Privacy Policy

Scope

This policy applies to this website and to the BYB Tech store, account area and order process it carries. It does not apply to third-party websites reached from links here — BYB TECH SRL has no control over, and no responsibility for, their content or their privacy practices.

It also takes account of Directive 2002/58/EC (the ePrivacy Directive) as updated by Directive 2009/136/EC, and of the decisions of the Italian Data Protection Authority (Garante per la protezione dei dati personali), in particular its provision of 8 May 2014 on cookies.

1. Data Controller

The Data Controller is:

BYB TECH SRL, Via Camillo Brozzoni 9, 25125 Brescia (BS), Italy. VAT ID IT04081900989, represented by its legal representative in office.

Write to info@bybtech.it for anything in this policy, including to exercise the rights in section 6.

2. Purposes and legal bases

Your personal data are processed lawfully under Article 6 of the GDPR, for the purposes below.

A) Contract and legitimate interest — Art. 6(1)(b) and (f):

• To enable browsing and the technical operation of this website.
• To respond to contact requests or information enquiries sent through the contact form.
• To process and fulfil orders, manage payments, deliver products and provide support. This includes the delivery address, the items ordered, the amounts and the order reference.
• To meet legal and regulatory obligations, including tax compliance and invoicing.
• For internal administrative and accounting activities necessary to fulfil pre-contractual or contractual obligations.

B) Legal obligation — Art. 6(1)(c) — for invoicing identifiers:

• Italian electronic invoicing requires a Codice Fiscale or a Partita IVA, and a Codice Destinatario or a PEC address to route the invoice through the Sistema di Interscambio. These are collected at checkout only where Italian law requires them, and are not collected from buyers outside Italy.
• Where an EU business customer claims reverse charge, the VAT number is validated against the European Commission's VIES service and the consultation number VIES returns is stored with the order. It is the evidence that the zero rate was applied correctly.

C) Legitimate interest — Art. 6(1)(f) — for signup attribution:

When an account is created, BYB Tech records how the visit began: the page you landed on, any campaign parameters in the link, the referring website's host name, and advertising click identifiers where present. It is used to understand which content and campaigns bring people to the site. It is kept for 24 months and nothing on the site keys off it. The referring host is stored without its path, so another site's search query is never recorded.

D) Legitimate interest — Art. 6(1)(f) — for unfinished checkouts:

When you begin a checkout and enter an email address, BYB Tech records what you had entered — the address, contact details, delivery country and the items in your basket — together with the total shown to you at that moment. It is used to understand where and why checkouts are not completed, for example whether a delivery charge or a VAT amount is the reason people stop. It is kept for 48 months and then deleted. That is longer than the other periods on this page because it is used to compare one season against another, which needs several years of it. BYB Tech may also write to you once, individually, to ask whether you need any help deciding — a person writes that message and sends it by hand. There are no automated abandoned-basket emails and no reminder sequence, and you will not be added to any mailing list by starting a checkout. Reply to say you would rather not be contacted, or write to info@bybtech.it to have the record erased or to object under Article 21.

E) Contract — Art. 6(1)(b) — for training course viewing:

If you have bought a training course, BYB Tech records which chapters you have watched, how long you have watched each one, and how far into a chapter you reached. It is used to understand which parts of the course are useful and where people stop, so the material can be improved. It is kept for 24 months and then permanently deleted. The figures are reported by your browser as the video plays: they are an internal measure of how the course is used and are not a record of completion, are never shown to anyone outside BYB Tech, and are not used to assess you or to decide anything about your purchase. Nothing is recorded if you are not signed in. If you delete your account, these records are deleted with it.

F) Consent — Art. 6(1)(a) — for marketing:

• With your explicit consent, to send promotional and marketing communications, including newsletters.
• Your data may be entered in a CRM system to analyse open rates, click-throughs and device or interaction details, in order to improve the effectiveness of those communications. These activities may involve profiling, but no automated decision-making with legal effects is carried out.
• Only if you tick the optional box when placing an order: your email address, phone number, first and last name, town, postcode and country are hashed (turned into an irreversible code) and added to a Meta customer list for the product you bought — Telemetry, Chrono or Focus. Meta matches the codes against its own users so BYB Tech can show relevant news on Facebook and Instagram and stop showing adverts for a product you already own. The box is never ticked for you and is not a condition of the order. You stay on the list until you withdraw.

You may withdraw marketing consent at any time using the unsubscribe link in an email or by writing to info@bybtech.it. Writing to the same address removes you from every Meta customer list. Section 9 explains why unsubscribing from a transactional message is a different thing.

