Privacy Policy

Privacy Policy

This Privacy Policy describes how personal data of users interacting with the beCoworking.it website is processed by Nexia Srl, in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data Controller

The Data Controller is Nexia Srl, with registered office at Viale Monza 347, 20126 Milano, operational office at Via Antonio Meucci 1, 63822 Porto San Giorgio (FM), registered in the Italian Business Register under no. REA MI 2513122.

For privacy requests, the Data Controller can be contacted:

• through the contact form, writing "Privacy" in the subject;
• by certified email (PEC) at pec [at] pec.nexia.it (it only accepts messages from PEC addresses);
• by post to Nexia Srl, Viale Monza 347, 20126 Milano, Italy, for the attention of the privacy contact;
• by phone at +39 0734 2787 87.

No Data Protection Officer (DPO) has been appointed, as none of the conditions set forth in Art. 37 GDPR apply.

2. Categories of data collected

• Contact form data: name, email address, phone number (optional), message content.
• Booking form data: first and last name, email, phone, type of space booked (hot desk, meeting room), date and time slot, additional notes.
• Payment data: payments are processed exclusively through Stripe. Card details are entered directly into Stripe's systems and never transit through or are stored on beCoworking.it servers. The site only receives the transaction outcome, a payment identifier and the last 4 digits of the card for reconciliation purposes.
• Server logs: for technical and security purposes, the server automatically records IP address, browser user-agent, request date and time, requested URLs and HTTP response codes.
• Technical cookies: as detailed in the Cookie Policy.

3. Purposes of processing

• Replying to enquiries submitted via the contact form.
• Managing bookings of workstations and spaces, including confirmation, changes and transactional emails (booking confirmation, receipt, reminders).
• Processing payments through Stripe and issuing the related tax documents.
• Complying with accounting, tax and legal obligations.
• Ensuring website security and preventing abuse (logs).

No profiling, direct marketing, newsletter or statistical analysis activities are carried out. The site does not use Google Analytics, Meta Pixel or similar tools.

4. Legal basis

• Art. 6(1)(b) — performance of a contract: for booking and payment management.
• Art. 6(1)(c) — legal obligation: for retention of accounting and tax records.
• Art. 6(1)(f) — legitimate interest: for website and infrastructure security (logs).
• Art. 6(1)(a) — consent: for voluntary submission of information via the contact form.

5. Recipients of the data

• Stripe Payments Europe, Ltd. (Ireland) — for payment processing. Stripe may transfer data outside the EEA on the basis of the Standard Contractual Clauses approved by the European Commission.
• Hosting provider — server located within the European Union.
• SMTP provider used to send transactional emails via the nodemailer library.
• Accounting and tax advisors of the Data Controller, for legal compliance.
• Public authorities, upon reasoned request and in the cases provided for by law.

Data is not disseminated or sold to third parties for commercial purposes.

6. Retention period

• Contact form data: 24 months from the last communication, unless converted into a client relationship.
• Booking and payment data: 10 years from the date of the transaction, due to civil and tax obligations (Art. 2220 of the Italian Civil Code).
• Server logs: 30 days, except where required for security incident investigation.

7. Rights of the data subject

Users may exercise at any time the rights granted by Arts. 15-22 GDPR, in particular:

• Access (Art. 15);
• Rectification (Art. 16);
• Erasure (Art. 17), subject to legal retention obligations;
• Restriction of processing (Art. 18);
• Data portability (Art. 20);
• Objection (Art. 21);
• Withdrawal of consent, where applicable, without affecting the lawfulness of prior processing.

Requests may be sent using the contact details in section 1 (contact form, PEC or post). Users also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of their country of residence.

8. Changes to this policy

This Privacy Policy may be updated at any time, including to reflect regulatory changes or service evolution. The current version is always published on this page along with the last update date.