Privacy notice

Applicable from: September 2026.

1. Introduction

This notice explains how Moovet DXC S.r.l. processes the personal data of people who use CuorEasy, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code).

It covers all CuorEasy services:

• the cuoreasy.it website and the eligibility questionnaire;
• purchase of the kit, including directly from Moovet on the cuoreasy.it online shop, by email or at events and fairs;
• kit activation, sample analysis and delivery of the report;
• CuorEasy days at partner stores and the related bookings;
• service communications, follow-up contact and marketing communications.

The service is intended for adult dog owners. Your dog's data (name, breed, age, weight, reported symptoms) are not personal data in themselves, but they become personal data when linked to you. For this reason we protect them in the same way.

2. Data controller

The controller is Moovet DXC S.r.l., operational headquarters and laboratory at Via dell'Università 6, 26900 Lodi (LO), Italy. Tax code and VAT no. 14348290967, REA MI-2776442. Registered office: Via Brisa 3, 20123 Milan.

• Privacy matters: privacy@moovet.eu
• Service support: help@moovet.eu
• Data Protection Officer (DPO): privacy@moovet.eu

3. What data we process

We only collect the data needed for the service you are using. No data is collected from public sources or bought from third parties.

We do not process special categories of data (Art. 9 GDPR): the health information we collect concerns the dog, not you. Please do not enter information about your own health, or anyone else's, in free-text fields.

4. Why we process data and on what legal basis

Each purpose has its own legal basis. Where the basis is consent, providing data is optional, and refusing has no effect on the service.

For purposes based on legitimate interest, we have checked that your rights do not override Moovet's interest. You may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

5. Direct sale and kit shipping

Besides partner stores, you can buy CuorEasy directly from Moovet:

• on the cuoreasy.it online shop;
• by writing to us by email;
• at our stand during events and fairs, where you can take the swab on site or have the kit shipped home.

In these cases Moovet is the seller and processes the data needed to conclude and perform the contract.

• Order: first and last name, email, phone, shipping address, product purchased, amount and date.
• Payment: handled through SumUp, which acts as an independent controller for payment operations. Moovet does not know or store your full card details.
• Shipping: name, address and phone are passed to the appointed courier (for example FedEx or GLS) to deliver the kit and collect the sample.
• Event Pass: links the questionnaire you completed to your purchase at the stand, so you do not have to re-enter your data.
• Tax documents: kept for 10 years, as required by Art. 2220 of the Italian Civil Code.

6. CuorEasy days at stores

Moovet organises days when CuorEasy staff are present at a partner store. You can book a time slot from the dedicated page for the day. You can also reach that page through the store's own channels, for example the chain's loyalty programme or a QR poster in store.

• Data: first and last name, email, phone and dog's name if provided, chosen date, time and store, and the channel the booking comes from.
• Use: confirming the booking, sending you a reminder the day before, letting you cancel with the personal link in the email, and welcoming you in store.
• The store receives your name, your dog's name and the time slot, only to organise the day and welcome you. For this activity the store acts as a processor on behalf of Moovet (Art. 28 GDPR), under a written agreement with the chain. It may use the data only for the day, not for its own purposes.
• The chain does not pass us its customers' data. If you arrive through one of its channels, you provide the data yourself when booking. Loyalty programme data remain governed by the chain's own privacy notice.
• No obligation: booking does not commit you to buy and does not trigger marketing communications. These require the consent described in § 7.

The legal basis is pre-contractual steps taken at your request (Art. 6.1.b). The privacy checkbox on the form confirms that you have read this notice: it is not consent.

7. Follow-up contact and marketing communications

We contact you for two different reasons, which follow different rules.

Service communications. You always receive these, because they are needed for the service you requested: the questionnaire result, activation confirmation, return reminder, sample received, report ready, sample not analysable, booking confirmation and reminder, and support replies.

Marketing communications and promotional follow-up. You receive these only in the cases allowed by law:

• with your consent, which is optional and separate. You can give it in the questionnaire, at the stand or in the booking form. It covers offers, invitations to store days, follow-up after an event to complete your purchase, reminders to repeat the screening and CuorEasy news, by email, SMS, WhatsApp or phone, according to the channels you chose;
• without consent, only by email and only if you have already bought CuorEasy, for products and services similar to those purchased (Art. 130(4) Privacy Code). We remind you of this in every email, and you may object at any time.

