Staff Privacy Policy

Regulation (EU) 2016/679 ("GDPR") — Articles 13 and 14 — management users of the MiBuono Partner app

This notice describes how the personal data of the management users of the MiBuono Partner app (shop owner, manager and staff members) is processed. It is provided, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR"), in addition to the privacy policy addressed to customers.

1. Data Controller

The data controller is the shop that opened the staff account (the "Shop"). Each shop in the MiBuono network is an independent controller of the data of its own staff. The Shop's full identity is published on the Shop's own page: https://<shop-domain>/staff-privacy.php.

2. Data Processor

The SparkLoyal / MiBuono software service is provided by 北京厚土客盛科技有限公司 (Beijing Houtukesheng Technology Co., Ltd.) as data processor (art. 28 GDPR), acting on behalf of the Shop under a service contract governing confidentiality, security and sub-processors.

Company name: 北京厚土客盛科技有限公司 (Beijing Houtukesheng Technology Co., Ltd.)
Address: 北京市丰台区丰管路甲1号北楼二层202-1236室 (Room 202-1236, 2nd Floor, North Building, No. 1A, Fengguan Road, Fengtai District, Beijing, China)
Tax ID (Unified Social Credit Code): 91110106MAKNWQLK7W
Privacy contact: [email protected]

3. Data we process about staff

Account data: display name, e-mail address, role (manager / staff). The password is stored only in hashed form and is never readable by the Shop or the Processor;
Operational data: access logs, audit log of management actions (coupon issuance, booking changes, points adjustments, deletions), IP address, user agent, date and time of the action;
Device and notification data (only if you enable notifications on your device): the push notification identifier of your device (push token / cid), together with the app platform, used to deliver operational notifications (e.g. new bookings, expiry reminders).

We do not process payment data of staff (payments are handled outside the apps), nor biometric data, health data or other special categories of personal data (art. 9 GDPR).

4. Purposes and legal bases

Purpose	Legal basis
Creation and management of the staff account, assignment of roles and access to the management functions	Performance of contract and secure service provision (art. 6(1)(b) and (f) GDPR)
Security of the app, prevention of misuse, recording and audit of management actions	Legitimate interest (art. 6(1)(f) GDPR)
Operational push notifications (new bookings, reminders, shop communications)	Legitimate interest and performance of contract (art. 6(1)(f) and (b) GDPR), revocable by disabling notifications on the device
Compliance with legal, accounting and fiscal obligations	Legal obligation (art. 6(1)(c) GDPR)

5. Processing methods and retention

Data is processed electronically on servers hosted in the European Union, with appropriate security measures (password hashing, HTTPS, role-based access control, audit logs, backups).

Account data is retained for the duration of the staff account and deleted or anonymised within 30 days of the account being disabled, except where retention is required by law;
security and audit logs are retained for the time strictly necessary for security purposes and in any case no longer than 12 months, unless they are needed to establish, exercise or defend legal claims;
accounting documentation is retained for 10 years as required by Italian law.

6. Sharing and transfer of data

Staff data is never sold or shared with third parties for marketing. It may be disclosed only to:

hosting and technical maintenance providers acting as processors — servers located in the EU (data centre in Germany);
transactional e-mail providers — sending of confirmation messages and verification codes;
the unified push provider (Getui, through the uniCloud function service) — processing takes place on servers located in China, limited to the device push identifier and the notification content (which does not contain customer personal data);
the device vendor push channels and Google FCM — offline delivery of notifications; processing may take place on servers located outside the EU (including the United States);
public authorities where required by law.

Any transfer outside the EEA is carried out under art. 28 GDPR and with the safeguards of arts. 44 et seq. GDPR (standard contractual clauses and the guarantees offered by the providers).

7. Your rights

You may exercise the following rights at any time by writing to the Shop (section 1) or to the Processor (section 2):

Access to your data (art. 15);
Rectification of inaccurate data (art. 16);
Erasure ("right to be forgotten", art. 17);
Restriction of processing (art. 18);
Portability (art. 20);
Objection to processing based on legitimate interest (art. 21);
Withdrawal of consent at any time, without affecting the lawfulness of prior processing.

You may also lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).

8. Nature of provision

Providing your account data is necessary to be authorised to use the management app and its functions. Enabling push notifications is optional and revocable at any time from the device or app settings, without affecting the use of the other functions.

9. Confidentiality obligations

Staff members who access the app are bound to confidentiality regarding the personal data of customers and colleagues they process, and may use it only for the purposes strictly connected with their role, in accordance with the Shop's instructions.

10. Profiling and automated decisions

No automated profiling or individual automated decisions are carried out on staff (art. 22 GDPR).

11. Updates

This notice may be updated; material changes will be communicated through the app and, where required, with new consent.

12. Contacts

Shop controller (section 1) — direct contact at the point of sale;
Data processor (section 2) — [email protected]

Last updated: 13/10/2026 — Version 1.0