Gli integratori alimentari non sostituiscono una dieta varia ed equilibrata e uno stile di vita sano. Sono formulati per persone adulte in buona salute. In caso di patologie, gravidanza, allattamento o assunzione di farmaci, consulta sempre il tuo medico o specialista di fiducia.
Privacy policy
Privacy notice
under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR")
Last updated: 10 November 2026
Other languages: English · Deutsch · Español
This notice explains how GOFOR360 S.r.l. processes the personal data of people who visit gofor360.it (the "Site"), buy our products, including through marketplaces, sign up for our communications, use our quiz or our virtual assistant, contact us or apply to work with us.
1. Controller
GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy. Tax code and VAT number 10816840960, REA MI 2796807.
Email: supporto@gofor360.it. Certified email (PEC): pec@pec.gofor360.it.
2. Data we process
2.1 Data you give us
- name, email, phone number, shipping and billing addresses;
- orders, purchase history, subscriptions, returns and refunds;
- payment data, processed directly by the payment providers: we do not store card details;
- messages you send us by email, WhatsApp, phone or through the forms on the Site;
- reviews and any photos;
- quiz answers (section 2.3) and questions to the virtual assistant (section 2.4);
- if you apply through the "Work with us" pages, your CV and the data you send us.
2.2 Data collected automatically
IP address, device and browser type, language, pages visited, products viewed, cart content, date and time, session identifiers. Only with your consent, collected through the cookie banner, we use analytics and marketing cookies and identifiers (see the Cookie Policy).
2.3 Quiz on the Site
The Site offers an optional quiz, "Discover your protocol", developed by us, that suggests products based on your answers. You can buy on the Site without taking the quiz.
In the "Discover your protocol" quiz the first questions concern data that are not health data (name, gender, age range, type of work, general goal). Before the questions on health and wellbeing (for example stress, sleep, symptoms, diet, physical activity, supplements already taken) we ask for your explicit consent to the processing of these data, under Article 9(2)(a) GDPR.
- If you do not consent, the quiz does not ask these questions, gives you general suggestions and we do not record any information about your health.
- If you consent, your answers and the resulting profile are linked to your email address in our email platform (Klaviyo), to send you the results and the suggested protocol. We record your consent and its date.
- You can withdraw your consent at any time by writing to supporto@gofor360.it: we will delete the health answers from your profile. Withdrawal does not affect the lawfulness of processing carried out before it.
Health information collected through the quiz is not used for advertising on Meta, TikTok or Google and is not disclosed to them. We have carried out a data protection impact assessment (Article 35 GDPR) for the processing of quiz data.
2.4 Virtual assistant
On the home page and on the "Assistant" page you can ask questions to a virtual assistant based on artificial intelligence, which answers on products and ingredients: you are talking to an automated system, not to a person. The text of your questions is sent to our server and to the provider of the artificial intelligence model to generate the answer. We do not send your name, your email or identifiers of your account or device.
Please do not write data that identify you or information about your health. The answers are indicative and do not replace the advice of a doctor or pharmacist.
2.5 WhatsApp and advice from our pharmacy graduate
We use WhatsApp for order communications and customer support. For cash-on-delivery orders we send an automatic message asking you to confirm the order before shipping. If you ask us to (for example by leaving your number at the end of the quiz), or if you qualify through the spending thresholds offered, Carlo, our pharmacy graduate, or our team may contact you on WhatsApp to give you advice on the suggested protocol.
If in your messages you share information about your health to ask for advice, we use it only to answer you and we do not add it to our marketing tools.
2.6 Club 360
When you buy from us or give us your email we enrol you in Club 360, our loyalty programme run with Bubblehouse: you collect points and rewards at no cost and with no obligations. We do this on the basis of our legitimate interest in rewarding people who buy or sign up, which we have assessed against your interests and rights. Membership does not mean you receive promotional emails: you receive those, including messages about points and rewards, only if you have consented to marketing. You can leave Club 360 and ask us to delete your points and programme data at any time by writing to supporto@gofor360.it.
