PRIVACY POLICY

Società Agricola BioXFarm S.r.l.s.
Contrada Ciuranà, 88812 Crucoli (KR), Italia

VAT number: 03832410793
REA number: KR – 186392

Email: info@bioxfarm.com
Phone: +39 0962 34 034

In this document, Società Agricola BioXFarm S.r.l.s. is also referred to as the “Controller”.

BioXFarm.com may collect, on its own or through third-party providers, the following categories of Personal Data:

• first and last name;
• email address;
• phone number;
• billing and shipping address;
• tax code or VAT number, when necessary;
• account information;
• data relating to the cart, orders and purchases;
• payment status information;
• data relating to shipments, refunds, cancellations and returns;
• data provided through contact forms;
• communications sent to the Controller;
• IP address;
• Usage Data;
• information about the device, browser and operating system;
• language and approximate geographic location;
• technical, diagnostic and security logs;
• online identifiers;
• Client ID;
• traffic source;
• page views;
• data relating to sessions and page interactions;
• events relating to products, cart, checkout, purchases and conversions;
• information on campaigns and advertisements viewed or selected;
• Cookies and other Tracking Tools, as specified in the Cookie Policy.

Personal Data may be provided voluntarily by the User or collected automatically while using BioXFarm.com.

When certain Data is indicated as mandatory, failure to provide it could prevent the Controller from providing the requested service, responding to a communication, creating an account, completing a purchase, or delivering the products.

The User is responsible for any third-party Personal Data communicated through BioXFarm.com and guarantees that they have the right to provide it to the Controller.

The Controller adopts appropriate technical and organisational measures to protect Personal Data from unauthorised access, loss, disclosure, alteration or destruction.

Processing is carried out mainly using computer and telematic tools, according to methods and procedures strictly related to the purposes indicated in this notice.

The following may access the Data, within the limits of their respective functions:

• personnel authorised by the Controller;
• system administrators;
• providers of technical, IT, hosting, database and backup services;
• providers of security and traffic-distribution services;
• providers of statistical and advertising services;
• payment processors;
• banks and payment networks;
• couriers and logistics operators;
• administrative, tax, accounting or legal consultants;
• public authorities and other parties to whom disclosure is legally required.

When necessary, these parties are appointed as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679.

The updated list of Data Processors can be requested by writing to info@bioxfarm.com.

The Controller processes Personal Data when at least one of the following conditions applies:

• the User has given their consent;
• processing is necessary to respond to a request or take pre-contractual steps;
• processing is necessary to perform a contract or manage an order;
• processing is necessary to fulfil legal, tax or accounting obligations;
• processing is necessary to pursue the Controller’s legitimate interest, such as site security, fraud and abuse prevention, and the protection of its own rights;
• processing is necessary to establish, exercise or defend a right.

The User may contact the Controller to find out the legal basis applied to a specific processing activity.

Personal Data may be processed to:

• enable the functioning and security of BioXFarm.com;
• display content and correctly distribute traffic;
• protect the site from attacks, spam, fraud and bots;
• respond to requests sent via email or contact forms;
• create and manage the User’s account;
• manage the cart and orders;
• process payments;
• organise shipping and delivery of products;
• provide pre- and post-purchase assistance;
• manage cancellations, refunds, returns, complaints and disputes;
• fulfil administrative, accounting, tax and legal obligations;
• carry out statistics on site usage;
• measure page performance;
• measure purchases and conversions;
• assess the effectiveness of advertising campaigns;
• carry out advertising and remarketing activities, subject to consent;
• personalise advertisements, subject to consent;
• send promotional communications, subject to consent;
• protect the rights and interests of the Controller and of Users.

When the User contacts BioXFarm.com through a form, email or phone, the Controller may process first and last name, contact details, the content of the request and any other information voluntarily provided.

Purpose: to respond to the request and provide assistance.

Legal basis: performance of pre-contractual measures requested by the User or the Controller’s legitimate interest in managing communications received.

When the site allows registration, the data necessary to create and manage the account is processed.

Data processed: first and last name, email address, credentials or access codes, addresses, order history and account preferences.

Purpose: to allow access to the personal area, simplify purchases, and allow orders to be viewed and managed.

