Privacy Policy

The data controller is BONS SRL, the legal entity responsible for deciding how and why your personal data is processed.

BONS SRL Corso Unione Sovietica 612/15/c — 10135 Torino (TO), Italy VAT ID 11994670013 — C.F. 11994670013 Contact: privacy@bons.hair

We receive data from website forms, purchases, support requests and people making group bookings. To simplify billing we may reuse names, contacts, addresses and tax details already held in our Shopify orders, Fatture in Cloud customer records and event booking lists. Prefilling is not new consent and does not subscribe you to marketing. Review and correct the details before submitting. If booking for others, share this notice with them before providing their data.

Depending on how you interact with the site, we may process:

• Technical data such as IP address, device type, browser, language, and pages visited.
• Contact and booking details: name, email, optional phone number, seats, attendees, amounts paid and due, payment references and status. For the waiting list we collect email, ticket category, language and request date.
• Behavioural data captured through analytics and marketing cookies, only if you give consent.
• Cookie consent preferences stored locally in your browser.
• Billing details: name or company name, country, address, tax code / VAT number / Tax ID and, for Italian businesses and professionals, SDI code and optional PEC address. The balance form uses Supabase to store data; Stripe handles payment and returns transaction references and status. Our form does not collect full card numbers. If you select bank transfer, we record your choice and payment reference; receipt is verified through our bank. We do not request your online banking credentials.
• Lunch preferences and, only when voluntarily provided with explicit consent, information about coeliac disease, allergies or intolerances. Do not provide diagnoses or medical information unnecessary for meal arrangements.

Each purpose has its own legal basis. Acknowledging this notice is not a request for blanket consent:

• Bookings, payments, support and requested waiting-list responses: contract or requested pre-contractual steps (Article 6(1)(b)). For business contacts and attendees named by a buyer: legitimate interest in administering the booking and operational communications (Article 6(1)(f)).
• Invoicing and tax obligations: legal obligation (Article 6(1)(c)). Prefilling existing details: legitimate interest in reducing errors and simplifying bookings (Article 6(1)(f)), subject to correction and the right to object.
• Service operation, abuse prevention and defending rights: legitimate interest in service security and handling disputes (Article 6(1)(f)); legal obligations where applicable.
• Hotjar analytics and Meta advertising / remarketing: optional consent to the relevant category (Article 6(1)(a)). A purchase or waiting-list request does not automatically authorise newsletters or further marketing.

Dietary information revealing health requires separate explicit consent (Articles 6(1)(a) and 9(2)(a)). It is used only to arrange meals and accessed by authorised staff and, as necessary, those preparing or serving lunch. It is not included in automatic notification emails. You may omit it or withdraw consent by contacting us: you can still book, but we may be unable to arrange a suitable meal. For other attendees, provide such data only after informing them and obtaining their explicit consent and authority to communicate it; otherwise ask them to contact us directly.

The identity, contact, billing and attendee names requested in the form are needed to administer the booking. Without them the online process cannot be completed; contact us for assistance. The form requests a tax identifier; foreign individuals can declare that they do not have a Tax ID. An SDI code is required only for Business profiles with Italy selected. Individuals provide their email at confirmation for receipts and operational communications. Phone, PEC, health information and tracker consent are optional. Rejecting non-essential cookies does not prevent a purchase.

Authorised BONS SRL staff and suppliers involved in providing the service may access data. Suppliers act as processors when working on our behalf; some also act as independent controllers for payments, security and their own legal duties, as explained in their notices.

• Shopify: orders, initial purchases and customer records used for prefilling.
• Meta: advertising measurement and remarketing, with marketing cookie consent.
• Hotjar: website usage analysis, with analytics cookie consent.
• Vercel and infrastructure providers: website delivery, request handling and security.
• Stripe: balance payments, fraud prevention and receipts.
• Supabase: storage of bookings, billing details and attendee information.
• Twilio SendGrid: operational team notifications containing contact, billing and attendee names, but no health information.
• Fatture in Cloud, accounting advisers and legally required recipients: customer records and tax obligations. Event staff and caterers: only information needed for reception and meals. Competent authorities where disclosure is required. Intesa Sanpaolo handles transfers to the BONS S.R.L. account under its own privacy notice.

International services may involve access or transfers outside the European Economic Area, even where the main database is hosted in the EU. Transfers require an applicable adequacy decision or safeguards under GDPR Chapter V, such as standard contractual clauses and supplementary measures where necessary. You can request information about countries and suppliers and a copy of the safeguards applicable to your data.

Provider privacy notices

• Shopify
• Stripe
• Supabase
• Vercel
• Twilio SendGrid
• Fatture in Cloud
• Hotjar
• Meta

Retention depends on the purpose and differs between data categories:

• Tax and accounting documents: for applicable statutory periods, normally 10 years; legal obligations or disputes may require longer retention of relevant data only.
• Bookings, contacts and prefilled details: to administer the event and subsequent requests; afterwards we retain only what is needed for legal obligations or the defence of rights within relevant limitation periods.
• Waiting list and support: until the request or relevant event is concluded, unless documented dispute-related or legal requirements apply.
• Health data for Hair Fusion Vol.3: deleted from the operational database after the event and by 30 November 2026. Deletion must also cover operational copies provided to caterers; backups follow provider retention cycles and are not used for new purposes.
• Cookie preferences: up to 12 months unless changed or removed earlier. A balance-form draft is stored in the browser session when switching language or proceeding to Stripe so you can return to the form; it is not a permanent archive.
• Technical logs and tracker data: as needed for security and diagnosis, or for the periods in the cookie policy and provider notices. Contact us for details about a specific processing activity.

Hotjar and Meta are activated only after you select the relevant category. Personal balance-payment pages exclude these scripts. You can change or withdraw your choice in cookie preferences; withdrawal stops future tracker use on this site without undoing previous processing. See the cookie policy for categories, services and browser storage.

Read the cookie policy

If you contact us, we use your contact details and message to respond. The WhatsApp button is an external link: opening it uses WhatsApp under its own privacy notice. Email is available as an alternative. Avoid sending medical information or tax documents through chat unless necessary for your request.

This website’s booking process does not decide event admission through solely automated decisions producing legal or similarly significant effects. With your consent, advertising tools may associate interactions with identifiers to measure campaigns and personalise ads. Payment providers may perform their own fraud checks as described in their notices.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased where applicable.
• Restrict how we process your data.
• Receive your data in a portable, machine-readable format.
• Object to processing based on legitimate interest or for direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

Write to the privacy contact below, describing your request and providing a useful booking reference. We may request only information necessary to verify your identity. We normally respond within one month; complex requests may take a further two months, with notice during the first month. Rights are subject to GDPR conditions; erasure does not override statutory retention duties.

We apply appropriate technical and organisational measures to protect your data from unauthorised access, loss, or alteration. All payments are processed through secure third-party providers; we never store full card details on our systems.

You may complain to the Italian Garante or the supervisory authority in the EU country of your habitual residence, workplace or alleged infringement, and seek a judicial remedy. You do not have to contact us before exercising your right to complain.

Italian data protection authority (Garante)

Official GDPR text

We may update this Privacy Policy from time to time. The current version is always available on this page, with the last-updated date at the top. Material changes will be communicated through the website.