GENERAL WEBSITE PRIVACY POLICY AND TECHNICAL COOKIES
EU Reg. 2016/679
PURSUANT TO ARTICLES 12, 13, AND 14 OF REGULATION (EU) 2016/679
This policy describes how we process the personal data of users who visit the website https://ilbotoxbar.it
This privacy policy applies exclusively to the processing of personal data carried out while browsing and using our institutional website and the general contact forms provided on the site. This policy does not fully cover the use of cookies and other tracking tools, for which a separate Cookie Policy is available via the dedicated panel on the site. The site may use technical cookies and, subject to user consent, non-technical cookies and tracking tools, including those from third parties, for statistical, marketing, remarketing, campaign measurement, and embedded content management purposes.
This privacy notice does not cover processing related to the online booking system and the newsletter/promotional communications service, for which specific privacy notices are provided in the relevant sections or prior to data submission.
In accordance with the provisions of Regulation (EU) 2016/679 (hereinafter "GDPR"), Italian harmonization legislation, and the measures adopted by the Data Protection Authority (collectively, the "Privacy Regulations"), BTX Care s.r.l., with registered office in Rome, Via Sicilia, 50-52-54, VAT No. 16938431000, informs you of the following:
1. DATA CONTROLLER
The Data Controller is BTX Care s.r.l., with registered office in Rome, Via Sicilia, 50-52-54 (hereinafter "Data Controller").
Any request regarding the Data processed by the Data Controller may be sent to the following contact details: Email: privacy@ilbotoxbar.it
2. SOURCE AND TYPE OF DATA PROCESSED
The processing carried out by the Data Controller will concern the following types of personal data (hereinafter, the "Data"):
1. Browsing data. The computer systems and software procedures used to operate this site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category includes, for example: IP addresses, domain names of devices used by users, URI/URL addresses of requested resources, the time and date of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response, and parameters related to the user's operating system and computing environment.
This data is not collected to be associated with identified data subjects, but could allow for user identification through processing and association with data held by third parties.
2. Data provided voluntarily by the user. The optional, explicit, and voluntary sending of communications to the addresses indicated on the site or the completion of any general contact forms involves the acquisition of personal data provided by the user (e.g., name, surname, email address, phone number, message content, and any other personal data spontaneously provided by the user).
Users are advised not to include special categories of data as defined by Article 9 of the GDPR in general contact forms, such as health-related data, unless expressly requested within dedicated channels accompanied by a specific privacy notice.
3. Data collected via cookies. Cookies are small text files that visited sites send to the user's device, where they are stored to be retransmitted to the same sites upon the next visit. Similar tools, even those other than cookies, may allow for similar processing, including device identification or the collection of information on user interactions with the site.
3.a. Technical cookies. The site uses technical cookies, which are necessary for the site to function correctly and to provide the service requested by the user. For these cookies, pursuant to Article 122 of the Privacy Code and the Guidelines on cookies and other tracking tools issued by the Data Protection Authority (July 9, 2021), user consent is not required, although this notice remains mandatory.
3.b. Non-technical cookies and tracking tools. The site uses non-technical cookies and other tracking tools, including those from third parties, such as analytics tools not equivalent to technical ones, marketing and remarketing pixels, advertising campaign measurement tools, and embedded content from third-party platforms. These tools are activated only with the user's prior consent, expressed via the appropriate banner or preference management panel, and can be modified or withdrawn at any time.
For detailed information on the types of cookies used, third-party providers, purposes, individual cookie durations, potential data transfers to third countries, and how to manage or withdraw consent, please refer to the separate Cookie Policy, which can be accessed via the dedicated panel on the site.
3. PURPOSES
Data is collected and processed in compliance with Privacy Regulations for the following purposes:
1. Enable site navigation and the use of published content.
2. Ensure site security, prevent unauthorized access, fraud, abuse, or illicit activities.
3. Respond to requests sent by the user via email, contact details published on the site, or general contact forms.
4. Manage any administrative, accounting, tax, or legal obligations related to the requests received.
5. Establish, exercise, or defend a right in judicial or extrajudicial proceedings.
6. Enable the use of technical cookies and tools strictly necessary for browsing and, subject to the user's consent, the use of non-technical cookies and tracking tools for statistical, marketing, remarketing, advertising campaign measurement, and management of content embedded from third-party platforms, as better described in the Cookie Policy.
4. PROCESSING METHODS AND RETENTION PERIOD
Personal data will be processed with the support of paper, electronic, telematic, or otherwise automated means, suitable for storing, managing, and transmitting the data in compliance with Privacy Regulations and, in particular, the provisions of Art. 32 of the GDPR, through the adoption of technical and organizational measures appropriate to the risk of processing, including with regard to security and confidentiality.
Personal data will be processed by personnel, collaborators, and subjects authorized by the Data Controller, within the limits of their respective duties and according to the instructions received.
