Privacy Policy

This document has been specifically drawn up in order to inform the “User”, the “Partner User” and/or the person to whom the products/services purchased by the User are possibly addressed (hereinafter, the “Recipient”) - regarding the processing of your personal data carried out by the Company 3Bee S.R.L. through this Website (hereinafter, the “Site”, https://www.xnatura.com, https://www.ilovenatura.com or https://www.3bee.com/) as well as through the Platform / App reachable through the following link https://www.3bee.com/ (hereinafter, the “Platform / App”).

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter, “GDPR”) the following information is provided to you:

1. PREMISES
   • Forecasts valid and applicable to all types of interested parties: “Users”, “Recipients” and “Partner Users”.
2. USER
   • (A) “User” Information ex. Art. 13 GDPR
   • (B) “Recipient” Information ex. Art. 14 GDPR
3. PARTNER USER
   • “Partner User” Information ex Art. 13 GDPR

1. Premises

DATA CONTROLLER

The Data Controller - as defined pursuant to Art. 4, co. 1, no. 7) of the GDPR – is the Company 3BEE S.R.L. with registered office in Trezzo sull'Adda (MI), Via Volta n. 4, VAT number, tax code and registration number in the Company Register of Milan, Monza-Brianza and Lodi 09711590969, capital of Euro 42,482.96 (of which €39,084.32 paid), R.E.A. N. MI – 2109101, PEC address: 3bee@legalmail.it (hereinafter referred to as the “Owner”).

The Data Controller has appointed pursuant to and for the purposes of Art. 37 of the GDPR, the Data Protection Officer (hereinafter DPO), available at the following email address privacy@3bee.com.

INTRODUCTORY INFORMATION

For a better understanding of the information and documents shared therein, below are some definitions directly contained in the provisions of the GDPR. Pursuant to Art. 4, co. 1 of the GDPR, means:

“personal data”: any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements specific to his or her physical identity, physiological, genetic, psychological, economic, cultural or social;

“processing”: any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction;

“data controller”: the natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and means of the processing of personal data;

“data processor”: the natural or legal person, public authority, service or other body that processes personal data on behalf of the data controller;

“consent of the interested party”: any free, specific, informed and unequivocal expression of will of the interested party, with which he or she expresses his or her assent, by means of a declaration or unequivocal positive action, for the personal data concerning him or her to be processed.

In addition to the above, in order to allow a complete understanding of this document, the following terms, singular and plural, will have the meaning indicated below:

“Services”: the services provided through the Site by 3Bee and XNatura (e.g. “Environmental Monitoring Platform”);

“User”: any person who accesses and uses the Site and/or the Platform/App;

“Partner User”: the natural or legal person, other than the Owner, who, through the Site and the Platform/App, provides services to Users, acting in the exercise of their commercial, artisanal or professional business activity (e.g. farmer, companies...).

“Site”: geographical area subject to analysis for the provision of the service, including company sites, oases managed or not managed by 3Bee, customer oases or any land for which the desire to carry out a natural analysis has been expressed.

PROCESSING METHODS AND STORAGE TIME

We inform you that the processing of your data is carried out in compliance with the GDPR and the current regulatory provisions regarding the processing of personal data. We inform you that the processing in question is based on the principles established pursuant to Article 5 of the GDPR, in particular on the principles of correctness, lawfulness, transparency and protection of confidentiality and the rights of the subject whose data are treated. The processing of your personal data will take place using IT and telematic tools, with methods suitable to guarantee its security and confidentiality in compliance with the provisions of Article 32 of the GDPR. Your personal data will be retained by the Data Controller for the period strictly necessary to achieve the purposes for which they were collected, and in any case in compliance with the principle of minimization referred to in article 5, paragraph 1, letter c) of the GDPR as well as the obligations established by law. In any case, please note that once the retention period established by current legislation has expired, the data will be deleted. In any case, this is without prejudice to the further conservation of personal data for specific accounting/tax purposes as provided for in the field of accounting records pursuant to art. 2220 of the Civil Code.

TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY AND/OR AN INTERNATIONAL ORGANIZATION

We inform you that your personal data will be processed by the Data Controller exclusively within the community territory. The data you provide will therefore not be transferred by the Data Controller to third countries located outside the European Economic Area. If for technical and/or operational reasons it is necessary to make use of subjects located outside the European Union (EU) or the European Economic Area (EEA), or it is necessary to transfer some of the data collected to technical systems and services managed in cloud and located outside the area of the European Union or the European Economic Area, the processing will be regulated in accordance with the provisions of Chapter V of Reg (EU) 679/2016. The Data Controller - if necessary - will adopt the necessary precautions for a legitimate transfer of data (in particular, through the use of the Standard Contractual Clauses approved by the European Commission). In any case, you can request information on the transfer of your personal data abroad at any time by contacting us at the e-mail address indicated in the following paragraph.