G) Legitimate interest — Art. 6(1)(f) — for correspondence and follow-up:

When you write to BYB Tech — through the contact form, or by email to info@bybtech.it — your name, address, company and telephone number may be recorded in BYB Tech's own customer records, together with notes a member of staff types about the exchange: what you asked about, which products you said interest you, where the conversation has got to, and any follow-up owed to you. These notes are written by a person and are visible only to BYB Tech. They exist so that you are answered properly, so that nobody has to ask you the same thing twice, and so that work promised to you is not forgotten. The content of your emails is not copied into these records; what is kept is the note and the address it relates to. They are kept for 48 months and then deleted automatically, except that a follow-up still outstanding is kept until it is closed. Writing to BYB Tech does not subscribe you to anything: a record of this kind is never a basis for marketing, which needs your consent under F) and is held separately. Write to info@bybtech.it to see what is held about you, to correct it, to have it erased, or to object under Article 21.

3. Categories of personal data

The following may be collected:

• Identifying information — name, email address, delivery address, telephone number.
• Account credentials — an email address and a password, which is stored only as a hash and is never readable by BYB Tech.
• Order data — the items ordered, quantities, amounts, the delivery address, the order reference and the payment status.
• Invoicing identifiers — Codice Fiscale, Partita IVA, Codice Destinatario, PEC address, VAT number and its VIES consultation number, where section 2(B) applies.
• Entitlements — which digital content an account may access, and whether that access has been revoked.
• Payment data — processed by Stripe. Card details are entered directly into Stripe's own payment form and are never received or stored by BYB Tech.
• Technical data — IP address, browser type, operating system, request logs.
• Advertising identifiers — where you have consented to marketing cookies, the identifiers those cookies contain are stored with your order so that a completed sale can be reported to the analytics and advertising services in section 4. They are stored only when consent was given, and an order placed without it carries none.
• Behavioural and interaction data — only where you have consented to marketing cookies or newsletters.
• Relationship records — notes typed by BYB Tech staff about an exchange with you, the products you said interest you, the stage a conversation has reached and any follow-up owed, as described in section 2(G).

Special categories of data — health, religion, political beliefs and the rest of Article 9 — are not collected or processed, unless required by law.

4. Who else processes your data

Data may be shared with trusted service providers, strictly for the purposes listed above, and with professional advisors and legal authorities where the law requires it.

Account and order data are held in the European Union: Supabase stores them in Frankfurt, Germany. Brevo sends from the European Union, in France. Fatture in Cloud and SpediamoPro are Italian. The remaining processors operate globally. The Google and Meta scripts are requested on every visit so that consent can be applied to them the moment it is given, which means those two receive your IP address, browser and referring page before any choice is made; nothing is stored on your device and no measurement is recorded until analytics cookies are switched on and consented to — the Cookie Policy states exactly what is set today.

Where data are transferred outside the EU, BYB TECH SRL relies on the appropriate safeguards: an adequacy decision of the European Commission, Standard Contractual Clauses, or Binding Corporate Rules.

5. How long data are kept

Personal data are stored only for as long as the purpose they were collected for requires.

For more detail on the criteria behind these periods, write to info@bybtech.it.

6. Your rights

You have the right to:

• Access your personal data — Art. 15 GDPR
• Have inaccurate data rectified — Art. 16
• Request erasure, the “right to be forgotten” — Art. 17
• Restrict processing — Art. 18
• Receive a copy of your data in a portable format — Art. 20
• Object to processing based on legitimate interest — Art. 21
• Withdraw consent at any time — Art. 7(3)

To exercise any of them, write to info@bybtech.it. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali.

Erasure has one limit worth stating plainly: an account with orders against it cannot be deleted outright, because Italian tax law requires the invoice and its data to be kept for ten years. The account is closed and the personal data not covered by that obligation are removed.

7. Automated decisions and profiling

Profiling techniques may be used for marketing purposes, such as tracking newsletter engagement. No automated decision-making producing legal or similarly significant effects, as defined by Article 22 of the GDPR, is carried out.

8. Cookies

Cookies and similar technologies are used to make the website work, to remember what is in your basket and to keep you signed in. The Cookie Policy lists every cookie this site sets, its purpose and how long it lasts, and states which are set only after consent.

9. Transactional email, and what unsubscribing does

Order confirmations, bank transfer details, shipping notices and password resets are sent through Brevo. Every message carries a one-click unsubscribe header, including these: Brevo sends as a member of the Certified Senders Alliance, whose certification requires an unsubscribe mechanism on all mail.

Using it blocks your address at Brevo, and order confirmations and payment details then stop arriving. Most people expect an unsubscribe link to stop marketing, not to stop the email carrying their bank transfer details, which is why it is stated here. If it happens, write to info@bybtech.it and the address will be unblocked.

10. Changes to this policy

This policy may be updated from time to time. Updates are published on this page and take effect from the date of publication shown above.