In compliance with EU Regulation 2016/679 (European Regulation on the protection of personal data), we provide you with the due information regarding the processing of the personal data provided while using our platforms. This notice does not apply to other websites (for example other websites that can be reached through links on the pages of the website and in the APP). Bantoa Srl shall in no way be held responsible for third-party websites.
This notice is drawn up pursuant to arts. 13 and 14 of the GDPR and Italian Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018, and takes into account EDPB Guidelines 05/2020 on consent and the “Guidelines on cookies and other tracking tools” of the Italian Data Protection Authority (Garante per la protezione dei dati personali) of 10 June 2021, referred to in the cookie policy.
Which personal data are processed? What does processing mean? Who is the data subject?
- Personal data
- Any information relating to a data subject that identifies them or makes them identifiable. Through the website, Bantoa Srl collects various personal data, including but not limited to: first name, last name, e-mail address, telephone number, IP address, device identifiers and browsing data.
- Processing
- Any operation or set of operations, performed with or without the aid of automated processes, and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- Data subject
- The identified or identifiable natural person. By way of non-exhaustive example, the data subject is the user who browses the platform and who sends, through it, a request for information.
Who is the Data Controller? How can you contact them?
The Data Controller, pursuant to arts. 4 and 24 of EU Regulation 2016/679, is Bantoa Srl, with registered office in Via Belluno 22/A - 37133 - Verona, Italy, in the person of its pro tempore Legal Representative.
To contact the Data Controller: e-mail [email protected]
Why does Bantoa Srl process your data? What legal basis allows the controller to process it?
Browsing the Bantoa web platform and the “Bantoa” APP to view the contents available without registering to the platform, with the use of profiling cookies and similar technologies as described in the cookie policy.
Art. 6 par. 1 lett. f) GDPR legitimate interest of the data controller. Technical activities aimed at the use of the platform.
Art. 6 par. 1 lett. a) GDPR: for profiling cookies the processing is based on consent to the processing of personal data. The user gives their consent through the cookie banner of the website and/or in the cookie policy.
Providing the data is necessary to browse the data controller’s platform.
For profiling cookies, see the cookie policy in the footer.
Registration on Bantoa: creation of a single account (also through social networks) to register on the Bantoa Srl website and access the “Bantoa” APP. The personal data provided will be used, until you object, to deliver the service the user accesses by registering, i.e. receiving personalised outfits. Personalisation takes place when the profile is created, where you can choose for example the style you are interested in (trendy, chic, ethnic etc.), select the range of the size you wear (e.g. below 44, size 44/46), select the products that characterise your style (e.g. combat boots, heels, earrings) etc.
At this stage you create your own profile (strictly related to the type of service covered by the user registration). The data controller processes your profile and analyses your tastes, characteristics and preferences, in order to improve the commercial offer and the services offered to you. Following this analysis you will receive every week an e-mail containing the outfit that best suits you based on the tastes and preferences you have shown. The outfits will be branded and by clicking on the brand you will access the partner’s platform where you can buy the products you like.
During registration the data controller verifies the identity of the user requesting the creation of the account through the e-mail address entered in the registration form, to which you will receive the link to access Bantoa again and continue creating your profile.
The outfits you create and publish, together with your profile name and picture, are visible to the other users of the platform.
If you use the APP and allow it in your device settings, you will receive push notifications about the service; you can disable them at any time from the same settings.
For registration via social networks (Google, Apple, Facebook): Social Login is a technology that allows the user to share automatically some personal data entered in a social network with the operator of a website. E.g. the user can use this technology to register quickly on a website/APP. In short, subject to the user’s authorisation, the social network will send the website operator the personal data needed to register on the website without the user having to enter the requested data manually.
Art. 6 par. 1 lett. f) GDPR legitimate interest of the data controller.
The processing is based on the legitimate interest of the controller who, in order to allow you to use Bantoa’s primary and main service, needs to create a profile of your tastes, characteristics and preferences, without which you could not use the service Bantoa was created for, a service delivered upon user registration.
Providing the data is necessary for registration. Failure to provide it will not allow you to register to the platform and to use Bantoa’s main service, i.e. receiving personalised outfits made exclusively for you.
