Privacy policy

1. Who we are

The data controller is Biztems SRL:

• registered office: Via Sarajevo, 13 – 84014 Nocera Inferiore (SA), Italy;
• operational office: Via Giovanni Porzio, 4 – Isola A/2, Centro Direzionale – 80143 Naples (NA), Italy;
• VAT number IT04857960654;
• email info@biztems.it, phone +39 081 196 42 686.

We have appointed a Data Protection Officer (DPO), whom you can reach at privacy@biztems.it with any question about this policy and to exercise your rights.

2. Our role: controller or processor

In BizFi we have two different roles, depending on who you are.

• We are the controller of the data of visitors to this website, of people who ask us for a demo, and of customers and the people who use the BizFi dashboard (sections 3, 4, 5 and 12).
• We are a processor (Art. 28 GDPR) of the data of guests who join a venue’s Wi-Fi through the BizFi portal or browse its digital menu. For these data the controller is the venue: the venue decides which data to collect and what they are for, and we process them only on its behalf and on its instructions (section 6).
• We are an independent controller of the BizFi profile of guests who choose “Remember me at every BizFi venue”: we collect it for ourselves, with a consent separate from the venue’s, and the venue doesn’t receive it (section 6, “The BizFi profile”).

If you are a guest, the privacy notice that applies to you is the venue’s, and it is the venue you can turn to for your rights. If you write to us, we forward your request to the venue and help it answer you.

3. Visitors to this website

Data: IP address, date and time of the request, the page requested and the referring page, browser and operating system type, and the outcome of the request. They are logged automatically by the systems of Netlify, the provider that hosts the website, for every page you visit.

Why: to run the website, keep it secure and detect abuse and faults. We do not use these data to identify or profile you.

Legal basis: our legitimate interest in offering a working, secure website (Art. 6(1)(f) GDPR).

How long: as long as needed for these purposes and in any case no longer than 12 months, unless they are needed to establish offences against the website.

Cookies: the website uses a technical cookie that remembers your cookie choices and, only if you consent, third-party statistics and marketing tools. Until you consent it loads nothing from other websites (even the fonts are hosted by us). The tools, cookies and durations are in section 12.

4. People who ask us for a demo

Data: what you enter in the form — name, venue name, email and, if you give them, phone, city, number of venues, whether you already use a UniFi network and your message — plus the language of the page you write from.

Why: to answer your request, arrange the demo and, if you ask, prepare an offer.

Legal basis: your request, that is, pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). The required fields are the ones we need to answer you: without them, we can’t.

How long: 12 months from the last contact if no contract follows; if you become a customer, the periods in section 5 apply.

Who receives them: the request reaches us by email. The BizFi app, hosted by Netlify, forwards it through Amazon Simple Email Service to the Biztems inbox, where the people who handle it read it. We keep it nowhere else. We do not use these data to send you marketing. If you accepted the website’s marketing tools, Meta Pixel tells Meta that you sent a request, without any of the data you entered (section 12).

5. Customers and dashboard users

This section concerns the venues that use BizFi and the people who sign in to the dashboard (app.bizfi.it): owners, invited team members and contract contacts.

Data:

• account data: name, email, role (admin or manager) and the venues you can access;
• your password, which we store only in a non-reversible encrypted form (a hash);
• technical data about sign-in sessions: IP address and browser type;
• for the contract contact, the data needed for the contract, invoicing and payments.

Why, and on what basis:

• to provide the service, manage accounts and give support: performance of the contract (Art. 6(1)(b) GDPR); for team members invited by a customer, our legitimate interest in providing the service the customer asked for (Art. 6(1)(f) GDPR);
• to protect accounts and the service from unauthorised access and abuse: legitimate interest (Art. 6(1)(f) GDPR);
• to meet tax and accounting obligations: legal obligation (Art. 6(1)(c) GDPR).

Service emails: the invitation to create your account and the link to reset your password come from no-reply@bizfi.it, sent through Amazon Simple Email Service. The link is valid for 24 hours.

Dashboard cookies: the dashboard uses only technical cookies, needed to keep you signed in and to remember the language you chose. They require no consent (Art. 122 of the Italian Privacy Code).

How long: account data for the duration of the relationship and until the account is closed; contract and invoicing data for the 10 years after the relationship ends, as the law requires (Art. 2220 of the Italian Civil Code).

6. Venue guests: the data we process on behalf of venues

When you join the Wi-Fi of a venue that uses BizFi, the portal you see is the venue’s: the controller of your data is the venue, and we process them on its behalf, as a processor. This is what happens to your data on our systems.

The venue’s privacy notice, which says who the controller is and how to reach them, and the Wi-Fi terms of use open from the portal itself, below the form and at the foot of every screen.