RIGHTS OF THE INTERESTED PARTY

Pursuant to Art. 7 co. 3 of the GDPR, we inform you that you can revoke the consent given at any time without prejudice to the lawfulness of the processing based on the consent given prior to the revocation. By forwarding the request directly to the registered office of the Data Controller indicated above or using the following e-mail address: privacy@3bee.com, you may exercise, at any time, pursuant to articles 15 to 22 of the GDPR, the right to:

1. ask for confirmation of the existence or otherwise of your personal data;
2. obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom your personal data have been or will be communicated and, when possible, the retention period;
3. obtain the rectification and deletion of your personal data;
4. obtain the limitation of the processing of your data;
5. obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments;
6. object to the processing at any time and also in the case of processing for direct marketing purposes;
7. oppose an automated decision-making process relating to natural persons;
8. ask the Data Controller to access the data and correct or delete them or limit the processing that concerns you or to oppose their processing, in addition to the right to data portability;
9. revoke consent at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation;
10. lodge a complaint with a supervisory authority. In Italy, the competent authority is the Garante per la Protezione dei Dati Personali, with registered office in Piazza Venezia 11, 00187 Rome (www.garanteprivacy.it).

Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.

AUTOMATED DECISION-MAKING

The Data Controller does not use automated decision-making processes, including profiling, as referred to in Article 22, paragraphs 1 and 4, of the GDPR.

2. (A) “USER” – Information pursuant to art. 13 GDPR

CATEGORIES OF DATA PROCESSED

By browsing and using this Site and/or the Platform/App, the following categories of personal data may be processed:

1. data necessary for the purchase of Services offered by the Owner through the Site. Specifically, the User may be asked for common personal data (name, surname), contact information (e-mail address, telephone number, residence/shipping address of the Products purchased), data relating to payments (card number, expiry date, CVV and billing address, PayPal address, bank details necessary to make a bank transfer), data relating to the company in which it operates such as Company Name and Number of employees;
2. IP address;
3. any personal data entered at the discretion of the User when creating the personal or company profile on the Platform / App (photographs, gender, date of birth, company name);
4. further information that you choose to provide by filling out the appropriate forms for customer support activities/requesting information on the Services offered by the Owner;
5. data collected through cookies, subject to the granting of your consent, as better described in the Cookie Policy available at the following link Cookie Policy;
6. The photos uploaded to the app will not be used for commercial purposes and will be visible exclusively on the Platform, accessible via the link 3bee.com/owner/me. The link to your Personal or Business Page on the platform can be private or public depending on the user's discretion; upon creation it is set to private.

g. The platform may collect and use the following data necessary for the provision of the service purchased based on the level of service purchased on the Site in question:

• GPS coordinates of the site: information on the geographical position of the analyzed site.
• Site Name: identifying name of the site.
• Operational activity: description of the main activity carried out at the site.
• Site description: additional information on the site, useful to characterize its specificity or peculiarities.
• Number of operators or employees: quantity of staff employed at the site.

PURPOSE OF THE PROCESSING AND LEGAL BASIS

The personal data you provide are processed by the Data Controller for the purposes set out below:

a. PURPOSE: navigation on this Website and/or on Platform / App;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

b. PURPOSE: IT systems management

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

c. PURPOSE: provision of the Service requested by the Owner;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letters b) of the GDPR, according to which the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same;

d. PURPOSE: defense of rights in the context of a judgment brought against the Data Controller and related prodromal and/or related activities

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties;

e. PURPOSE: compliance with obligations imposed by laws or regulations

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

f. PURPOSE: compliance with tax and accounting obligations;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

g. PURPOSE: registration on the Site and/or on Platform / App and the use of services reserved for registered users.

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letters b) of the GDPR, according to which the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same.

h. PURPOSE: if desired, sending material of an advertising and informative nature, of a promotional and/or commercial nature via e-mail (e.g. including the newsletter) regarding the Services/Products offered by the Owner;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter a) of the GDPR, according to which the interested party has expressed consent to the processing of their personal data for one or more specific purposes.

i. PURPOSE: if you wish, to be contacted by the Owner in order to process the requests made by you by filling in the specific form on the Site

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter a) of the GDPR, according to which the interested party has expressed consent to the processing of their personal data for one or more specific purposes.

