1. Types of data, purposes of processing and retention period
In the course of the activity carried out by the Controller through byonda.it, different data may be collected for different purposes, as follows:
- Browsing data: the site is hosted by Netlify, Inc. Like every web server, the hosting infrastructure processes the IP address, the pages requested, the time of the request and basic browser information, solely to deliver the pages and keep the service secure. This data is not used to identify visitors. Legal basis: the Controller's legitimate interest in running a secure website (Art. 6(1)(f) GDPR). It is retained by the hosting provider for a limited period, stated in its own privacy policy.
- Data collected through the "Request a demo" form: name, practice or yard, email address, type of patients treated, any notes and the language of the page. The form is handled by the Netlify Forms service, which stores the request and forwards it to the Controller by email. The data is used only to the extent necessary to answer the request and arrange the demonstration, and is deleted once the processing is complete, and in any case within 24 months, unless the user becomes a customer. Legal basis: pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR). Requests are screened by a spam filter (Akismet). Providing the data is optional, but without it the request cannot be handled.
- Data collected through Google Analytics 4 (only with your consent): if you accept statistics cookies in the banner, Google Analytics 4 (Google Ireland Ltd) is loaded and records the pages you open, the click on our phone number or email address, the completion of a demo request (without the content of the form), the address of the page, browser and device information, an approximate location derived from a truncated IP address and the
_ga identifiers. Purpose: aggregate statistics on the use of the site. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time from "Cookie settings" in the footer; withdrawal stops the tool from loading on any further page and deletes its cookies. Google processes this data as data processor of the Controller and may transfer it to the United States under the EU-US Data Privacy Framework. Retention in Google Analytics: 14 months. Details in the Cookie policy.
- Data collected through the Meta Pixel (only with your consent): if you accept marketing cookies in the banner, the Meta Pixel of Meta Platforms Ireland Ltd is loaded and sends Meta the pages you open, clicks on our phone number or email address, the completion of a demo request (without the content of the form), the address of the page, browser information, your IP address and the
_fbp cookie identifier. Purpose: measuring the results of our advertising on Facebook and Instagram and showing BYONDA messages to people who have visited the site. Legal basis: consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time from "Cookie settings" in the footer; withdrawal stops the pixel from loading on any further page. If you do not consent, nothing is sent to Meta. Retention on Meta's side is governed by its own privacy policy; the cookie lasts 3 months. Details in the Cookie policy.
- Data for promotional activities and newsletters: the site does not collect newsletter subscriptions. Any promotional communication will be sent only with the data subject's specific and optional consent, which can be withdrawn at any time by writing to the contacts below or by using the link included in each communication, so that the data is immediately removed from the mailing lists.
- Data required for administrative and accounting purposes: should the data subject become a customer, the data collected under the contract is processed exclusively for administrative, accounting and tax purposes; it is strictly necessary to conclude the contract or provide the service, and failure to provide it makes it impossible to obtain the service requested. This data is kept for the whole duration of the relationship and for the period required by accounting and tax law.
- Preferences stored in the browser: the language chosen (EN/IT) and the choices made in the cookie banner are saved only in the local storage of the user's browser and are never transmitted to the Controller or to third parties. This is strictly necessary technical storage, which does not require consent under Article 122 of the Privacy Code. See the Cookie policy for details.
Data is processed by electronic means, with logic strictly related to the purposes stated and with security measures adequate to prevent loss, unlawful use or unauthorised access. The site performs no profiling and no automated decision-making.
2. Recipients
For the purposes listed above, the data collected may be made accessible to:
- employees and collaborators of the Controller in Italy and abroad, as persons authorised to process data, internal data processors or system administrators;
- third-party companies or other entities performing outsourced activities on behalf of the Controller, as external data processors: in particular Netlify, Inc. (website hosting and contact-form handling), Google Ireland Ltd. (Google Workspace email service and, only with the user's consent to statistics cookies, Google Analytics 4), Automattic Inc. (Akismet spam filter), and the Controller's professional advisers and consultants;
- Meta Platforms Ireland Ltd (Meta Pixel, advertising measurement), only if the user has consented to marketing cookies. For the collection and transmission of pixel events Meta and the Controller are joint controllers under Art. 26 GDPR, as set out in the Meta Business Tools terms; for its subsequent processing Meta is an independent controller. Meta may transfer data to the United States under the EU-US Data Privacy Framework;
- judicial authorities and any entity to which disclosure is required by law for the purposes stated. These entities process the data as independent controllers.
Data is not transferred abroad except for the hosting and anti-spam services mentioned above, whose providers are established in the United States and guarantee compliance with European requirements through Standard Contractual Clauses and the further safeguards provided for in Chapter V GDPR. Data is never disclosed to the public or sold to third parties for marketing purposes.
3. Rights of the data subject
Under Chapter III of Regulation (EU) 2016/679 the data subject has the right to:
- request access to their personal data and ask for it to be rectified, erased or its processing restricted;
- know the purposes of processing, the categories of data processed, the recipients to whom the data is disclosed and the retention period;
- withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
- request the erasure, where possible, of data no longer necessary for the purpose for which it was collected;
- obtain the portability of the data provided;
- object to processing based on legitimate interest, to profiling and to direct marketing;
- lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the supervisory authority of their own country;
- know the entities to which personal data may be disclosed.
Requests may be addressed to B&M as follows:
- by registered letter with return receipt to B&M s.r.l. Marketing nel Benessere – Via Leonardo Bruni 25 – 20158 Milan (Italy);
- by email to privacy@baldangroup.it.
The Controller replies within one month of receiving the request.
4. Changes to this notice
This notice may be updated to reflect changes in the law or in the website. The version published on this page, with its update date, is the one in force.
