Skip to content
BIMON

Privacy policy

Last updated:

Data controller

The data controller for personal data collected through bimon.it is BIMON S.r.l. (single-member company), Via Velletri 35, 00198 Rome, Italy, VAT no. IT13444611001.

We also have offices in Milan (Piazza Città di Lombardia 1) and Padua (P.zza A. De Gasperi 28, c/o Adhox).

For any question about this notice or your data, write to info@bimon.it or call +39 06 85383064.

Data Protection Officer (DPO)

BIMON has not appointed a Data Protection Officer (DPO), as none of the cases set out in Art. 37 GDPR applies. For any privacy matter, write to info@bimon.it.

Scope of this notice

This notice, provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code), explains which personal data we process when you visit bimon.it, write to us, use our free tools or apply for an open position.

For details on cookies and similar technologies, see our cookie policy.

Contact requests, quotes and tools

When you fill in the contact form or the form to receive the results of one of our tools (for example the BIM Mandate Checker or the calculators), we collect:

  • first and last name, email, company and role;
  • phone number, only if you choose to provide it;
  • topic and text of your message;
  • for tools, also the data you entered and the results obtained.

Why we use them: to answer your request, send you the report and, if you ask for it, prepare a quote.

Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and, where relevant, our legitimate interest (Art. 6(1)(f) GDPR) in following up on the requests we receive, for example by contacting you again on the same topic.

How we handle them: your message reaches us by email via Resend (Resend Inc., USA) and is stored in the HubSpot CRM (HubSpot Inc. / HubSpot Ireland). We reply from our company mailboxes, run on Microsoft 365.

How long: if the request does not lead to an engagement, we keep the data for 24 months from the last contact, after which we delete them or make them anonymous. If a contract follows, we keep them for the duration of the relationship and, once it ends, for 10 years to meet accounting and tax obligations (Art. 2220 of the Italian Civil Code) and for the limitation periods needed to protect our rights.

Newsletter

If you sign up for our newsletter, we collect:

  • email address;
  • chosen language;
  • the page you signed up from and the signup date.

Why we use them: to send you the BIMON newsletter, with new Insights articles, the yearly BIM tender observatory and events.

Legal basis: your consent (Art. 6(1)(a) GDPR), collected with double opt-in: your subscription becomes active only after you click the confirmation link we send you by email.

How we handle them: emails are sent via Resend (Resend Inc., USA) and, where we use it, the data are also stored in the HubSpot CRM (HubSpot Inc. / HubSpot Ireland).

How long: until you unsubscribe, using the link in every email or by writing to info@bimon.it. After you unsubscribe, we keep only your email address in a suppression list, so that we do not write to you again.

Withdrawal: you can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Job applications

If you apply through our careers page or by email, we process the data in your CV and in the message you send us: personal and contact details, education and work history, any attachments.

Why we use them: to assess your application and run the selection process.

Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).

Where we store them: in our company mailbox on Microsoft 365 and, if you apply through the site form, also in the HubSpot CRM. Only the people handling recruitment can access them.

How long: 12 months from receipt, after which we delete them, unless you agree to let us keep them longer for future openings. You can ask us to delete them earlier.

Please do not include in your CV any data that is not needed for the selection, in particular health data, religious or political beliefs and the other special categories of data listed in Art. 9 GDPR.

Browsing data and hosting

The site is hosted by Vercel Inc. (USA). Like any web service, the servers log some technical data about requests, such as IP address, date and time, requested page, response status, browser type and operating system.

Why we use them: to run the site, keep it secure and detect abuse or malfunctions.

Legal basis: our legitimate interest in the security and proper functioning of the site (Art. 6(1)(f) GDPR).

How long: for the short period set by the hosting service (generally no more than 30 days), for security and debugging purposes. We do not use these logs to profile visitors.

Anonymous, cookieless statistics

To know how many people visit the site, how they use it and how fast the pages load, we use two services that store nothing in your browser.

Vercel Web Analytics and Speed Insights only give us aggregate data on visits and performance, without cookies and without identifying individual visitors.

PostHog in cookieless mode (PostHog Inc., data hosted in the European Union, in Frankfurt, reached through our own domain) is active for every visitor from the first page. It records pages viewed, clicks, scrolling, the referring page, the approximate country derived from the request, and the type of device and browser. In this mode PostHog:

  • uses no cookies, localStorage or sessionStorage;
  • does not record browsing sessions;
  • assigns no persistent identifier: to count visits it uses a code calculated on the server from IP address, user agent and a value that rotates daily, so the code changes every day and is not stored in readable form;
  • does not store your IP address.

We also record, anonymously, some usage events of our free tools, for example the BIM Mandate Checker outcome and a value band, never the exact amount. We use them to improve the tools and publish aggregate statistics.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving the site. No consent is needed because nothing is stored on or read from your device beyond what is technically necessary, with safeguards equivalent to those set out for analytics cookies in the Italian Data Protection Authority guidelines of 10 June 2021.