The provision of personal data is optional for everything concerning the processing purposes referred to in the previous letters h) and i) of this Privacy Policy. Failing this, it will not be possible for you to obtain the provision of the requested service (such as, for example, the sending of commercial information; the processing of requests made by you, the receipt of the newsletter;).

In any case, the right to revoke the consent given is reserved, as provided for pursuant to art. 7 co. 3 of the GDPR, if the same constitutes the legal basis of the processing.

COMMUNICATION OF YOUR PERSONAL DATA

We inform you that your personal data are not subject to dissemination, this term meaning the disclosure of the same to indeterminate subjects, in any form, including by making them available or consulting them. However, this is without prejudice to the hypothesis in which the diffusion is requested from the Data Controller, in compliance with legislative provisions, by public authorities, by judicial authorities, by supervisory and control bodies, by information and security bodies or by other subjects and/or public bodies for the purposes of defense and security of the State, prevention and detection or repression of crimes. To achieve the purposes described in the previous section, the Data Controller may need to communicate your personal data to the following categories of subjects:

1. natural persons authorized by the Data Controller to process personal data pursuant to and for the purposes of Art. 29 of the GDPR in reason of the performance of their work duties;
2. subjects who have been appointed by the Data Controller pursuant to Article 28 of the GDPR as data processors such as, by way of example and not limited to, subjects who provide services for the management of the digital and non-digital communication system, employment consultants, consultants in financial, accounting matters, etc.
3. purchaser of the Service/gift voucher, exclusively upon request of the latter.

2. (B) “RECIPIENTS” – Information pursuant to art. 14 of the GDPR

SOURCE OF PERSONAL DATA

The source from which your personal data originates is the person who contacted the Owner so that the Service purchased by the User could be provided to you and/or so that you could receive the Product purchased by the User.

CATEGORIES OF DATA PROCESSED

In order to allow the provision of the Service purchased by the User in his favor and/or the delivery of the Product purchased by the User in his favor, the Data Controller may process the following categories of personal data:

1. common personal data (name, surname) and/or contact information (e-mail address) of the Recipient.
2. IP address;
3. data collected through cookies, subject to the granting of your consent, as better described in the Cookie Policy available at the following link Cookie Policy;

PURPOSE OF THE PROCESSING AND LEGAL BASIS

Personal data is processed by the Data Controller for the purposes set out below:

a. PURPOSE: navigation on this Website and/or on Platform / App;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

b. PURPOSE: IT systems management

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

c. PURPOSE: to allow the Recipient to receive the Service purchased by the User on his behalf

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letters b) of the GDPR, according to which the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same;

d. PURPOSE: defense of rights in the context of a judgment brought against the Data Controller and related prodromal and/or related activities

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties;

e. PURPOSE: compliance with obligations imposed by laws or regulations

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

f. PURPOSE: compliance with tax and accounting obligations;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

g. PURPOSE: registration on the Site and/or on Platform / App and the use of services reserved for registered users.

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letters b) of the GDPR, according to which the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same.

COMMUNICATION OF YOUR PERSONAL DATA

We inform you that your personal data are not subject to dissemination, this term meaning the disclosure of the same to indeterminate subjects, in any form, including by making them available or consulting them. However, this is without prejudice to the hypothesis in which the diffusion is requested from the Data Controller, in compliance with legislative provisions, by public authorities, by judicial authorities, by supervisory and control bodies, by information and security bodies or by other subjects and/or public bodies for the purposes of defense and security of the State, prevention and detection or repression of crimes. To achieve the purposes described in the previous section, the Data Controller may need to communicate your personal data to the following categories of subjects:

1. natural persons authorized by the Data Controller to process personal data pursuant to and for the purposes of Art. 29 of the GDPR due to the performance of their work duties;
2. subjects who have been appointed by the Data Controller pursuant to Article 28 of the GDPR as data processors such as, by way of example and not limited to, subjects who provide services for the management of the digital and non-digital communication system, employment consultants, consultants in financial, accounting matters, etc.

3. “PARTNER USERS”: Information pursuant to art. 13 of the GDPR

This privacy policy has been drawn up in order to inform you, the Partner User, regarding the processing of your personal data carried out by the Company 3Bee S.r.l. through this Site and/or the Platform / App. In accordance with GDPR, the following information is provided to you.

