This notice summarises how we process data when you register to the Bantoa website and APP. The letters in brackets (for example “purpose B”) refer to the purposes described in the General Privacy Policy, which contains all the details and is an integral part of this notice.
Data controller
Bantoa Srl, with registered office in Via Belluno 22/A - 37133 - Verona, Italy, in the person of its pro tempore Legal Representative.
To contact the Data Controller: e-mail [email protected]
Which data we process
- account data: first name, last name, e-mail address, password (stored in encrypted form), language and country;
- if you register with Google, Apple or Facebook: the data you allow the social network to share (for example name, e-mail, profile picture and, if you allow it, date or year of birth);
- style profile data: gender, preferred style, size and physical characteristics you choose to provide, favourite products and brands;
- content you publish (outfits, profile name and picture) and activity on the platform (outfits and products viewed, saved and clicked);
- if you use the APP: device identifier for push notifications and permission status.
Why we process the data and on what legal basis
- Creating and managing the account, personalised outfits and service communications (purpose B)
- Art. 6 par. 1 lett. f) GDPR: legitimate interest of the controller in providing the service Bantoa was created for, suggesting outfits that match your tastes, which requires creating a profile of your tastes and preferences. Providing the data is necessary to register. You can object to profiling at any time (art. 21 GDPR) and choose which e-mails to receive from the edit profile page.
- Marketing sent by Bantoa on behalf of partner brands (purpose C)
- Art. 6 par. 1 lett. a) GDPR: consent, optional and revocable at any time without consequences on the use of the service.
- Transfer of data to third parties for their marketing purposes (purpose D)
- Art. 6 par. 1 lett. a) GDPR: specific consent, optional and revocable at any time.
- Attribution of purchases on partner websites (purpose F) and platform security (purpose G)
- Art. 6 par. 1 lett. f) GDPR: legitimate interest of the controller, as described in the General Privacy Policy.
To whom we disclose the data
To authorised persons acting under the authority of the controller, to the providers supporting it (cloud and hosting services, e-mail and notification delivery, error monitoring, statistical analysis), appointed as processors, and to partner brands and affiliate networks within the limits set out in the General Privacy Policy. The content you publish on your profile is visible to other users.
Transfer of data outside the European Union
Some providers belong to groups based in the United States. Transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework) or of the standard contractual clauses approved by the European Commission (art. 46 GDPR).
How long we keep the data
Until the account is deleted, which you can do at any time from the settings menu under “Delete account”, or until 2 years of inactivity. Data processed on the basis of consent are kept until consent is withdrawn. Legal retention obligations remain unaffected.
Minors
Registration is reserved to persons aged 14 or over (art. 8 GDPR and art. 2-quinquies of Italian Legislative Decree 196/2003).
Your rights
You can exercise at any time the rights provided by arts. 15-22 GDPR (access, rectification, erasure, restriction, portability, objection) and withdraw the consents given by writing to [email protected]; withdrawal does not affect the lawfulness of processing carried out before it. The controller replies within one month of receipt of the request. You also have the right to lodge a complaint with the Italian Data Protection Authority (art. 77 GDPR, www.garanteprivacy.it).
Last update: 26 October 2026