2.7 Free guides
If you download one of our free guides, we process your email address, your name and the guide you requested in order to send it to you. We send you promotional emails only if you tick the dedicated box, which is not pre-ticked, and we record the wording of the consent, the date and your IP address. Without this consent we keep your email for 12 months, only to handle your request.
2.8 gofor360 app
The gofor360 iPhone app reminds you when to take your supplements and helps you keep a wellbeing diary. It needs no account and contains no analytics, advertising or tracking tools.
What stays only on your phone. Registered supplements, doses, times, ticked days, diary (energy, sleep, mood, digestion, notes), summaries, optional name and daily times: we do not receive them. Reminder notifications are generated on the phone. The camera is used only to read barcodes and QR codes: no image is stored or sent.
Reminders even when the app is closed (optional). If you turn this on, the app sends to our server, hosted by Fly.io in the Frankfurt region (EU), a random installation code not linked to your name, email or phone (with a secret key of which we keep only an irreversible fingerprint), the code Apple uses to deliver the notification to your phone, your time zone and, for doses in the next 48 hours, time, quantity, random pack code and whether the dose has been ticked. Product names stay on the phone: neither our server nor Apple receives them, and the notification passing through Apple has generic text. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which we record with date, time and version of the text. Each dose is deleted within 24 hours of its time; installation code, notification token and proof of consent are kept while the feature is on and deleted immediately when you turn it off or use "Delete all data". The app works without this feature.
Siri, Shortcuts and on-device features. If you use Siri or the Shortcuts app to log doses or ask for the next one, the app answers by reading the data on your phone and sends nothing to our servers. The voice request and the answer, which may include the supplement name, are handled by Apple as an independent controller, under its terms and the Siri settings on your iPhone. Reminders, usage tips and tips about the app's features are generated on the phone; feature tips can be turned off in the "Promemoria" (Reminders) section of the app. If you ask for a test of the closed-app reminder, the server keeps the request for at most 10 minutes. Without consent to this feature, the server stores neither notification tokens nor your time zone.
Consistency reward. When you unlock the discount and request it, the app sends the server the random installation code, the product and variant, the number of days in the pack and the ticked days. The server checks the threshold and creates on Shopify a single-use discount code valid for 30 days on that product, without sending Shopify any data about you. We keep installation code, pack, discount level and date for 24 months to prevent abuse; ticked days are used only for the check and are not stored. Legal basis: performance of the service you request (Art. 6(1)(b)) and legitimate interest in preventing abuse (Art. 6(1)(f)). When you use the code at checkout, the rules of this notice for orders apply.
App updates. When it starts, the app checks Expo's servers (650 Industries, Inc., USA) for an available fix. Expo receives the IP address, the operating system, the app version and a random installation identifier generated only for this purpose, which we do not link to you. If the app fails to start, Expo also receives the error text, which it deletes after three days. Legal basis: legitimate interest in fixing errors and keeping the app secure (Art. 6(1)(f)). The transfer to the United States is based on standard contractual clauses.
IP address and other links. The server uses the IP address only to limit repeated requests, as a counter kept for no more than 24 hours. Product photos are downloaded from Shopify servers, which receive the IP address as with any website. "Send to Carlo" opens WhatsApp with a pre-filled message that you read and send yourself: from then on WhatsApp terms and section 2.5 apply. The QR page on the label (app.gofor360.it) uses no cookies or tracking.
Providers and rights. Fly.io, Inc. hosts the server as a processor, with data in the EU and participation in the EU-U.S. Data Privacy Framework for any access from the United States. Apple Inc. delivers notifications through its own service, with standard contractual clauses for transfers to the United States. 650 Industries, Inc. (Expo) delivers app updates as a processor, with standard contractual clauses for transfers to the United States. You can turn off reminders when the app is closed at any time ("Turn off and delete data from the server") and use "Delete all data" to erase everything from the phone and the server. For the other rights in section 6, write to supporto@gofor360.it, quoting if possible the installation code shown in the app settings.
