Privacy Policy
Last updated: 25/09/2026
This policy describes how Bongiovanni SRL (“we”, “Controller”) collects, uses and protects the personal data of users of tibiona.it and its international domains, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable national legislation.
1. Data Controller
Bongiovanni SRL
Via Case Molino di Pogliola
12089 Villanova Mondovì (CN) – Italy
VAT / Tax ID: 00602720047
E-mail: [email protected]
Website: bongionatura.it
2. Personal data collected
We collect the following categories of data:
- Identification and contact data: name, surname, e-mail address, phone number, shipping and billing address.
- Tax data: tax identification number, VAT number, SDI/PEC code (where provided).
- Order data: products purchased, amounts, payment method (we do not store full card details), order history.
- Account data: login credentials, preferences, wish list.
- Browsing data: IP address, browser type, pages visited, access times, data collected via cookies (see Cookie section).
- Communication data: messages sent via contact form, chat or e-mail.
3. Purposes and legal bases
3.1 Performance of a contract – Art. 6(1)(b) GDPR
We process your data to:
- manage account registration and authentication;
- process and ship orders;
- manage payments, returns and refunds;
- provide customer support.
3.2 Legal obligation – Art. 6(1)(c) GDPR
We retain data required to comply with tax, accounting and regulatory obligations (invoicing, record-keeping, anti-fraud).
3.3 Legitimate interest – Art. 6(1)(f) GDPR
We process your data based on our legitimate interest for:
- website and service analysis and improvement;
- fraud and abuse prevention;
- direct marketing communications to existing customers (see section 4).
3.4 Consent – Art. 6(1)(a) GDPR
We request your explicit consent for:
- newsletter subscription for users who are not yet customers;
- use of non-essential cookies (analytics, marketing, functional).
Consent may be withdrawn at any time (see section 8).
4. Direct marketing and “soft opt-in”
If you have made a purchase or created an account on our website, we may send you commercial communications about similar products or services without requiring separate prior consent.
This practice complies with:
- Art. 6(1)(f) GDPR – the Controller’s legitimate interest in maintaining the business relationship with existing customers;
- Art. 13(2) of Directive 2002/58/EC (ePrivacy Directive), transposed into Italian law by Art. 130(4) of Legislative Decree 196/2003 (Privacy Code), which allows promotional e-mails to those who provided their contact details in the context of a sale, provided that:
- the communications concern similar products or services;
- the data subject is informed and has not objected;
- a simple and free opt-out mechanism is always available.
This mechanism is commonly known as “soft opt-in”: acceptance of the privacy policy and completion of a purchase or registration form the basis for sending these communications.
You always have the right to object to marketing communications at any time by clicking the “Unsubscribe” link in every e-mail or by writing to [email protected]. Your request will be processed without delay and at no cost.
Open tracking (1×1 pixel). Our informational and promotional e-mails may contain an open pixel: it tells us whether and when a message is opened, plus other delivery statistics. The processing is based on your consent (Art. 6(1)(a) GDPR) and/or on the Controller's legitimate interest in verifying delivery (Art. 6(1)(f) GDPR). You can object at any time by writing to [email protected] or by using the unsubscribe link in every e-mail.
5. Recipients and data sharing
Your personal data may be shared with:
- Payment service providers (PayPal, Amazon Pay, card processors) for transaction processing;
- Couriers and shipping companies (BRT, GLS and others) for order delivery;
- E-mail marketing platforms for sending newsletters and commercial communications;
- IT and hosting providers for technical website management;
- Analytics services (Google Analytics) in anonymised/pseudonymised form;
- Competent authorities where required by law.
All entities processing data on our behalf are appointed as Data Processors pursuant to Art. 28 GDPR and provide adequate safeguards.
6. International data transfers
Some of our service providers (e.g. cloud platforms, analytics, payment services) may process data outside the European Economic Area. In such cases, transfers are based on European Commission adequacy decisions, Standard Contractual Clauses (SCCs) or other safeguards under Arts. 46–49 GDPR.
7. Data retention
| Data category | Retention period |
|---|---|
| Account data | Until account deletion by user or upon request |
| Order and billing data | 10 years from transaction (tax obligation) |
| Direct marketing data (soft opt-in) | Until objection or 24 months from last purchase, unless the relationship is renewed |
| Newsletter data (consent) | Until consent withdrawal |
| Browsing / cookie data | As indicated in the Cookie Policy |
| Contact form data | 12 months from request, unless further retention is necessary |
8. Your rights
Under Arts. 15–22 GDPR, you have the right to:
- Access – obtain confirmation of processing and a copy of your data;
- Rectification – correct inaccurate or incomplete data;
- Erasure – request deletion of your data, within legal limits;
- Restriction – restrict processing in certain circumstances;
- Portability – receive your data in a structured, machine-readable format;
- Objection – object to processing based on legitimate interest, including direct marketing;
- Withdraw consent – withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, write to [email protected].
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).
9. Cookies
This website uses technical, analytical and marketing cookies. For detailed information about the cookies used, how they are managed and your consent options, please refer to the cookie banner and the “Cookie Settings” panel available on every page.
10. Changes to this policy
We may update this policy to reflect regulatory changes or new processing activities. The updated version will always be available on this page with the date of last update.
The Data Controller
Bongiovanni SRL
