Privacy Policy (2.0)
Tenant Privacy Policy — v2.0
Issued under Articles 13 and 14 GDPR.
1. Controller
BlueStarSystem di Juri Montico, registered office Dorsoduro, 2408/D - 30123 Venezia (VE), email privacy@flabio.com, certified email (PEC) info@pec.bluestarsystem.it. Data protection officer: dpo@flabio.com.
2. Data processed, and why
| Purpose | Legal basis | Data |
|---|---|---|
| Performance of the SaaS contract | Art. 6(1)(b) | Identifying and tax details, contact details, published content |
| Invoicing and tax obligations | Art. 6(1)(c) | Tax details, transactions |
| Security and fraud prevention | Art. 6(1)(f) | Access logs, IP address, user agent, webhook fingerprints |
| Anti-money laundering (Legislative Decree 231/2007) | Art. 6(1)(c) | Identity documents, bank details |
| Operational communications | Art. 6(1)(b) | Email address, telephone number |
| Direct marketing of our own similar services | Art. 6(1)(f) (legitimate interest — soft opt-in) | Email address; opt-out in every message |
| Marketing of new products and partnerships | Art. 6(1)(a) (consent) | Email address; consent may be withdrawn |
3. AI features
In accordance with Regulation (EU) 2024/1689 (the AI Act), Flabio declares that the only AI-based feature is machine translation of menu text (sections, dishes, descriptions) through the DeepL service (DeepL SE, Germany).
- The feature is classified as minimal risk under the AI Act.
- No automated decisions with legal effects are taken about the tenant or about data subjects.
- Translations can always be edited by the storeholder, before and after publication.
- Final editorial responsibility rests with the storeholder.
The menu text sent to DeepL for translation is handled subject to DeepL's own privacy notice. Flabio sends DeepL no other personal data: no customer names, no reviews, no content identifying an individual.
4. Sub-processors and transfers outside the EU
See t_dpa § 7 and § 9 for the full list and the basis for each transfer (SCCs and the EU-US DPF).
5. Retention
| Type | Period |
|---|---|
| Account data in use | For the duration of the relationship |
| Grace period after termination | 30 days |
| Statutory accounting records | 10 years (Article 2220 of the Italian Civil Code) |
| Anti-money-laundering documents | 10 years (Legislative Decree 231/2007) |
| Access logs | 12 months |
| Backups | 30 days, rolling |
| Marketing data after consent is withdrawn | Deleted immediately, save for the proof-of-consent log |
| Pseudonymised data for analytics | 24 months, in aggregate form |
6. Your rights
Access, rectification, erasure (anonymisation), restriction, portability, objection, and complaint to the Italian supervisory authority (garanteprivacy.it).
How to exercise them: dpo@flabio.com or the /admin/account panel. We reply within 30 days (60 in complex cases, on notice).
7. Automated decisions
Flabio takes no automated decisions with legal effects for the tenant. The algorithms in use (mini-site ranking priority, pricing suggestions) are informational and support human decisions.
8. Cookies
See t_cp (the cookie policy specific to the admin panel).
9. Changes
Notified by email 30 days in advance. Changes required by law may take effect on shorter notice.
END OF DOCUMENT — v2.0 — 13 July 2026