Objection: you can object at any time (Art. 21 GDPR) by writing to info@bimon.it. You can also turn on your browser's tracking protection.

How long: we keep events for up to 12 months.

Full behaviour analytics (with your consent)

If you click "Accept" in the cookie banner, PostHog switches to full mode, to understand better how the site is used and where to improve it. In addition to the data described above, it:

  • stores an identifier in cookies and localStorage (ph_<project>_posthog and other keys with the prefix ph_, up to 1 year), so it recognises your browser when you come back;
  • records browsing sessions, in which all form inputs are masked: what you type is not recorded.

If you click "Reject", or make no choice, PostHog stays in cookieless mode.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

Withdrawal: you can withdraw your consent at any time from the "Cookie preferences" link in the footer, which reopens the banner. If you reject after accepting, we delete PostHog's cookies and stored data from your browser and go back to cookieless mode. Withdrawal does not affect the lawfulness of processing carried out before it.

How long: we keep events for up to 12 months and session recordings for up to 30 days, after which they are deleted. BIMON sets these limits in the PostHog project.

In this mode PostHog also stores the IP address with the events, to derive the approximate country and city of the visit. The IP follows the same retention period as the events (up to 12 months).

Your cookie choice

The cookie banner has two buttons, "Accept" and "Reject", and a link to the cookie policy. Your choice is saved in your browser, in the localStorage key bimon-consent. It is technical data used only to remember your decision and does not require consent. It is valid for 6 months, after which the banner is shown again. You can change your choice at any time from the "Cookie preferences" link in the footer or the button in the cookie policy.

In-browser tools and third-party content

The IFC Viewer processes models entirely in your browser: the file is never uploaded to our servers or sent to third parties.

The site does not embed third-party content, such as videos, maps or social widgets, that could collect data while you browse.

Who we share data with

Data are processed by authorised BIMON staff and by the providers that help us run the site and our communications, acting as data processors (Art. 28 GDPR). A data processing agreement under Art. 28 GDPR is in place with each of them, as part of their terms of service or data processing addendum:

  • Vercel Inc. (USA): hosting, technical logs and cookieless statistics;
  • Resend Inc. (USA): email delivery of messages sent through the forms;
  • HubSpot Inc. / HubSpot Ireland: CRM for managing requests;
  • PostHog Inc.: cookieless statistics and, only with your consent, full behaviour analytics, with data hosted in the EU;
  • Microsoft (Microsoft 365): company email we use to reply to requests.

We do not sell your data or share them with third parties for marketing. We disclose them to authorities only when required by law.

Transfers outside the European Union

Some providers are based in the United States (Vercel, Resend, HubSpot). In these cases, transfers rely on the EU-US Data Privacy Framework for certified providers, or on the standard contractual clauses approved by the European Commission (Arts. 45 and 46 GDPR).

Data collected with PostHog are hosted in the EU, in Frankfurt; any access from the United States by PostHog Inc. is covered by the EU-US Data Privacy Framework and/or the standard contractual clauses. Microsoft 365 data are stored in the EU (EU Data Boundary), and any transfer is covered by the EU-US Data Privacy Framework and the standard contractual clauses.

You can ask for information on the safeguards in place by writing to info@bimon.it.

How long we keep data

In short:

  • contact requests and tool forms that do not lead to an engagement: 24 months from the last contact;
  • data linked to an engagement: duration of the relationship, then 10 years for accounting and tax obligations, plus the applicable limitation periods;
  • newsletter: until you unsubscribe, then only the address in a suppression list;
  • job applications: 12 months from receipt, unless you agree to a longer period;
  • server technical logs: generally no more than 30 days;
  • analytics data collected with PostHog: events up to 12 months; session recordings, only with consent, up to 30 days; the daily code used in cookieless mode changes every day;
  • cookie choice (bimon-consent): 6 months.

When these periods expire, we delete the data or make them anonymous.

Providing your data

Providing your data is optional. Without the data marked as required in the forms, however, we cannot answer your request, send you the report or assess your application.

Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The results of our free tools are indicative estimates for your own use.

Your rights

Under Arts. 15–22 GDPR, you can ask us at any time for:

  • access to your data and a copy of them;
  • rectification of inaccurate or incomplete data;
  • erasure of your data;
  • restriction of processing;
  • portability of the data you provided, in a commonly used format;
  • objection to processing based on our legitimate interest;
  • withdrawal of consent, without affecting processing already carried out.

To exercise these rights, write to info@bimon.it. We will reply without undue delay and in any case within one month, a period that may be extended in the cases set out in Art. 12 GDPR.

Complaints to the supervisory authority

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

Changes to this notice

We update this notice when the site's services or the law change. The date of the latest update is shown at the top of the page.