This Privacy Policy describes how we process personal data when you use the website bcaun.it, operated by BCA BUSINESS LTD, a Private Limited Company incorporated in the United Kingdom.

We comply with:

• the EU General Data Protection Regulation (GDPR),
• the UK GDPR and the Data Protection Act 2018,
• relevant European and international data-protection standards.

1. Data Controller

BCA BUSINESS LTD
128 City Road
London
United Kingdom, EC1V 2NX

Email: benvenuto@bcaun.it
Website: bcaun.it

BCA BUSINESS LTD acts as the Data Controller under both EU GDPR and UK GDPR.

BCA BUSINESS LTD is registered with the Information Commissioner’s Office (ICO) as a data controller under the UK GDPR.
ICO Registration Number: ZC027486.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

a) Identification data

• Name, surname
• Passport or national ID (required for SPID, PEC, Firma Digitale and identity procedures)
• National identification numbers (Codice Fiscale, NIE, NIF, UK NI—if applicable)

b) Contact data

• Email address
• Phone number
• Postal address
• PEC address (if provided)

c) Digital identity & compliance data

• Information required for SPID activation
• Information required for PEC setup
• Data for Firma Digitale / electronic signatures
• Uploaded documents, filings, forms, certificates
• Cross-border administrative documentation

d) Technical data

• IP address
• Browser details
• Device type
• Cookies and analytics identifiers
• Hosting logs (Dondominio infrastructure)

e) Communication data

• Emails and support tickets
• Correspondence via PEC
• Documentation exchanged for service provision

We do not process biometric data unless strictly required for digital signature issuance and only in compliance with applicable law.

3. Purpose and Legal Basis of Processing

Service delivery

To provide digital identity services (SPID, PEC, Firma Digitale), virtual presence packages, identification numbers, and cross-border compliance.
Legal basis: Art. 6(1)(b) GDPR / UK GDPR Art. 6(1)(b).

Legal obligations

To verify identity, maintain security, fulfill administrative requirements in the EU and the UK.
Legal basis: Art. 6(1)(c) GDPR / UK GDPR Art. 6(1)(c).

Legitimate interests

To operate the website, prevent misuse, improve service quality, and maintain internal administration.
Legal basis: Art. 6(1)(f) GDPR / UK GDPR Art. 6(1)(f).

Consent

For analytics tools, cookies and optional marketing communications.
Legal basis: Art. 6(1)(a) GDPR / UK GDPR Art. 6(1)(a).

4. Processing Under UK GDPR

For users located in, or serviced from, the United Kingdom, BCA BUSINESS LTD processes personal data in compliance with the UK GDPR and the Data Protection Act 2018.

BCA BUSINESS LTD is formally registered with the Information Commissioner’s Office (ICO) as a data controller.
ICO Registration Number: ZC027486.

Cross-border transfers between the UK and the EU are conducted on the basis of approved safeguards, including Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), and additional technical measures where required.

5. International Transfers

Our operations involve cooperation with partners in the EU, the UK, and jurisdictions such as Bahrain and the United Arab Emirates.

When transferring data outside the EU or UK, we use:

• Standard Contractual Clauses (SCCs)
• UK IDTA
• Adequacy mechanisms
• Appropriate technical safeguards

6. Hosting & Infrastructure

The bcaun.it domain is registered through DonDominio, which provides hosting infrastructure and DNS services.
Standard hosting logs may be automatically collected for security and technical operation.

7. Data Retention

We retain personal data only for as long as necessary for:

• fulfilling a contract,
• complying with regulatory obligations,
• administrative or audit requirements,
• maintaining digital identity functionality.

Documents used for SPID, PEC and Firma Digitale are retained only for the duration required to complete activation or ongoing support.

8. Your Rights

You have the following rights under EU GDPR and UK GDPR:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right to withdraw consent
• Right to lodge a complaint

EU users: contact your national Data Protection Authority.
UK users: contact the Information Commissioner’s Office (ICO).

9. Data Security

We apply technical and organizational measures including:

• encrypted communication
• secure storage
• restricted access
• controlled retention periods
• secure handling of electronic signatures and PEC documents
• continuous monitoring of hosting infrastructure

10. Cookies

We use cookies for essential website functions and, with consent, analytics.
A dedicated Cookie Policy is available on the website.

11. Third-Party Services

We may use trusted providers for:

• hosting (Dondominio or sub-providers)
• analytics
• digital identity verification
• PEC and signature infrastructure
• secure electronic document processing

All third-party providers are bound by GDPR/UK GDPR-compliant agreements.

12. Children’s Data

We do not provide services to individuals under 18 years of age.

13. Updates to This Policy

We may update this Privacy Policy to reflect regulatory or operational changes.
The latest version will always be available at bcaun.it/privacy.

14. Contact

For privacy-related requests:

BCA BUSINESS LTD
128 City Road
London, EC1V 2NX
United Kingdom

Email: benvenuto@bcaun.it

ICO Registration Number: ZC027486.

For UK-specific requests, please include “UK Data Rights Request” in the subject.