Legal basis: performance of the contract or of pre-contractual measures requested by the User.

The following may be processed to manage purchases:

• identification and contact data;
• billing and shipping address;
• tax code or VAT number, when required;
• products purchased;
• amounts and payment status;
• information necessary for shipping;
• communications relating to the order.

The data is used to conclude and perform the sales contract, manage payment, issue tax documents, organise delivery and provide assistance.

The data necessary for delivery may be communicated to the appointed couriers and logistics operators.

Legal basis: performance of the contract and fulfilment of legal obligations.

Cloudflare CDN and traffic distribution

BioXFarm.com uses Cloudflare, Inc. services to optimise performance, distribute content, ensure the site’s availability and protect the infrastructure.

This integration means that traffic between the User’s browser and BioXFarm.com may pass through the Cloudflare network.

Data processed:

• IP address;
• network request data;
• date and time of connection;
• browser, device and operating system information;
• HTTP headers;
• approximate geographic location;
• technical logs;
• Usage Data;
• data necessary for connection security.

Purpose: traffic optimisation and distribution, security, attack prevention and service continuity.

Legal basis: the Controller’s legitimate interest in ensuring the site’s security, reliability and performance.

Provider: Cloudflare, Inc. — Privacy notice: cloudflare.com/privacypolicy

Cloudflare Bot Management

BioXFarm.com may use Cloudflare Bot Management to detect and counter malicious bots, abusive automated access, fraudulent activity and security threats.

Depending on the configuration actually used, the service may process:

• IP address;
• city, postal code, province, state, country, county and geographic region;
• approximate geographic coordinates associated with the city;
• metropolitan area;
• device, browser and operating system information;
• application information;
• language;
• Usage Data and technical logs;
• strictly necessary Tracking Tools;
• number and duration of sessions;
• page views;
• data relating to navigation within the site;
• clicks and page interactions;
• scrolling and scroll position;
• mouse movements;
• keypress events;
• touch events;
• motion-sensor events;
• content-view data;
• session statistics;
• interaction, page and custom events.

This data is used to distinguish human from automated traffic, protect the site, prevent fraud and counter malicious activity.

Legal basis: the Controller’s legitimate interest in the security of the site and its Users.

Provider: Cloudflare, Inc. — Privacy notice: cloudflare.com/privacypolicy

Cloudflare Turnstile

BioXFarm.com may use Cloudflare Turnstile to protect forms, sign-ins and other site features from spam and bots.

According to Cloudflare’s specific notice, Turnstile processes technical signals such as:

• IP address;
• TLS fingerprint;
• User-Agent header;
• Sitekey;
• origin of the site on which the service is used.

These signals are used to distinguish human Users from bots, block malicious traffic and improve the effectiveness of the detection systems.

Purpose: protection from spam, bots, fraud and malicious activity.

Legal basis: the Controller’s legitimate interest in protecting the site and the technical need to ensure the service’s security.

Provider: Cloudflare, Inc. — Specific notice: cloudflare.com/turnstile-privacy-policy

Cloudflare Web Analytics

BioXFarm.com may use Cloudflare Web Analytics to obtain aggregated statistics on the site’s performance and usage.

The service may process technical metrics relating to page views, language, site usage and general device characteristics.

Cloudflare states that Web Analytics does not collect or use visitors’ Personal Data and is designed with a privacy-oriented approach.

Purpose: aggregated statistics, performance measurement and site improvement.

Provider: Cloudflare, Inc. — Documentation: developers.cloudflare.com/web-analytics — Privacy notice: cloudflare.com/privacypolicy

Google Analytics 4

BioXFarm.com uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, to collect statistical information on site usage and assess its performance, traffic and interactions.

Google Analytics may collect:

• number of Users;
• page views;
• session statistics and duration;
• navigation and interaction events;
• traffic source;
• browser, device and operating system information;
• language;
• approximate geographic location;
• IP address, processed according to the methods provided by Google;
• online identifiers;
• Client ID stored in the _ga Cookie;
• events relating to products, cart, checkout, purchases and conversions, when configured.

Google Analytics uses Cookies and similar technologies to distinguish Users and their sessions. Analytics Cookies are activated only after the User has given consent through the Cookie banner.