CATEGORIES OF DATA PROCESSED

By browsing and using this Site and/or the Platform/App, the following categories of personal data may be processed:

1. data transmitted by the Partner User to the Owner in order to obtain information (i) on the possible partnerships to be started with the Owner (ii) as well as on the Products / Services offered by the Owner through the Site. In this sense, when completing the appropriate forms present on the Site, the following data may be requested from Partner Users: common personal data (name, surname) and contact information (e-mail address, telephone number), address of a Partner User's point of sale, further information that the Partner User chooses to share with the Owner by filling out the appropriate forms in order to receive customer assistance/information requests on the Services/Products offered by the Owner.
2. IP address;
3. any personal data entered by the Partner User when creating the profile on the Platform/App (photographs, gender, date of birth);
4. data collected through cookies, subject to the granting of your consent, as better described in the Cookie Policy available at the following link Cookie Policy.

During the organization and carrying out of in-person team building activities organized by 3Bee, the following categories of personal data may be processed: personal and contact data: name, surname, e-mail address, telephone number, multimedia data: photographs and videos taken during the event, which may include images of attendees.

PURPOSE OF THE PROCESSING AND LEGAL BASIS

The personal data you provide are processed by the Data Controller for the purposes set out below:

a. PURPOSE: navigation on this Website and/or on Platform / App;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

b. PURPOSE: IT systems management

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties.

c. PURPOSE: defense of rights in the context of a judgment brought against the Data Controller and related prodromal and/or related activities

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter f) of the GDPR, according to which the processing is necessary for the pursuit of the legitimate interest of the Data Controller or third parties;

d. PURPOSE: compliance with obligations imposed by laws or regulations

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

e. PURPOSE: compliance with tax and accounting obligations;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter c) of the GDPR, according to which the processing is necessary for the fulfillment of a legal obligation to which the Data Controller is subject.

f. PURPOSE: registration on the Site and/or on Platform / App and the use of services reserved for registered users.

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letters b) of the GDPR, according to which the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same.

g. PURPOSE: if desired, sending material of an advertising and informative nature, of a promotional and/or commercial nature via e-mail (e.g. including the newsletter) regarding the Services/Products offered by the Owner;

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter a) of the GDPR, according to which the interested party has expressed consent to the processing of their personal data for one or more specific purposes.

h. PURPOSE: if you wish, to be contacted by the Owner in order to process the requests made by you by filling in the specific form on the Site

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter a) of the GDPR, according to which the interested party has expressed consent to the processing of their personal data for one or more specific purposes.

i. PURPOSE: Organization and management of the event: collection and use of data to ensure the correct planning and carrying out of team building activities.

LEGAL BASIS OF THE PROCESSING: for this purpose the legal basis is Art. 6, co. 1, letter a) of the GDPR, according to which the interested party has expressed consent to the processing of their personal data for one or more specific purposes.

The provision of personal data is optional for everything concerning the processing purposes referred to in the previous letters g) and h) of this Privacy Policy. Failing this, it will not be possible for you to obtain the provision of the requested service (such as, for example, the sending of commercial information; the processing of requests made by you, the receipt of the newsletter;).

In any case, the right to revoke the consent given is reserved, as provided for pursuant to art. 7 co. 3 of the GDPR, if the same constitutes the legal basis of the processing.

COMMUNICATION OF YOUR PERSONAL DATA

We inform you that your personal data are not subject to dissemination, this term meaning the disclosure of the same to indeterminate subjects, in any form, including by making them available or consulting them. However, this is without prejudice to the hypothesis in which the diffusion is requested from the Data Controller, in compliance with legislative provisions, by public authorities, by judicial authorities, by supervisory and control bodies, by information and security bodies or by other subjects and/or public bodies for the purposes of defense and security of the State, prevention and detection or repression of crimes.

To achieve the purposes described in the previous section, the Data Controller may need to communicate your personal data to the following categories of subjects:

1. natural persons authorized by the Data Controller to process personal data pursuant to and for the purposes of Art. 29 of the GDPR due to the performance of their work duties;
2. subjects who have been appointed by the Data Controller pursuant to Article 28 of the GDPR as data controllers such as, by way of example and not limited to, subjects who provide services for the management of the digital and non-digital communication system, employment consultants, consultants in legal, financial, accounting matters, etc.
3. Users.

Last updated: February 2026