You can withdraw consent or object free of charge at any time: with the link in every email, by replying STOP to an SMS or message, or by writing to privacy@moovet.eu. Withdrawal does not make earlier processing unlawful.

We do not use your data to profile you for marketing, and we do not pass it to third parties for their own marketing.

8. Events, photos and content

During events and store days we may take photos or short videos, mostly of dogs.

• We publish images in which a person is recognisable on the website and social media only with that person's consent.
• For minors, consent from whoever holds parental responsibility is required.
• If you share content mentioning CuorEasy or Moovet, we repost it only after asking you.
• You may ask us at any time to remove content concerning you. We do so on the channels we control.

9. The dog's sample and the report

The dog's saliva sample is analysed at the Moovet laboratory in Lodi. It is identified only by the kit code: the person performing the analysis does not know your name. The link between code and owner is kept in the CuorEasy platform, with access restricted to authorised staff.

• The report is sent to you by email and can be viewed with a personal link. We do not send it to your vet or to the store: you decide whether to share it, and with whom.
• The store where you return the kit records only the code and the drop-off date. It does not see the report.
• Residual samples are kept after analysis, identified only by the kit code. They may be used for scientific research on mitral valve disease (MMVD) and to improve the method. Results are processed and published only in aggregated, anonymous form, with no reference to you. You may object by writing to privacy@moovet.eu: we will then exclude your dog's sample and data from research.
• Analytical data and information about the dog (breed, age, weight, reported symptoms) may be used in pseudonymised form for the same research, with only aggregated results (§ 4, purpose k).

10. Who we share data with

Data is not made public. We share it only with those who need it for the purposes in § 4.

When you buy CuorEasy at a store, the sale data and any loyalty programme data are processed by the store as an independent controller, under its own privacy notice: Moovet does not receive them.

An up-to-date list of processors is available on request at privacy@moovet.eu.

11. Transfers outside the European Economic Area

Service data (database, CuorEasy platform and email delivery) is stored on servers located in the European Union.

A transfer outside the European Economic Area can occur only for Google's statistics services, which run only if you accept cookies. In that case the recipient participates in the EU-US Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023. Standard Contractual Clauses are also in place as an additional safeguard (Art. 46 GDPR).

Couriers and the payment service, acting as independent controllers, process data under their own privacy notices. You can request a copy of the safeguards adopted by writing to privacy@moovet.eu.

12. How long we keep data

At the end of the period, data is deleted or anonymised. We keep it longer only if it is needed to defend a legal claim, and only for as long as strictly necessary.

13. Your rights

You may exercise the rights under Articles 15-22 GDPR at any time and free of charge, by writing to privacy@moovet.eu:

• access to your data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure, when the data is no longer needed or there is no legal basis;
• restriction of processing;
• portability of the data you provided, in a machine-readable format;
• objection to processing based on legitimate interest and, with no reason needed, to marketing communications;
• withdrawal of consent, without affecting earlier processing.

We reply within one month. In complex cases this can be extended by two months, and we will let you know. We may ask for information to verify your identity.

If you believe the processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of the country where you live or work.

14. Minors, questionnaire logic and security

Minors. CuorEasy services are reserved for adults. We do not knowingly collect data of people under 18; if we become aware of it, we delete it.

Questionnaire logic. The questionnaire applies predefined rules on breed, age, weight and reported symptoms to tell you whether the test suits your dog. It is guidance only. It is not a clinical assessment, nor a decision producing legal or similarly significant effects on you (Art. 22 GDPR). If you have any doubt, you can write to us and speak to a person.

Security. We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR): encrypted communications, restricted and logged access, personal links and temporary access for reports and stores, attempt limits to prevent abuse, and pseudonymised IP addresses. In the event of a data breach we follow the notification procedures of Articles 33 and 34 GDPR.

15. Cookies, changes and contacts

Cookies. The use of cookies and similar tools is described in the Cookie Policy at cuoreasy.it/cookie. You can change your preferences at any time.

Changes. We update this notice when services or laws change. The date of the last update is shown at the top. In case of substantial changes, we notify by email anyone who has an ongoing relationship with us.

Contacts. Privacy: privacy@moovet.eu · Support: help@moovet.eu · Moovet DXC S.r.l., Via dell'Università 6, 26900 Lodi (LO), Italy.