Which data

• The form data: first name, last name, phone, email, date of birth and city. The venue decides which of these to ask for, and which to make required.
• Your consent choices: your acceptance of the Wi-Fi terms of use and the optional consents to marketing and statistics, each with the date and the version of the text you saw.
• Device and connection data: your device’s MAC address, your IP address, the browser, operating system and device type, language, time zone and screen size, and the access point and Wi-Fi network you join.
• Connection history: the date and time of each connection, how long Wi-Fi was granted for, and the button you chose (for example the menu or one of the venue’s social pages).

What they are for

• Getting you online: the portal passes your device’s MAC address to the venue’s UniFi network system, which lets it online for the time the venue has chosen. We send the network system no name, phone number or email.
• Recognising you when you come back, to greet you by name and spare you the form.
• Showing you the venue’s digital menu, in your language.
• The venue’s marketing, only if you consent: if you tick the marketing box, BizFi may send you the venue’s news, offers and advertising on its behalf and, after a visit, ask you how it went, on WhatsApp and by email. On WhatsApp the messages come from the venue’s own WhatsApp Business account, and the first one only asks you to confirm your number. The rating and comment you leave reach the venue and are not published; everyone who answers, whatever their rating, is also offered the option of leaving a public review, for example on Google. Every message says how to stop. The venue also sees guests’ contacts and their consent choices in the dashboard, and can export those of guests who consented to use with its own tools, under its own responsibility. BizFi’s own marketing, with a separate consent, is under the BizFi profile, below.
• Meta and Google tools, only if you consent and only if the venue has turned them on: with marketing consent the confirmation page can load the venue’s Meta Pixel, which lets it show you its ads on Facebook and Instagram; with statistics consent, the venue’s Google Analytics 4. Without consent nothing is loaded. Meta and Google receive these data under their own privacy policies.

Technical storage on your device

The portal keeps how far you have got, and what you have typed in, in your browser’s session storage, which is cleared when you close the window: that way a page that reloads doesn’t make you start again. The menu page may store its files in the browser cache to load faster.

How long

The venue chooses the period, between 30 days and 10 years (365 days unless it changes it). Every day we automatically delete connections older than that period and the data of guests who haven’t been back for as long. If you ask the venue to delete you, it does so from the dashboard: your data and your consents are deleted at once, the device is made anonymous, and your past connections lose their IP address, device data and the network system’s response. All that remains of them, anonymously and until the retention period runs out, is their date and time, duration, the button chosen and the language.

The BizFi profile, if you choose it

In the portal you can choose, if you wish, “Remember me at every BizFi venue”. If you do, we are the controller of a BizFi profile of yours, separate from the venue’s data. The profile is for adults only: if the form shows you are under 18, the portal doesn’t offer it.

• Data: what you entered in the form (name, phone number, email, date of birth and city, whichever you gave); the consents you give BizFi, with their date, text version and venue; the list of your visits to BizFi venues: which venue, when, which button. No device or connection data.
• Recognising you at other BizFi venues: with your consent (Art. 6(1)(a) GDPR).
• Analysing your visits to offer you personalised deals, only with a second, separate consent: which BizFi venues you go to, how often, on which days and at what time, and which ones you visit together, also by age and city if you gave them, to recognise your habits and pick the BizFi venues’ offers that suit you best (Art. 6(1)(a) GDPR).
• Sending you offers and news from BizFi venues, only with a third, separate consent: by email or text message, to the contacts you entered, for example an offer for your birthday; if you also gave the second consent, chosen from your visits (Art. 6(1)(a) GDPR).
• Aggregate statistics on the BizFi network, for example how many guests visit more than one venue, how old they are and which cities they come from, which identify no one: our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR), which you can object to.
• How long: 24 months from your last visit to a BizFi venue; then the profile is deleted automatically, with its visits and consents.
• Independent of the venue’s data: the venue doesn’t see your profile or your visits to other venues. If you ask the venue to delete you, the profile stays; if you ask us to delete the profile, the venue’s data stays; if the venue stops using BizFi, its data is deleted and your profile is not.

Separate controllers. For the BizFi profile we are an independent controller, separate from the venue: we collect the data for ourselves, with a consent that isn’t the venue’s; the venue decides nothing about the profile and doesn’t receive it, and we don’t use it on its behalf. The form is the same one: if you choose “Remember me”, what you enter in it goes both to the venue, which remains the controller of its own guest list, and to us. To withdraw a consent, delete the profile or exercise your other rights over it, write to privacy@biztems.it.

Your rights

For the data the venue processes as controller, contact the venue. If you write to privacy@biztems.it, we forward your request to the venue and help it act on it.

7. Who processes data on our behalf

Besides authorised Biztems staff, data are processed by providers we have appointed as processors (or, for guest data, sub-processors), bound by contract to confidentiality and security:

Meta Platforms Ireland Ltd, for Meta Pixel, is not one of our providers: it is a joint controller with us (section 12).

When a venue connects its UniFi network through Ubiquiti’s cloud service, the device’s MAC address and the access duration pass through Ubiquiti Inc. (United States), the provider of the venue’s network system, to reach the venue’s network.

When a venue messages its guests on WhatsApp, the messages come from its own WhatsApp Business account and are delivered by Meta Platforms Ireland Ltd, the venue’s provider (not ours), under the terms the venue has accepted with Meta.