2.9 Creator Program
If you reach our site through a link from a partner creator or use their discount code, we associate the order with that creator to calculate their commission. With the link, we do this only if you have accepted marketing cookies. Creators do not receive your name, your contact details or the list of products you bought: they see only the date and the amount of the sale. To prevent abuse, we automatically compare the email on the order with the creator's email: the comparison takes place at that moment and the email is not stored for this purpose. The legal basis is our legitimate interest in running the program properly and preventing fraud. You can object by writing to supporto@gofor360.it.
3. Purposes, legal bases and retention
We process data for the purposes below. When the periods indicated expire, the data are deleted or anonymised.
| Purpose | Legal basis | Data | Retention |
|---|---|---|---|
| Handling orders, shipping, payments, invoicing and order communications (including by WhatsApp or SMS) | Performance of the contract (Art. 6(1)(b)); tax and accounting obligations (Art. 6(1)(c)) | Identification and contact data, addresses, order data, tax data | 10 years from the order |
| Confirmation of cash-on-delivery orders by WhatsApp and fraud prevention | Performance of the contract (Art. 6(1)(b)); legitimate interest in preventing fraud (Art. 6(1)(f)) | Name, phone, order number, confirmation status | Until shipping, then 3 years for any complaints |
| Subscriptions | Performance of the contract (Art. 6(1)(b)) | Identification data, renewals, payment method (held by the payment provider) | Duration of the subscription, then 10 years for tax obligations |
| Customer support. Replies may be prepared with artificial intelligence tools and are checked by our staff | Performance of the contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)); legitimate interest in handling requests (Art. 6(1)(f)) | Contact data, content of messages, order data | 3 years from closing the request |
| Marketing emails and SMS, newsletters, automations and segmentation | Consent (Art. 6(1)(a)) | Email, phone, name, order and browsing history, interactions with emails | Until consent is withdrawn |
| "Discover your protocol" quiz: results and suggested protocol | Provision of a requested service (Art. 6(1)(b)); for health answers, explicit consent (Art. 9(2)(a)) | Name, email, general answers; with consent, answers on health and wellbeing and the resulting profile | Health answers: no more than 24 months from collection, or until consent is withdrawn |
| Sending free guides and, with separate consent, promotional emails | Performance of a service you requested (Art. 6(1)(b)); consent for marketing (Art. 6(1)(a)) | Email, name, guide requested, date and proof of consent | 12 months without marketing consent; with consent, until withdrawn |
| gofor360 app: reminders even when the app is closed (see 2.8) | Consent (Art. 6(1)(a); Art. 122 Italian Privacy Code) | Random installation code, notification token, time zone, dose times and quantities, ticked dose | Doses: 24 hours from their time; the rest until the feature is turned off |
| gofor360 app: consistency reward (see 2.8) | Performance of the service requested (Art. 6(1)(b)); legitimate interest in preventing abuse (Art. 6(1)(f)) | Random installation code, pack, discount level, date | 24 months |
| gofor360 app: app updates (see 2.8) | Legitimate interest in fixing errors and keeping the app secure (Art. 6(1)(f)) | IP address, operating system, app version, random installation identifier, error text if the app fails to start | Error text: 3 days; other data according to Expo's retention periods |
| Virtual assistant | Pre-contractual steps at your request (Art. 6(1)(b)) | Text of questions and answers, language | Conversations are not linked to your profile and are not used for other purposes; server technical logs are kept only as long as needed for the operation and security of the service, and in any case for no more than 12 months |
| Personalised product recommendations on the Site | Consent (Art. 6(1)(a)), collected through the cookie banner | Browsing and purchases | 12 months or until consent is withdrawn |
| Collecting and publishing reviews | Performance of the contract (Art. 6(1)(b)); consent for photos (Art. 6(1)(a)) | Name, email, review, photos | Until a request for deletion |
| Club 360 (community and loyalty programme), with automatic membership when you buy from us or give us your email (see section 2.6) | Legitimate interest in rewarding people who buy or sign up (Art. 6(1)(f)); you can leave at any time | Name, email, purchases, points, tier and rewards | Duration of membership, then 2 years |