Marketing sent by Bantoa on behalf of third parties (without transfer of personal data): e-mails concerning generic discounts available on the websites of third parties, commercial partners of Bantoa in the fashion, clothing and accessories sectors, and e-mails concerning the completion of your “pending” purchase on the third party’s platform. List of commercial partners available on request at [email protected]
Art. 6 par. 1 lett. a) GDPR
Consent of the data subject
Providing the data for this purpose is optional. If you do not provide it you will still be able to use the service under purpose A) and purpose B) (if you have registered).
Subject to consent and until you object, transfer of data to third parties for marketing purposes, market research or other sample surveys and direct sales, to receive information material, for customer satisfaction surveys, promotional, commercial and advertising material or material relating to events and initiatives.
The third parties are commercial Partners of Bantoa Srl operating in the following product sectors: fashion, clothing, to which the data will be transferred. The complete list of product sectors and of the parties to which the data will be transferred is always available on request at [email protected]
Please note: without first obtaining the consent of the data subject, personal data will not be used for the purposes under point C). To request the privacy notice pursuant to art. 14 GDPR, as well as to exercise the data subject’s rights (arts. 15 to 22 GDPR) for the subsequent processing of data by the third parties to Bantoa Srl - commercial Partners - the data subject must contact the third party itself - an independent controller - that will send the promotional communications.
Art. 6 par. 1 lett. a) GDPR
Consent of the data subject
Providing the data for this purpose is optional. If you do not provide it you will still be able to use the service under purpose A), purpose B) (if you have registered) and purpose C) (if you have given your consent).
Replying to the requests for information you send by filling in the “contacts” form.
Art. 6 par. 1 lett. b) pre-contractual measure – reply to the request for information sent by the user.
Providing the data for purpose E) is necessary. Otherwise the data controller will not receive your request for information and will not be able to reply to it.
When you click on a product on Bantoa you are redirected to the website of the partner brand. In order to recognise the purchases generated by Bantoa and calculate the commissions owed by the partner, the controller records the click (date, product, click identifier, IP address, device identifier and, if you are logged in, your account) and receives from the partner, or from the affiliate network, the purchase data: order identifier, amount and, in some cases, the e-mail address in encrypted form (hash).
Art. 6 par. 1 lett. f) GDPR legitimate interest of the data controller in receiving the fee for the service provided to partners.
The processing is connected to the use of links to partner websites. You can object at any time by writing to [email protected].
Protecting the platform against unauthorised access, spam and fraud (also through Google reCAPTCHA on the contact form) and detecting and fixing technical errors.
Art. 6 par. 1 lett. f) GDPR legitimate interest of the data controller in the security and proper functioning of the platform.
The processing is necessary to use the platform securely.
The Bantoa CRM
The data will be entered in the company CRM. In order to compare and possibly improve the results of its communications, the Controller uses systems for sending newsletters and promotional communications with reports. Thanks to the reports the Controller may know, for example:
- the number of readers, opens, unique “clickers” and clicks;
- the devices and operating systems used to read the communication;
- the details of the activity of individual users;
- the details of the e-mails sent, delivered and not delivered, and forwarded.
All these data are used for the purpose of comparing, and possibly improving, the results of the communications.
To whom will the personal data collected be disclosed?
The personal data provided will be disclosed to recipients who will process it as processors (art. 28 of EU Regulation 2016/679) or as natural persons acting under the authority of the Controller and of the Processor (art. 29 of EU Regulation 2016/679), for the purposes listed above.
Specifically, the data will be disclosed to:
- parties providing services for the management of the information system used by Bantoa Srl and of telecommunication networks (including e-mail);
- parties supporting the data controller in the management of web platforms, including providers of cloud and hosting services, e-mail delivery, content delivery (CDN), error monitoring and statistical analysis;
- partner brands and affiliate networks, limited to the data needed to attribute purchases (purpose F);
- parties instructed pursuant to art. 29 GDPR who create the outfits or send the newsletters, or internal functions in general operating under the control of the data controller;
- firms or companies within the scope of assistance and consulting relationships;
- competent authorities for the fulfilment of legal obligations and/or provisions of public bodies, upon request;
- where the user has consented to the transfer of data to third parties, the data will be transferred to Bantoa Srl partners, as described above.
The list of Data Processors is constantly updated and available on request at [email protected]. Personal data are not disseminated, except for the content you publish on your public profile (purpose B).
