years from closing |
| Handling personal data breaches | Legal obligation (Arts. 33-34) | Description of the breach, data subjects involved | 5 years |
| Site security and technical logs | Legitimate interest in security (Art. 6(1)(f)) | IP, user agent, URL, date and time | 6 to 12 months |
| Defending our rights in legal proceedings | Legitimate interest (Art. 6(1)(f)) | Data needed for the defence | For the duration of the dispute and until the limitation period expires |
4. Who we share data with
4.1 Providers processing data on our behalf
We use providers that process data on our behalf as processors (Article 28 GDPR), under their data processing terms or appointment agreements. The main ones are:
| Provider | Service | Location and safeguards |
|---|---|---|
| Shopify (Shopify International Ltd., Ireland, and group companies) | Store platform, Site hosting, orders, checkout and card payments (Shopify Payments) | EU, Canada, USA: adequacy decision (Canada), standard contractual clauses |
| Klaviyo, Inc. | Email and SMS, automations, segmentation, results of the "Discover your protocol" quiz | USA: Data Privacy Framework, standard contractual clauses |
| RevenueHunt | RevenueHunt quiz | EU and USA: standard contractual clauses |
| PostHog | Usage analytics on the quiz page, with your consent | EU (hosting in Germany) |
| Loox | Reviews | USA: standard contractual clauses |
| Bubblehouse | Club 360 (community and loyalty) | USA: standard contractual clauses |
| Loop Subscriptions | Subscriptions | USA: standard contractual clauses |
| Store apps for cart, offers, recommendations and QR codes (Rebuy, Kaching, Fly Bundles, AOV.ai, Aftersell, EG Auto Add to Cart, QR Codes Unlimited) | Product recommendations, bundles, discounts, cart and post-purchase offers, QR codes in parcels | EU and third countries: standard contractual clauses |
| Shoplift | A/B testing of pages | USA: standard contractual clauses |
| Pandectes | Cookie consent management | EU and USA: standard contractual clauses |
| WeTracked | Server-side sending of purchase events to Meta | USA: standard contractual clauses |
| Google (Analytics, Ads, Workspace) | Statistics, campaign measurement, work tools | USA: Data Privacy Framework, standard contractual clauses |
| WhatsApp Business (Meta) and connected messaging apps (WhatFlow and others) | Order messages, confirmation of cash-on-delivery orders, customer support | USA: Data Privacy Framework, standard contractual clauses |
| CEDCommerce | Connection between the store and TikTok Shop | India: standard contractual clauses |
| Artificial intelligence and cloud service providers | Virtual assistant, drafting of support replies, internal applications (order management, logistics, economic analysis) | EU and USA: Data Privacy Framework, standard contractual clauses |
| Novapri S.r.l. | Warehousing, order preparation and returns handling | Italy |
4.2 Parties processing data as independent or joint controllers
- Couriers and shipping services (for example T.W.S. Express Courier, BRT, GLS, InPost, Amazon Shipping), for deliveries and returns.
- Payment providers (for example PayPal and Klarna), for payments made with their services.
- Marketplaces (Amazon, TikTok Shop): for purchases on these platforms the marketplace processes data as controller; we receive the data needed to fulfil the order.
- Meta Platforms Ireland Ltd., joint controller (Article 26 GDPR) for data collected through the pixel and the Conversions API; TikTok and Google for their own advertising processing, with your consent.
- Advisers (accountant, payroll consultant, lawyers), banks, insurers and authorities, where necessary or required by law.
- In corporate transactions (for example a sale of shares or a merger), potential buyers and their advisers, only for the data needed and under confidentiality obligations.
5. Transfers outside the European Union
Some providers are based in, or process data in, countries outside the European Economic Area, mainly the United States. In these cases transfers are based on:
- adequacy decisions of the European Commission (for example for Canada and, for certified organisations, for the United States under the EU-U.S. Data Privacy Framework);
- standard contractual clauses approved by the European Commission (Decision 2021/914);
- supplementary measures where needed (encryption, pseudonymisation, access restrictions).
6. Your rights
Under Articles 15-22 GDPR you may request access to your data, rectification, erasure, restriction of processing and portability; you may object to processing based on legitimate interest and to marketing, and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You may withdraw any consent at any time, without affecting processing carried out before.
To exercise your rights, write to supporto@gofor360.it or to GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy. We reply within 30 days, which may be extended by a further 60 days for complex requests, with reasons. You can also unsubscribe from emails using the link in every message.
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
7. Profiling, automated decisions and artificial intelligence
- Quizzes: an algorithm suggests products based on your answers. It is a non-binding purchase suggestion and has no legal or similarly significant effect on you.
- Recommendations on the Site: with your cookie consent we show products based on browsing and purchases. They do not change prices or terms of sale.
- Marketing: with your consent the email platform helps us send you communications in line with your interests. You can unsubscribe at any time.
- Virtual assistant: it is an artificial intelligence system; we tell you so on the page and in this notice (section 2.4).
- Support and internal tools: we use artificial intelligence tools to draft replies, always checked by our staff, and to develop internal applications. We take measures to avoid entering customer data into development tools.
None of these processing activities involves decisions based solely on automated processing within the meaning of Article 22 GDPR. You can object to profiling and ask for information on the logic involved by writing to supporto@gofor360.it.
8. Cookies
The Site uses technical cookies needed for it to work and, only with your consent collected through the banner, analytics and marketing cookies. Consent is given by category and you can change it at any time from the link at the bottom of the pages. Details in the Cookie Policy: www.gofor360.it/pages/cookie-policy.
9. Minors
The Site and the quizzes are intended for adults. We do not knowingly collect data of minors; if we find that we have, we delete them.
10. Security
We protect data with technical and organisational measures appropriate to the risk: encrypted connections, personal access to systems, access to data limited to authorised and trained staff, agreements with providers, procedures for handling breaches.
11. Changes
We may update this notice, for example following changes in the law or in the services we use. We publish every change on this page with the date of the update.
GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy, tax code and VAT number 10816840960, REA MI 2796807