| Advice from our pharmacy graduate and wellbeing guidance sessions by WhatsApp | Consent (Art. 6(1)(a)); for health information, explicit consent (Art. 9(2)(a)) | Name, phone, goals, content of messages | 24 months from the last contact or until consent is withdrawn |
| Sales on marketplaces (Amazon, TikTok Shop) | Performance of the contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) | Identification data, address, order data | 10 years from the order |
| Advertising and campaign measurement (Meta, TikTok, Google, Microsoft) | Consent (Art. 6(1)(a)); for Meta, joint controllership (Art. 26) | Browsing and purchase events, email in hashed form | As set out in the Cookie Policy (for example 90 days Meta, 14 months Google Analytics) |
| Statistics and improvement of the Site (Google Analytics, analytics on the quiz page, A/B tests) | Consent for non-technical cookies (Art. 6(1)(a)); legitimate interest for aggregated data (Art. 6(1)(f)) | Browsing events, test variants | 14 months (Google Analytics); duration of the tests |
| Cookie consent management | Legal obligation (Art. 6(1)(c)) | Preferences, truncated IP, date and time | 13 months |
| Internal economic analysis (margins and costs) | Legitimate interest (Art. 6(1)(f)) | Order data, customer identifier | Same as the source data |
| Recruitment | Pre-contractual steps (Art. 6(1)(b)) | CV, contact data, experience | 12 months from receipt, unless hired |
| Handling requests on data subject rights (Arts. 15-22) | Legal obligation (Art. 6(1)(c)) | Identifiers, content of the request | 5 years from closing |
| Handling personal data breaches | Legal obligation (Arts. 33-34) | Description of the breach, data subjects involved | 5 years |
| Site security and technical logs | Legitimate interest in security (Art. 6(1)(f)) | IP, user agent, URL, date and time | 6 to 12 months |
| Defending our rights in legal proceedings | Legitimate interest (Art. 6(1)(f)) | Data needed for the defence | For the duration of the dispute and until the limitation period expires |
4. Who we share data with
4.1 Providers processing data on our behalf
We use providers that process data on our behalf as processors (Article 28 GDPR), under their data processing terms or appointment agreements. The main ones are:
| Provider | Service | Location and safeguards |
|---|---|---|
| Shopify (Shopify International Ltd., Ireland, and group companies) | Store platform, Site hosting, orders, checkout and card payments (Shopify Payments) | EU, Canada, USA: adequacy decision (Canada), standard contractual clauses |
| Klaviyo, Inc. | Email and SMS, automations, segmentation, results of the "Discover your protocol" quiz | USA: Data Privacy Framework, standard contractual clauses |
| PostHog | Usage analytics on the quiz page, with your consent | EU (hosting in Germany) |
| Loox | Reviews | USA: standard contractual clauses |
| Bubblehouse | Club 360 (community and loyalty) | USA: standard contractual clauses |
| Loop Subscriptions | Subscriptions | USA: standard contractual clauses |
| Store apps for cart, offers, recommendations and QR codes (Rebuy, Kaching, Fly Bundles, AOV.ai, Aftersell, EG Auto Add to Cart, QR Codes Unlimited) | Product recommendations, bundles, discounts, cart and post-purchase offers, QR codes in parcels | EU and third countries: standard contractual clauses |
| Shoplift | A/B testing of pages | USA: standard contractual clauses |
| Pandectes | Cookie consent management | EU and USA: standard contractual clauses |
| WeTracked | Server-side sending of purchase events to Meta | USA: standard contractual clauses |
| Google (Analytics, Ads, Workspace) | Statistics, campaign measurement, work tools | USA: Data Privacy Framework, standard contractual clauses |
| WhatsApp Business (Meta) and connected messaging apps | Order messages, confirmation of cash-on-delivery orders, customer support | USA: Data Privacy Framework, standard contractual clauses |
| Manychat | Automatic replies and sign ups from Instagram and Messenger messages | USA: standard contractual clauses |
| CEDCommerce | Connection between the store and TikTok Shop | India: standard contractual clauses |
| Artificial intelligence and cloud service providers | Virtual assistant, drafting of support replies, internal applications (order management, logistics, economic analysis) | EU and USA: Data Privacy Framework, standard contractual clauses |
| Fly.io, Inc. | Server for the gofor360 app | EU (Frankfurt); USA: Data Privacy Framework |
| Apple Inc. | Delivery of gofor360 app notifications | USA: standard contractual clauses |
| 650 Industries, Inc. (Expo) | gofor360 app updates | USA: standard contractual clauses |
| Novapri S.r.l. | Warehousing, order preparation and returns handling | Italy |
4.2 Parties processing data as independent or joint controllers
- Couriers and shipping services (for example T.W.S. Express Courier, BRT, GLS, InPost, Amazon Shipping), for deliveries and returns.
