Privacy Policy

Regulation (EU) 2016/679 ("GDPR") — Articles 13 and 14

This notice describes how the personal data of users of the MiBuono app (customer loyalty) and the MiBuono Partner app (shop management) is processed. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").

1. Data Controller

The data controller is the shop to which the user is registered (the "Shop"). Each shop in the MiBuono network is an independent controller of the data of its own customers and staff. The Shop's full identity is communicated at registration and is also published on the Shop's own privacy page: https://<shop-domain>/privacy.php.

2. Data Processor

The SparkLoyal / MiBuono software service is provided by 北京厚土客盛科技有限公司 (Beijing Houtukesheng Technology Co., Ltd.) as data processor (art. 28 GDPR), acting on behalf of the Shop, on the basis of a service contract governing confidentiality, security and sub-processors.

• Company name: 北京厚土客盛科技有限公司 (Beijing Houtukesheng Technology Co., Ltd.)
• Address: 北京市丰台区丰管路甲1号北楼二层202-1236室 (Room 202-1236, 2nd Floor, North Building, No. 1A, Fengguan Road, Fengtai District, Beijing, China)
• Tax ID (Unified Social Credit Code): 91110106MAKNWQLK7W
• Privacy contact: [email protected]

3. Data we collect

Customer users (MiBuono app):

• Registration data: first name, last name, e-mail, phone number, date of birth, loyalty card number;
• Loyalty data: purchase history, amounts spent, points earned and redeemed, coupons issued and used, welcome and birthday vouchers;
• Booking data: dates, times, selected services, preferred technician;
• Technical data: device identifier, operating system, push token, connection logs for security.

Management users (MiBuono Partner app — owner, manager, staff):

• Account data: display name, e-mail, role (manager / staff);
• Operational data: access logs, management actions (coupon issuance, booking changes, points adjustments, deletions), IP address, user agent.

We do not collect payment data: payments are made exclusively at the point of sale and do not transit through the apps.

4. Purposes and legal bases

Purpose	Legal basis
Account creation and management, loyalty programme (points, coupons, welcome and birthday vouchers)	Performance of contract (art. 6(1)(b) GDPR)
Compliance with legal, accounting and fiscal obligations	Legal obligation (art. 6(1)(c) GDPR)
Push notifications (promotions, birthdays, booking status, shop communications)	Consent (art. 6(1)(a) GDPR), revocable at any time in the app settings
App security, fraud prevention, log and backup management, audit of management actions	Legitimate interest (art. 6(1)(f) GDPR)
Management staff accounts (manager / staff) for service provision	Performance of contract and legal obligations (art. 6(1)(b/c) GDPR)

The date of birth is collected exclusively for sending the birthday coupon and for anonymous statistics.

5. Processing methods and retention

Data is processed electronically on servers hosted in the European Union, with appropriate security measures (password encryption, HTTPS, access control, daily backups, audit logs).

• Data is retained for the duration of the user's account;
• in any case, for the maximum period required by law (accounting documentation: 10 years under Italian law);
• after account deletion, identifying data is deleted or anonymised within 30 days, except data whose retention is imposed by law.

6. Sharing and transfer of data

Data is never sold or shared with third parties for marketing. It may be disclosed only to:

• hosting and technical maintenance providers acting as processors (art. 28 GDPR);
• transactional e-mail providers (confirmation e-mails, verification codes, coupons);
• push notification providers: Getui (through the uniCloud function service), with processing on servers located in China, limited to the device push identifier and the notification content (which does not contain customer personal data); device vendor push channels and Google FCM, for offline delivery, with processing that may take place outside the EU (including the United States);
• public authorities where required by law.

Account, booking and transaction data are stored within the European Union. The push identifier and the notification content described above may be processed outside the EEA (China for Getui, the United States for Google FCM) under arts. 44 et seq. GDPR (standard contractual clauses).

7. Your rights

You may exercise the following rights at any time by writing to the Shop (section 1) or to the processor (section 2):

1. Access (art. 15);
2. Rectification (art. 16);
3. Erasure ("right to be forgotten", art. 17);
4. Restriction (art. 18);
5. Portability (art. 20);
6. Objection (art. 21);
7. Withdrawal of consent at any time, without affecting the lawfulness of prior processing.

To delete your account and the associated data, you can use the dedicated page: Delete your account.

You may also lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

8. Nature of provision

Providing registration data is mandatory for account creation and loyalty programme participation. Consent to push notifications is optional and revocable without losing other features.

9. Profiling and automated decisions

No automated profiling or individual automated decisions (art. 22 GDPR). Coupons are awarded on objective criteria (registration, birthday, accumulated points).

10. Updates

This notice may be updated; changes will be communicated via the apps and, where required, with new consent.

11. Contacts

• Shop controller (section 1) — direct contact at the point of sale;
• Data processor (section 2) — [email protected]

Last updated: 09/11/2026 — Version 1.1