This notice explains how Biomine S.r.l. processes the personal data of people who visit biomine.it, write to us or interact with our channels. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller and contacts
Biomine S.r.l., Via Asiago 19, 28066 Galliate (NO), Italy. VAT no. IT02589360037.
- Email for privacy matters: privacy@biomine.it
- Certified email (PEC): biomine@twtcert.it
We have appointed a Data Protection Officer (DPO), who can be reached at dpo@biomine.it.
2. What data we process
| Type of data | What it includes | How we collect it |
|---|---|---|
| Browsing and server logs | IP address, date and time, requested page, browser and operating system | automatically, when you visit the site |
| Cookies and statistics | browsing identifiers, pages viewed, visit duration (see the Cookie Policy) | through cookies: technical ones always; statistics and YouTube cookies only with your consent |
| Contact form and email | name, email, subject, message and anything else you choose to write | you enter it in the form or in an email |
| Customers and suppliers | contact details and administrative data of the contact person | contracts, quotes, invoices |
| Applications | what is in your CV and cover letter, if you send them unsolicited | you send it |
| LinkedIn data | name and public profile of people who comment on or react to Biomine page posts; aggregate page statistics | from LinkedIn, not from you (Art. 14 GDPR): today we only see it on the LinkedIn platform (section 9) |
We do not ask for special categories of data (health, opinions, etc.). If you write them in the form, we delete them.
Providing data in the contact form is optional, but without contact details we cannot reply. Data for contracts and invoices is necessary to conclude them and to meet legal obligations.
3. Why we process it and on what basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Reply to your requests and prepare quotes | pre-contractual steps or contract (point b) |
| Perform contracts with customers and suppliers, invoicing | contract (point b) |
| Tax, accounting and legal obligations | legal obligation (point c) |
| Security of the site and contact form, prevention of spam and automated abuse (including Cloudflare Turnstile), technical logs | legitimate interest (point f): protecting the site and the form from abuse |
| Managing the Biomine LinkedIn page and replying to comments | legitimate interest (point f): communicating with people who follow the company |
| Usage statistics with analytics cookies (Google Analytics 4) | consent (point a), which you can withdraw at any time |
| Showing you the YouTube videos embedded in articles | consent (point a), which you can withdraw at any time |
| Assessing an unsolicited application | pre-contractual steps (point b); consent is not required (Art. 111-bis, Italian Legislative Decree 196/2003) |
Where we rely on legitimate interest, we have assessed that your rights do not override it. You can object at any time (section 8).
4. Who receives the data
We do not sell data. It is processed by authorised staff and by providers appointed as processors (Art. 28 GDPR) or acting as independent controllers:
- Hosting: the site runs on Biomine’s own servers in its datacenter in Italy: no external hosting provider.
- Google Ireland Limited: Google Analytics 4 (via Site Kit), visit statistics, only with your consent; YouTube, the videos embedded in articles, only if you consent to watching them. Once the data has been transmitted, Google processes YouTube data as an independent controller.
- Cloudflare, Inc. (United States), Turnstile anti-spam service on the contact form: it receives your IP address, technical browser data (User-Agent, TLS connection fingerprint) and the originating page, to check that the submission does not come from an automated program. It does not read the content of the form. Cloudflare acts as a processor for the check and as an independent controller when it uses this data to improve its own anti-bot systems (Turnstile privacy addendum).
- LinkedIn Ireland Unlimited Company: for company page statistics (Page Insights) LinkedIn and Biomine are joint controllers (Art. 26 GDPR); the arrangement is in the Page Insights Joint Controller Addendum.
- Google Search Console and Microsoft Bing Webmaster Tools only give us aggregate search statistics: we do not send them visitor data.
- Email service provider: sending and receiving the domain’s email: Aruba S.p.A., acting as data processor.
- Advisers and professionals (tax, legal), to the extent necessary.
- Authorities, where required by law.
An up-to-date list of processors is available on written request.
5. Transfers outside the European Union
Google and LinkedIn may transfer data to their group companies in the United States; Cloudflare, Inc. is based in the United States. Transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023) for certified companies and, otherwise, on the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR). You can ask us about the safeguards in place.
6. How long we keep data
| Data | Period |
|---|---|
| Server logs | 12 months |
| Contact form requests and emails | 24 months from last contact |
| Contract and tax data | 10 years (legal obligations) |
| Unsolicited applications | 12 months |
| Google Analytics data | as set in the property: 2 months |
| LinkedIn data read via API | today we do not store it in our systems; with the API integration (section 9): no longer than needed to handle the single post or comment, 12 months at most; tokens deleted on revocation |
After these periods, data is deleted or anonymised.
7. Cookies
The site uses technical cookies, which do not require consent: they remember your language and the choices made in the banner. Only with your consent does it use statistics cookies (Google Analytics 4) and, if you choose to watch a video, YouTube cookies. The Contact page uses Cloudflare Turnstile against spam (section 4). Details, durations and how to change your choice: Cookie Policy.
8. Your rights
At any time you can ask us for (Arts. 15-22 GDPR):
- access to your data and a copy (Art. 15);
- rectification (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- objection to processing based on legitimate interest (Art. 21);
- not to be subject to decisions based solely on automated processing (Art. 22): we do not make any.
Where processing is based on consent, you can withdraw it at any time, without affecting processing already carried out.
To exercise them, write to the address in section 1. We reply within one month, as the GDPR requires.
Complaint. If you believe the processing breaches the law, you can contact the Italian data protection authority (Garante per la protezione dei dati personali): www.garanteprivacy.it, or the authority of your own country.
9. API integrations (LinkedIn, Google, Microsoft)
LinkedIn. We manage the Biomine company page on LinkedIn. If you comment on or react to one of our posts, we see your name and public profile as you would see them on LinkedIn, and we use them only to manage the page and reply to you. For page statistics (Page Insights) LinkedIn and Biomine are joint controllers (section 4). We have asked LinkedIn for access to its page-management APIs: it is not active today and we do not transfer data from LinkedIn to our systems. Once active, Biomine Console, the internal software we use to manage our infrastructure and content, will connect to the APIs through OAuth authorised by the page administrators and will read only the page’s posts, comments received and statistics, for the same purposes and with the retention periods in section 6; we will update this notice before starting. Whoever authorises access will be able to revoke it from LinkedIn settings: on revocation we will delete the tokens. We do not sell the data, do not share it with third parties, do not combine it with other sources and do no profiling or targeted advertising. You can object by writing to us (section 1); data LinkedIn collects on its own account is covered by LinkedIn’s privacy policy.
Google. Google Analytics 4 (via Google Site Kit) is loaded only after you consent to statistics cookies: without consent your browser does not contact Google Analytics. Search Console provides aggregate data on the searches that lead to the site. Google notice: policies.google.com/privacy. Opt-out: tools.google.com/dlpage/gaoptout.
Microsoft. Bing Webmaster Tools provides aggregate data on searches. Microsoft notice: privacy.microsoft.com.
10. Children
The site is aimed at businesses, not at minors. We do not knowingly collect data of children under 14, the age below which consent must come from parents under Italian law (Art. 2-quinquies, Legislative Decree 196/2003). If you think a child has written to us, tell us and we will delete the data.
11. Changes
We may update this notice. The current version is always on this page, with the date below.
Last updated: 12 November 2026