Transfer of data outside the European Union
Bantoa Srl is a company with registered and operational offices in Italy. The data collected by the data controller are stored in a data center located in Bolzano and in the Amazon Cloud located in Ireland.
Some providers used by the controller (for example for statistical analysis, advertising, e-mail delivery and error monitoring) belong to groups based in the United States, to which data may be transferred. Such transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), for the providers that adhere to it, or alternatively of the standard contractual clauses approved by the European Commission (art. 46 GDPR). You can request information on the safeguards adopted by writing to [email protected].
How long are the data kept?
The processing will be carried out by automated and/or manual means, with methods and tools aimed at ensuring maximum security and confidentiality, by persons specifically instructed for this purpose.
In compliance with art. 5 par. 1 lett. e) of EU Regulation 2016/679, the personal data collected will be kept in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- Browsing data
- With regard to browsing data, the browsing data tracked for technical purposes and relating to the proper functioning of the platform are kept for the duration of the browsing session. The data collected through profiling cookies (subject to the user’s consent) will be kept as explained in the cookie policy. You retain the right to withdraw your consent by disabling the cookies you enabled when landing on the platform.
- Registration and use of the service
- With regard to registration data, Bantoa Srl keeps the data relating to the user’s account until a request to unsubscribe from the platform. If the account is inactive for more than 3 months, you will not receive the profiled newsletters containing the outfits. If the account is inactive for 2 years, the account will be removed and you will need to register again.
- Contact requests
- The data provided by filling in the contact form will be kept until the request for information has been handled and, for more complex requests, for a maximum of 1 year.
- Purposes C) and D) - Third-party marketing and transfer of data to third parties
- The data controller will keep the data until the consent given is withdrawn.
- Attribution of purchases (purpose F)
- The data are kept for the time needed to verify and settle commissions with partners; data included in accounting records are kept for the period required by tax law.
- Platform security (purpose G)
- The data are kept for the time strictly necessary to identify and solve the problem, unless they need to be kept longer to establish, exercise or defend a legal claim.
Profiling and automated decisions
The profiling described in purpose B) is used exclusively to suggest outfits and products that match your tastes. The controller does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR).
Minors
The platform is not intended for children under 14. Pursuant to art. 8 GDPR and art. 2-quinquies of the Italian Privacy Code, consent to the processing of data in relation to information society services can only be given by persons aged 14 or over. If the controller becomes aware of data collected from a child under 14, it will delete them.
What are your rights? How can you exercise them?
You may exercise your rights as set out in arts. 15 et seq. of the GDPR by contacting the Controller. The Controller can be contacted at [email protected].
You have the right, at any time, to ask the Data Controller for access to your personal data, rectification, erasure or restriction of processing. You also have the right to object, at any time, to the processing of your data based on the legitimate interest of the Controller, including profiling (art. 21 GDPR), as well as the right to data portability.
Where the processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal (art. 7 par. 3 GDPR). The Controller replies to requests within one month of receipt, extendable by two months for more complex cases (art. 12 GDPR).
Without prejudice to any other administrative or judicial remedy, if you believe that the processing of data concerning you infringes EU Regulation 2016/679, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to art. 77 GDPR, as explained on www.garanteprivacy.it.
In the case of a request for data portability, the Data Controller will provide you with the personal data concerning you in a structured, commonly used and machine-readable format, without prejudice to paragraphs 3 and 4 of art. 20 of EU Regulation 2016/679.
Withdrawing marketing consent
To stop receiving marketing communications sent by Bantoa Srl on behalf of third parties (purpose C), simply send an e-mail at any time to [email protected] with the subject “cancellazione da automatizzato” (removal from automated mailing) or use our automatic unsubscribe systems available for e-mails only. To withdraw consent for purpose D) you can write to [email protected]. For the marketing of third-party partners, you can consult their art. 14 notice to exercise your rights.
Deleting your account
The profile and all the data linked to it can also be deleted through the dedicated function in the user profile menu. The function is available in the settings menu under “Delete account”.
Further information
The controller reserves the right to modify, update, add or remove parts of this privacy notice at its discretion and at any time. To make it easier to check for changes, the notice will show the date of the last update. In the event of substantial changes, registered users will be informed.
Last update: 26 October 2026
