Privacy notice

This notice explains how we process the personal data of people who visit the website and contact us, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Last updated: 4 November 2026

1. Data controller

BM Colloca S.r.l., Zona Industriale, Località Aeroporto, s.n.c., 89900 Vibo Valentia (VV), VAT no. and tax code 03865500791.

For any question about your data, write to [email protected] or, for communications with legal value, to our certified email (PEC) [email protected]. We have not appointed a Data Protection Officer (DPO), as it is not required for our activity.

2. What data we process

• Request form data: full name, phone, email (optional), job location, product of interest, description of the request and any attachments (photos, drawings or PDFs).
• Data you send us directly: whatever you tell us by phone, email or WhatsApp.
• Technical browsing data: IP address and browser information, processed by Cloudflare's systems to run the website and protect it from spam and abuse. We do not use analytics or profiling tools.

Please do not include data that isn't needed for your request, especially health data or other special categories of data, and avoid photos in which people can be recognised.

3. Why we process them and on what legal basis

• Answering your request, preparing the quote and, if needed, arranging a site visit: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
• If the request becomes a job: performing the contract (Art. 6(1)(b)) and meeting accounting and tax obligations (Art. 6(1)(c)).
• Protecting the website and form from automated submissions and abuse: our legitimate interest in security (Art. 6(1)(f)).
• Defending our rights in case of disputes: legitimate interest (Art. 6(1)(f)).

We do not use your data to send you marketing communications and we never sell it.

4. Required and optional data

Name, phone and a description of the request are needed to answer you: without them we cannot handle the request. Email and attachments are optional.

5. How we process them

Using electronic tools and appropriate security measures: encrypted connection (HTTPS), attachments downloadable only through personal, expiring links, and access limited to authorised staff. We do not make decisions based solely on automated processing and we do not profile you.

6. How long we keep them

• Requests that don't become a job: 12 months from the last contact, after which we delete them.
• Attachments uploaded with the form: they are kept on servers in the European Union and deleted automatically after 30 days. Any copies we keep to prepare the quote follow the same retention as the request.
• If the request becomes a job: for the whole relationship and then for 10 years, as required for accounting and tax records (Art. 2220 of the Italian Civil Code).
• Technical browsing data: only for as long as needed to keep the website secure.

7. Who we share them with

• Authorised BM Colloca staff and collaborators.
• Cloudflare, Inc.: hosts the website, stores attachments on servers in the European Union, sends the form emails to the company and protects the website (Turnstile anti-spam). It acts as our processor; to improve its anti-bot systems it processes some technical data as an independent controller.
• Google: provides the email inbox (Gmail) where we receive requests and messages.
• WhatsApp (Meta): only if you choose to contact us on WhatsApp; the messaging service is governed by WhatsApp's privacy policy.
• Google Maps: only if you load the map on the Contact page (see the cookie policy).
• Our accountant, advisers and public authorities, when the request becomes a job or the law requires it.

Your data is never made public.

8. Transfers outside the European Union

Attachments stay on servers in the European Union. Cloudflare, Google and Meta are US companies or part of US groups: any transfer of data to the United States is based on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or on the standard contractual clauses approved by the Commission.

9. Your rights

You can ask us at any time to access, correct or delete your data, restrict its processing or receive it in a readable format (Articles 15-20 GDPR), and object to processing based on legitimate interest (Article 21). Write to [email protected] or to our PEC [email protected]: we will reply within one month.

If you believe the processing is unlawful, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. Changes

If the way we process data changes, we will update this page and the date at the top.