Privacy and cookies

This policy explains what personal data we collect through heawendistribution.com, why we collect it and what your rights are. It is provided under Article 13 of Regulation (EU) 2016/679 (GDPR).

1. Data controller

B.M.B. S.r.l.s., registered office at Via Cipro 1, 25124 Brescia, Italy, VAT no. IT04354110985.
For any privacy question you can write to support@heawendistribution.com.

2. What data we collect

Data you send us through the forms

• Contact form: full name, email, phone (optional), subject and message.
• B2B retailer form: company name, full name, email, phone (optional), type of business, country, PEC (optional) and message.

Please don't include unnecessary personal data in your messages, especially information about your health.

Browsing data

Like any website, the server hosting the site automatically records some technical data about visits (IP address, date and time, requested page, browser type) in its log files. This data is used to keep the site running and secure, and is not used to identify you.

In addition, to protect the forms from repeated and abusive submissions, when you send a form the site records the time of submission together with a code derived from your IP address (not the address itself), and uses it only to limit the number of submissions over the following 10 minutes.

3. Why we process it and on what legal basis

• Replying to your requests for information, price lists or commercial terms: processing is necessary to act on your request (Art. 6(1)(b) GDPR). Your consent is not required.
• Site security (browsing data): the controller's legitimate interest in protecting the site from abuse (Art. 6(1)(f) GDPR).

We don't use your data to send you newsletters or promotional messages, and we don't use it for profiling. We don't make decisions based solely on automated processing (Art. 22 GDPR).

4. Do you have to provide your data?

Fields marked with an asterisk are required: without them we can't reply to you. All other fields are optional.

5. How we handle your data and who receives it

Messages sent through the forms reach us by email and are read only by the people who handle them on behalf of the controller. The data may also be processed by:

• Hosting provider: Namecheap, Inc., which hosts the site on servers located in the Netherlands (European Union), acting as data processor.
• Email provider: Namecheap, Inc. (Private Email service), which manages the company mailboxes that receive the messages sent through the forms, acting as data processor. The mail servers are located in the United States.
• Advisors (for example accountants or lawyers), only where necessary and bound by confidentiality.

Transfers outside the European Union. Namecheap, Inc. is based in the United States, where the mail servers are located. Any transfer of data to the United States, including any access from the US for technical support on the site's European server, is based on the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), included in Namecheap's Data Processing Addendum, where you can read them.

We don't sell your data or share it with third parties.

6. How long we keep it

• Form requests: for as long as needed to handle them and in any case no longer than 24 months after the last contact, unless the request leads to a business relationship: in that case the data is kept for the period required by law.
• Browsing data: for 30 days, after which it is deleted.
• Data used to limit form submissions: 10 minutes, after which it is no longer used.

7. Your rights

At any time you can ask to access, correct or delete your data, restrict its processing, object to processing based on legitimate interest and receive your data in a commonly used, machine-readable format (portability). If we ever ask for your consent for other purposes, you'll be able to withdraw it at any time.

To exercise your rights, write to support@heawendistribution.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority in your country.

8. Cookies

This site does not use cookies: no technical cookies, and no analytics or profiling cookies. We don't use statistics tools such as Google Analytics and we don't embed third-party content (videos, maps, social buttons). Even the typeface is served directly from our own domain, with no connection to external services. That's why we don't show you a cookie banner.

Age confirmation. When you confirm that you are 18 or older, the site saves this confirmation in your browser's storage (localStorage) for 30 days, so we don't ask you on every visit. The information stays on your device, is not sent to us or to third parties and contains no personal data. It is a technical tool, needed to show you the site, and does not require consent. You can delete it at any time from your browser settings (site data).

Links to Instagram open Meta's website: from that point, Meta's policies apply.

If we add tools that use cookies in the future, we'll update this page and, where required, ask for your consent before enabling them.

9. Minors

HEAWEN products are for adults only. We don't knowingly collect data from people under 18.

10. Changes

We may update this policy, for example if the services we use change. The date of the last update is shown at the top of the page.