We disclose data to others only when the law requires it, for example to public authorities, or to advisers bound to confidentiality.

8. Transfers outside the European Union

The app’s data are stored in the European Union: the database in Frankfurt, files and emails in Ireland. Some providers, however, are based, or use group companies, outside the European Economic Area, mostly in the United States. In those cases data are transferred only with the safeguards the GDPR provides for (Art. 44 onwards):

• to US companies certified under the EU-US Data Privacy Framework, on the basis of the European Commission’s adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795), for as long as it remains in force;
• otherwise, and as an additional safeguard, on the basis of the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914).

The website tools we use only with your consent (section 12) transfer data to the United States: Google Analytics 4 and Google Tag Manager to Google LLC and Meta Pixel to Meta Platforms, Inc., under the Data Privacy Framework and the standard contractual clauses. Hotjar stores data in Ireland and transfers data to sub-processors outside the European Union under the standard contractual clauses or, for certified US companies, the Data Privacy Framework. Venues’ WhatsApp messages may also be processed by Meta Platforms, Inc. in the United States, under the Data Privacy Framework and the standard contractual clauses.

You can ask for a copy of these safeguards by writing to privacy@biztems.it.

9. How long we keep data

When the period ends we delete the data or make them anonymous, unless they are needed to establish, exercise or defend legal claims.

10. Your rights

You have the right to ask us for access to your data, for their rectification or erasure, for restriction of processing and for the portability of the data you gave us (Arts. 15–20 GDPR). Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before; you change your consents to the website’s cookies with the cookie button, bottom left on every page (section 12).

How to exercise them: write to our DPO at privacy@biztems.it, or to info@biztems.it. We reply within one month, which can be extended by two months for complex requests, in which case we tell you (Art. 12 GDPR). To protect your data we may ask you to confirm your identity. If you are a venue’s guest, see section 6.

Complaints: if you believe the processing breaches the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work, or go to court (Arts. 77 and 79 GDPR).

11. Security

We protect data with appropriate technical and organisational measures: encrypted connections (HTTPS), dashboard access with personal credentials and roles that limit what each person sees, passwords stored only in a non-reversible encrypted form, the keys to venues’ networks encrypted in the database, and infrastructure in the European Union. If a personal data breach occurs, we handle and notify it as Arts. 33 and 34 GDPR require.

12. Cookies and other tracking tools

Cookies are small text files that a website saves in your browser and reads back on later visits. Other tools, such as pixels, scripts and the browser’s local storage, read or store information on your device in a similar way. The law calls them all “tracking tools” and requires your consent to use them, unless they are strictly necessary for the website to work (Art. 122 of the Italian Privacy Code). This section is about this website: for the dashboard see section 5, for venues’ Wi-Fi portal section 6.

How you choose, and how you change your mind

On your first visit we show you a window where you can accept all the tools, reject them all or choose them by category with “Customize”. If you close the window with the X, it is as if you had rejected them. Until you choose, and if you reject them, the website uses only the technical cookie that remembers your choice and loads nothing from other websites: no statistics or marketing tool.

We remember your choice for 6 months, then ask you again; we ask sooner if we change the tools we use. The cookie that remembers it is technical and needs no consent: it only serves to respect your choice, as the law requires of us (Art. 6.1.c GDPR and Art. 122 of the Italian Privacy Code).

You can change your mind at any time with the cookie button, bottom left on every page, or with “Cookie settings” at the bottom of the page. If you withdraw a consent, the page reloads, the tools you had accepted stop working and the cookies they had saved on this website are deleted. You can also delete cookies in your browser’s settings: Chrome, Firefox, Safari, Edge. If you block all cookies, the website can’t remember your choices.

The tools we use

Legal basis: for the statistics and marketing tools, your consent (Art. 6.1.a GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time without affecting what was done before. Rejecting them doesn’t stop you from using the website or asking us for a demo.

Profiling: only with your consent to the marketing tools, Meta Pixel lets us show our ads to people who visited the website and measure their results: a form of profiling for advertising, which you can refuse or withdraw at any time. It leads to no decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

Meta as joint controller: for the collection of data on the website with Meta Pixel and its transmission to Meta, Biztems and Meta Platforms Ireland Ltd are joint controllers (Art. 26 GDPR), under Meta’s controller addendum. In short: Biztems gives you this notice and collects your consent; Meta processes the data it receives as an independent controller, under its own policy, which also explains how to exercise your rights with Meta. You can still come to us: if your request concerns data processed by Meta, we pass it on.

The providers’ policies

• Google: privacy policy, how Google uses information from sites that use its services and the Google Analytics opt-out add-on;
• Hotjar: privacy policy;
• Meta: privacy policy and controller addendum.

13. Changes to this policy

We may update this policy when the service or the law changes. The date at the top of the page shows the latest change; if the changes are significant, we also tell customers by email. If the website’s tracking tools change, we ask for your consent again.