Purpose: statistics, performance analysis, understanding of site usage, conversion measurement and improvement of the User experience.

Legal basis: the User’s consent.

Provider: Google Ireland Limited. — Privacy notice: policies.google.com/privacy — Information on data collection: support.google.com/analytics

The User can withdraw consent at any time through the Cookie preferences panel on BioXFarm.com.

Google Ads and conversion tracking

BioXFarm.com uses Google Ads to promote its products, measure the effectiveness of advertising campaigns and understand whether a User has taken certain actions after viewing or selecting an advertisement.

Google Ads may process:

• IP address;
• Cookies and online identifiers;
• browser, device and operating system information;
• data relating to advertisements viewed or selected;
• referrer URL and page;
• pages visited;
• interactions with the site;
• products viewed or added to cart;
• events relating to checkout and purchase completion;
• conversion value and technical identifier;
• date and time of interactions;
• approximate geographic location.

Conversion data is used to attribute actions taken on the site to advertisements and to assess the performance of advertising campaigns.

Google Ads may also be used for remarketing or personalised-advertising activities, in order to show BioXFarm advertisements to Users who have previously visited the site. These features are activated only when the User gives the relevant consent.

Purpose: advertising, campaign measurement, conversion tracking and, subject to specific consent, remarketing and ad personalisation.

Legal basis: the User’s consent.

Provider: Google Ireland Limited. — Privacy notice: policies.google.com/privacy — Advertising preference management: myadcenter.google.com

The User can withdraw consent at any time through the BioXFarm.com Cookie preferences panel.

Google Consent Mode

BioXFarm.com uses Google’s consent mode to communicate the User’s expressed preferences to Google services.

Before consent is given, the parameters relating to the storage of analytics and advertising data, the transmission of advertising data, and ad personalisation are set to denied.

Settings are updated only after the choice made by the User through the banner or the Cookie management panel.

Consent mode does not replace the Cookie banner and does not, on its own, constitute a legal basis for processing.

BioXFarm.com uses Stripe to process payments made through the online shop.

When the User makes a purchase, the data necessary for payment is transmitted directly to Stripe over secure connections.

Società Agricola BioXFarm S.r.l.s. does not acquire or store the full card number, security code, or complete payment-method credentials.

Stripe may process:

• first and last name;
• email address and phone number;
• billing and shipping address;
• payment method information;
• card or account data used;
• amount, currency, date and time of the transaction;
• products purchased and order references;
• payment status;
• information relating to refunds, disputes and chargebacks;
• IP address;
• device, browser and operating system information;
• technical data and signals used for authentication and fraud prevention.

BioXFarm receives from Stripe the information necessary to verify the payment outcome and link the transaction to the order, such as:

• transaction identifier;
• amount and currency;
• payment status;
• payment date;
• network used;
• last digits and expiry of the payment method, when available;
• information necessary to manage refunds and disputes.

Stripe may communicate data to banks, payment networks and other parties involved in the transaction to authorise and process payment, carry out authentication, prevent fraud and manage any disputes.

Purpose: payment processing, User authentication, fraud prevention, and management of orders, refunds, chargebacks and disputes.

Legal basis: performance of the purchase contract, fulfilment of legal obligations, and the Controller’s legitimate interest in fraud prevention and transaction security.

Provider: Stripe Payments Europe, Limited.

In providing payment services, Stripe may act as a Data Processor on behalf of the Controller and, for certain activities determined autonomously, as an independent Data Controller.

Should the User choose to use Stripe Link to store their payment method and speed up future purchases, the related processing is carried out directly by Stripe according to the service’s own terms and notice. Use of Stripe Link is optional.

Privacy notice: stripe.com/privacy

Transaction data is retained by the Controller for the period necessary to perform the contract and subsequently for the periods required by tax, accounting and civil law. Stripe retains data according to the periods and conditions set out in its own notice.

BioXFarm.com may contain links to BioXFarm’s social pages, such as Facebook, Instagram and LinkedIn.

Where these are simple links, no data is communicated to the platform before the User chooses to open the relevant link.

After clicking, data processing is governed by the terms and notices of the platform visited.

Should widgets, pixels or embedded social content be integrated, this notice and the Cookie Policy will be updated accordingly.