- Payment providers (for example PayPal and Klarna), for payments made with their services.
- Marketplaces (Amazon, TikTok Shop): for purchases on these platforms the marketplace processes data as controller; we receive the data needed to fulfil the order.
- Meta Platforms Ireland Ltd., joint controller (Article 26 GDPR) for data collected through the pixel and the Conversions API; TikTok, Google and Microsoft (Microsoft Advertising) for their own advertising processing, with your consent.
- Advisers (accountant, payroll consultant, lawyers), banks, insurers and authorities, where necessary or required by law.
- In corporate transactions (for example a sale of shares or a merger), potential buyers and their advisers, only for the data needed and under confidentiality obligations.
5. Transfers outside the European Union
Some providers are based in, or process data in, countries outside the European Economic Area, mainly the United States. In these cases transfers are based on:
- adequacy decisions of the European Commission (for example for Canada and, for certified organisations, for the United States under the EU-U.S. Data Privacy Framework);
- standard contractual clauses approved by the European Commission (Decision 2021/914);
- supplementary measures where needed (encryption, pseudonymisation, access restrictions).
6. Your rights
Under Articles 15-22 GDPR you may request access to your data, rectification, erasure, restriction of processing and portability; you may object to processing based on legitimate interest and to marketing, and not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You may withdraw any consent at any time, without affecting processing carried out before.
To exercise your rights, write to supporto@gofor360.it or to GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy. We reply within 30 days, which may be extended by a further 60 days for complex requests, with reasons. You can also unsubscribe from emails using the link in every message.
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it.
7. Profiling, automated decisions and artificial intelligence
- Quizzes: an algorithm suggests products based on your answers. It is a non-binding purchase suggestion and has no legal or similarly significant effect on you.
- Recommendations on the Site: with your cookie consent we show products based on browsing and purchases. They do not change prices or terms of sale.
- Marketing: with your consent the email platform helps us send you communications in line with your interests. You can unsubscribe at any time.
- Virtual assistant: it is an artificial intelligence system; we tell you so on the page and in this notice (section 2.4).
- Support and internal tools: we use artificial intelligence tools to draft replies, always checked by our staff, and to develop internal applications. We take measures to avoid entering customer data into development tools.
None of these processing activities involves decisions based solely on automated processing within the meaning of Article 22 GDPR. You can object to profiling and ask for information on the logic involved by writing to supporto@gofor360.it.
8. Cookies
The Site uses technical cookies needed for it to work and, only with your consent collected through the banner, analytics and marketing cookies. Consent is given by category and you can change it at any time from the link at the bottom of the pages. Details in the Cookie Policy: www.gofor360.it/pages/cookie-policy.
9. Minors
The Site and the quiz are intended for adults. We do not knowingly collect data of minors; if we find that we have, we delete them.
10. Security
We protect data with technical and organisational measures appropriate to the risk: encrypted connections, personal access to systems, access to data limited to authorised and trained staff, agreements with providers, procedures for handling breaches.
11. Changes
We may update this notice, for example following changes in the law or in the services we use. We publish every change on this page with the date of the update.
GOFOR360 S.r.l., Via Filippo Argelati 10, 20143 Milan (MI), Italy, tax code and VAT number 10816840960, REA MI 2796807