Privacy Policy

1. Data Controller

The Data Controller is:

Barbara Bassani — Founder of cluBBart
Email: info@clubbart.it
Website: www.clubbart.it

2. Personal data collected

The platform collects the following categories of personal data:

2.1 Data provided directly by the user

• Registration data: first name, last name, email address, password (stored in encrypted form), account type (private, restorer, company)
• Restorer profile: profile photo, specialisation, city, province, years of experience, phone, professional email, PEC, website, social links, biography, education, certifications, courses, internships, types of intervention, techniques, materials, tools, project portfolio and images
• Company profile: legal name, trade name, owner data, logo, year of foundation, city, province, operating areas, number of collaborators, phone, email, PEC, website, social links, company description, values, project approach, certifications, professional register memberships, institutional collaborations, awards, types of intervention, materials, techniques, diagnostic tools, project portfolio and images, team introduction
• Listings: title, description, type, city, province, images, category-specific data (urgency, level, mode, condition, shipping)
• Listing applications: name, email, phone, message
• Forum content: title, text content, category (with option for anonymous posting)
• Restoration articles: title, abstract, author's first and last name, city, type of work, PDF file, cover image
• Events: title, description, category, poster, images, dates, venue, address, geographic coordinates (optional), external link
• Comments: text of comments on articles and events

2.2 Data collected automatically

• Session data: IP address, browser User-Agent, encrypted session data, last activity timestamp
• Interaction data: liked content, saved content, article and forum discussion views, article downloads

2.3 Data NOT collected

The platform does not use third-party tracking tools (Google Analytics, tracking pixels, etc.), does not carry out automated profiling for advertising purposes and does not share data with third parties for marketing purposes.

3. Purposes and legal basis of processing

4. Processing methods

Personal data is processed using IT and electronic tools, with logic strictly related to the stated purposes and, in any case, in a manner that ensures the security and confidentiality of the data.

Passwords are stored in encrypted form (bcrypt) and are never accessible in plain text. OTP codes for verification are valid for a maximum of 10 minutes.

5. Data communication and disclosure

Personal data is not sold, transferred or disclosed to third parties for marketing purposes.

Data may be disclosed to:

• Hosting provider: O2Switch (server located in France, EU) — for the provision of hosting services
• SMTP email provider: O2Switch — for sending transactional emails
• Google Fonts: loading of Epilogue and Figtree fonts via Google CDN (no personal data transmitted to Google beyond the IP address required for font download)

Some user data is publicly visible on the platform by nature of the service offered:

• Approved restorer and company profiles (professional data, portfolio, professional contacts)
• Published listings (with author's name, except anonymous forum posts)
• Forum discussions, articles, events and related comments

6. Data retention

• Account data: retained for the entire duration of the membership and for 30 days following account deletion
• Published content (listings, articles, forum, events): retained for the entire duration of the membership. In case of account deletion, already published content may be anonymised and retained for the integrity of discussions
• Session data: retained for the duration of the session (maximum 120 minutes of inactivity)
• OTP codes: automatically deleted after 10 minutes
• Unverified accounts: automatically deleted 24 hours after registration

7. Data subject rights

Pursuant to Articles 15-22 of the GDPR, the user has the right to:

• Access (Art. 15): obtain confirmation of the existence of their data and receive a copy
• Rectification (Art. 16): request the correction of inaccurate data or the completion of incomplete data
• Erasure (Art. 17): request the deletion of personal data ("right to be forgotten")
• Restriction (Art. 18): request the restriction of processing in certain circumstances
• Portability (Art. 20): receive personal data in a structured, commonly used and machine-readable format
• Objection (Art. 21): object to the processing of personal data on legitimate grounds
• Withdrawal of consent (Art. 7.3): withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

To exercise their rights, the user can send a request to: info@clubbart.it

The Controller undertakes to respond within 30 days of receiving the request.

8. Complaint to the Supervisory Authority

The user has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali):

Italian Data Protection Authority
Piazza Venezia 11 — 00187 Roma
Email: protocollo@gpdp.it
PEC: protocollo@pec.gpdp.it
Website: www.garanteprivacy.it

9. Cookies

The platform uses only technical cookies necessary for the operation of the service (session management, authentication, CSRF protection). No profiling or third-party cookies are used for advertising purposes.

For more details, see our Cookie Policy.

10. Data transfer outside the EU

Personal data is stored on servers located in the European Union (France — O2Switch). No transfer of personal data to third countries outside the EU/EEA takes place, with the exception of font loading via Google Fonts (whose use involves the transmission of the IP address to Google's server, protected by standard contractual clauses pursuant to Art. 46.2.c GDPR).

11. Minors

The platform is not intended for persons under 16 years of age. We do not knowingly collect personal data from persons under 16. If the Controller becomes aware that data has been collected from a minor without parental or guardian consent, it will proceed with its deletion.

12. Changes to this privacy policy

The Controller reserves the right to modify this privacy policy at any time. Changes will be published on this page with an indication of the last update date. Continued use of the platform after the publication of changes constitutes acceptance thereof.