BioXFarm.com may use the email address provided by the User to send newsletters, updates and promotional communications only after obtaining specific consent.

Data processed: name, email address, preferences and subscription information.

Purpose: sending commercial and promotional communications.

Legal basis: the User’s consent.

The User can withdraw consent at any time using the unsubscribe link included in the communications or by writing to info@bioxfarm.com.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Data is processed at the Controller’s premises and in the places where the providers involved operate.

Some providers, including Cloudflare, Google and Stripe, may process data outside the European Economic Area through globally distributed infrastructure.

Where applicable, international transfers are carried out on the basis of:

• a European Commission adequacy decision;
• the Data Privacy Framework;
• Standard Contractual Clauses approved by the European Commission;
• another safeguard provided by applicable law.

The User may request information on the safeguards applied by contacting the Controller.

Personal Data is retained for the time necessary to achieve the purposes for which it was collected. In particular:

• data relating to orders, invoices and accounting obligations is retained for the period required by tax and civil law;
• account data is retained until a deletion request is made, except for data linked to legal obligations or orders already placed;
• data from contact requests is retained for the time necessary to manage the communication and any subsequent relations;
• data processed on the basis of consent is retained until consent is withdrawn or the relevant purpose is achieved;
• data relating to promotional communications is retained until consent is withdrawn;
• technical and security logs are retained for the period necessary to ensure site security, prevent abuse and investigate any incidents;
• statistical and advertising data is retained according to the settings adopted by the Controller and the periods indicated by the respective providers;
• data connected to disputes or proceedings may be retained until the conclusion of the dispute and the relevant limitation periods.

Once the retention period has ended, the Data is deleted or anonymised, subject to further legal obligations.

In the cases provided by law, the User may:

• obtain confirmation of the existence of processing;
• access their own Personal Data;
• request rectification or updating of the Data;
• request deletion of the Data;
• request restriction of processing;
• object to processing based on legitimate interest;
• withdraw consent previously given;
• receive their Data in a structured, machine-readable format;
• request, where technically possible, transmission of the Data to another controller;
• lodge a complaint with the data protection authority;
• bring proceedings before the competent judicial authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

When Data is processed for direct marketing purposes, the User may object at any time without providing a reason.

Requests may be sent free of charge to:

Società Agricola BioXFarm S.r.l.s.
Contrada Ciuranà, 88812 Crucoli (KR), Italia

Email: info@bioxfarm.com
Phone: +39 0962 34 034

The Controller will respond within the time limits set by applicable law and, as a rule, within one month of receiving the request.

BioXFarm.com uses Cookies and other Tracking Tools.

To learn about the Cookies used, their providers, purposes, durations and how to give or withdraw consent, the User may consult the Cookie Policy.

The User can change or withdraw their preferences at any time through the Cookie management panel.

For operational, maintenance and security purposes, BioXFarm.com and its providers may collect system logs containing IP addresses, dates and times of requests, technical information, and events relating to the site’s operation and security.

Personal Data may be used by the Controller to establish, exercise or defend a right in court or in the preparatory stages of any proceedings.

The Controller may also be required to communicate the Data to public authorities where this is required by law or ordered by a lawful measure.

The Controller may amend this Privacy Policy to bring it into line with regulatory, technical or organisational changes.

Changes will be published on this page with an indication of the update date.

Where changes concern processing based on consent, the Controller will request consent again where necessary.

Personal Data: any information relating to an identified or identifiable natural person.

Usage Data: information collected automatically while using the site, such as IP address, time of the request, pages visited, browser and device characteristics, and technical connection information.

User: the person who uses BioXFarm.com.

Data Subject: the natural person to whom the Personal Data relates.

Data Processor: the party that processes Personal Data on behalf of the Controller.

Data Controller: the party that determines the purposes and means of processing.

Cookie: small pieces of data stored in the User’s browser or device.

Tracking Tool: any technology, such as Cookies, identifiers, scripts, web beacons or similar systems, that allows information to be collected or stored about the device or use of the site.

This notice is drafted pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 and applicable Italian data-protection law.

Unless otherwise indicated, this Privacy Policy applies exclusively to BioXFarm.com.