Data will be stored by the Data Controller for the period strictly necessary to pursue the purposes listed in point 3 and subsequently within the limits of the law. For data processed via cookies and other tracking tools, including the storage of user-expressed preferences and the duration of individual cookies, please refer to the specific Cookie Policy.
In particular, browsing data and technical logs are kept for the time necessary to ensure the functioning and security of the site and, as a rule, for no more than 6 months, unless further retention is required for the investigation of illegal activities or the protection of the Data Controller's rights; data sent via contact forms and spontaneous communications are kept for the time necessary to manage the request and, in any case, no longer than 12 months from the closure of the request, unless a relationship is established or legal obligations/protection apply; data processed for legal obligations are kept for the period provided by applicable regulations, and data processed for the protection of the Data Controller's rights are kept for the time necessary to manage the dispute and until the applicable limitation periods expire.
5. LEGAL BASIS FOR PROCESSING AND MANDATORY OR OPTIONAL NATURE OF PROVISION
The provision of browsing data is necessary to enable the technical functioning of the website and its consultation.
Providing the data requested in general contact forms or communicated spontaneously by the user is optional. However, failure to provide necessary data may prevent the Data Controller from responding to the request received.
The provision of any additional, non-essential data is left to the user's discretion. The Data Controller asks users not to transmit information that is not relevant to the request being made.
Processing for the purposes illustrated in paragraph 3 above will be carried out in accordance with the provisions of Art. 6(1)(b), (c), and (f) of the GDPR.
Processing carried out via non-technical cookies and tracking tools occurs exclusively with the user's prior consent, pursuant to Art. 6(1)(a) of the GDPR, collected via the appropriate banner or cookie preference management panel. Users may modify or revoke their consent at any time according to the procedures indicated in the Cookie Policy.
6. DATA ACCESS AND COMMUNICATION
Your personal data may be accessed by:
1. personnel and/or delegates authorized to process data and responsible for the management and maintenance of electronic tools, the website, and/or system administrators.
2. hosting service providers;
3. IT and security service providers;
4. subjects who typically act as data processors (e.g., professionals and/or companies that the Data Controller uses in the context of outsourcing for the provision of services and/or performance);
5. subjects, entities, or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders from authorities;
6. persons authorized by the Data Controller to process Personal Data necessary to perform activities strictly related to the provision of the Services;
7. public health institutions and bodies or affiliated entities;
Your data may also be processed by external parties, formally appointed by the Data Controller as Data Processors, due to existing service relationships.
With regard to third-party cookies and tracking tools, data may also be processed by the providers indicated in the Cookie Policy, who may act, depending on the case, as independent controllers, joint controllers, or data processors according to their respective policies and terms of service. For transfers potentially related to cookies, pixels, analytics tools, marketing, or embedded content provided by third parties, please also refer to the Cookie Policy and the policies of the respective providers.
The parties to whom the data may be communicated as mentioned above may act as independent Data Controllers or may perform processing activities on behalf of the Data Controller, being appointed as Data Processors for this purpose pursuant to Article 28 of the GDPR.
The updated list of Data Processors is available at the Data Controller's office, and you may obtain a copy by requesting it via the contact details provided below.
7. DISSEMINATION AND INTERNATIONAL TRANSFER. Your personal data will not be disseminated. Given the existence of electronic, IT, or correspondence links, for the purposes referred to in point 3, data may also be transferred abroad, within the European Union. In the event of a transfer to non-EU countries, the Data Controller ensures that such transfer will take place in compliance with applicable legal provisions by entering into, if necessary, agreements that guarantee an adequate level of protection and/or by adopting the standard contractual clauses provided by the European Commission.
8. AUTOMATED DECISION-MAKING PROCESSES
Within the scope of the processing governed by this policy, the Data Controller does not use automated decision-making processes, including profiling, pursuant to Article 22 of the GDPR.
9. LINKS TO THIRD-PARTY SITES, PLATFORMS, OR SERVICES
The site may contain links to third-party sites, platforms, or services.
The Data Controller is not responsible for the processing of personal data carried out by such third parties. Users are encouraged to consult the respective privacy policies before providing personal data through such sites, platforms, or services.
10. DATA SUBJECT RIGHTS
You have the right to ask the Data Controller, at any time, for access to your data, their rectification, or
the deletion of the same, or to request the restriction of processing, or to obtain your data in a structured, commonly used, and machine-readable format in the cases provided for by Article 20 of the Regulation. You also have the right to object, pursuant to Article 21 of the Regulation, to the processing of your data for legitimate reasons.
Requests must be addressed in writing to the Data Controller BTX Care s.r.l., with registered office in Rome, via Sicilia, 50-52-54, VAT no. 16938431000, via email to privacy@ilbotxbar.it
In any case, you always have the right to lodge a complaint with the competent supervisory authority.
(Data Protection Authority), pursuant to Article 77 of the Regulation, if you believe that the processing is contrary to applicable law.