Privacy Policy
Last updated: 4 October 2026
This policy explains what personal data we collect when you visit bananakit.com, buy from us or contact us, why we collect it, who we share it with and what rights you have. Part A applies to everyone and reflects the EU General Data Protection Regulation (GDPR). Part B adds the information required by California and other U.S. state laws.
BananaKit products are intended for adults only. This website is not directed to anyone under 18.
Part A. Privacy information under the GDPR
1. Who is responsible for your data
The data controller is:
Major Prodotti Dentari S.p.A. Via Luigi Einaudi 23, 10024 Moncalieri (TO), Italy VAT number IT07002860018 Email: sales@bananakit.com Certified email (PEC): majordental@pec.it Phone: +39 011 6400211
BananaKit is a brand of Major Prodotti Dentari S.p.A. For any privacy question or request, write to sales@bananakit.com with the subject “Privacy”. We have not appointed a Data Protection Officer: you can reach us directly at the contacts above.
2. What data we collect
Browsing data. When you visit the site, our hosting and security providers process technical data such as your IP address, browser type, device information, pages requested, date and time. This is needed to deliver the pages and protect the site.
Cookies and similar technologies. We use technical cookies that the site needs to work. We use statistics and marketing cookies only if you consent. Details are in our Cookie Policy.
Order data. When you buy, we collect your name, billing and shipping address, email address, phone number, the products ordered, the order amount and the delivery details. If you buy as a business, we also collect your company name and VAT number.
Payment data. Payments are processed by Stripe or PayPal. We do not see or store your full card number. We receive only a transaction reference, the payment status and limited details such as the card type and last four digits.
Account data. If you create a customer account, we store your login details (email and password, the password in encrypted form), your addresses and your order history.
Messages to us. When you use the contact form or write to us, we process your name, email address, the content of your message and any attachments (for example photos of a damaged product).
“Ask the banana” assistant. The chat assistant on the site answers questions about our products using answers prepared and checked by our team. You do not need to log in to use it. If you choose to flag a question as unanswered, we store the text of that question together with the product and language selected, for up to 90 days, to improve our answers. Please do not type personal information in the assistant. At present, the questions you type are not sent to external artificial intelligence providers. If we enable such a feature, we will update this policy before doing so.
We do not knowingly collect special categories of data (such as data about health or sex life). We do not use your order data to draw conclusions about your private life, and we do not share product-level details of your purchases with advertising partners.
3. Why we use your data and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Showing the website, keeping it secure, preventing abuse and fraud | Browsing data, technical cookies | Our legitimate interest in running a secure website (Art. 6(1)(f) GDPR) |
| Processing your order, taking payment, delivering, sending order and shipping updates, handling withdrawals, returns and guarantee claims | Order, payment and contact data | Performance of the contract with you (Art. 6(1)(b) GDPR) |
| Managing your customer account | Account data | Performance of the contract (Art. 6(1)(b) GDPR) |
| Answering your questions before or after a purchase | Messages, contact data | Pre-contractual steps or contract (Art. 6(1)(b) GDPR); for general questions, our legitimate interest in replying (Art. 6(1)(f) GDPR) |
| Invoicing, accounting, tax and VAT obligations, including checking business VAT numbers through the EU VIES system | Order and billing data, VAT number | Legal obligation (Art. 6(1)(c) GDPR) |
| Payment fraud prevention by our payment providers | Payment and device data | Legitimate interest in preventing fraud (Art. 6(1)(f) GDPR) |
| Improving the assistant’s answers | Flagged questions | Legitimate interest in improving our service (Art. 6(1)(f) GDPR) |
| Website statistics | Statistics cookies and similar technologies | Your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) |
| Measuring the effectiveness of our advertising (Google Ads) and recording which channel each order comes from (WooCommerce, first-party cookies) | Marketing cookies and similar technologies | Your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) |
| Establishing, exercising or defending legal claims | Data relevant to the dispute | Legitimate interest (Art. 6(1)(f) GDPR) |
Where we rely on legitimate interest, you can object at any time (see section 8).
4. Do you have to give us your data?
Data marked as required in the checkout and contact forms are needed to process your order or answer you. Without them we cannot do so. Giving consent to statistics and marketing cookies is optional: if you refuse, you can still use the site and buy from us.
5. Who receives your data
We share data only as needed for the purposes above, with:
- Hosting and security: GoDaddy (website hosting, data centre in the EU, Strasbourg, France (EU)) and Cloudflare (content delivery and protection against attacks, used by our hosting).
- Payments: Stripe and PayPal. PayPal acts as an independent controller for the payments you make through it. Stripe also processes some data as an independent controller for fraud prevention and to meet its legal obligations.
- Email: Microsoft (Microsoft 365), which we use to send order emails and reply to you from sales@bananakit.com.
- Shipping: the selected express couriers who deliver your order, and the shipment-tracking tool installed on our site.
- Internal systems: our order management, accounting and customer relationship systems, run by us or by IT providers acting on our behalf.
- Website tools: WooCommerce (online shop), WPForms (contact form) and WPML (site languages) run on our own website. WooCommerce usage tracking is switched off.
- VAT checks: the European Commission’s VIES service and the tax authorities, when a business customer enters a VAT number.
- Google: only if you consent to statistics or marketing cookies (Google tag and Google Ads). For some processing, such as ad measurement and its own services, Google acts as an independent controller. See Google’s privacy policy at policies.google.com/privacy.
- Advisers and authorities: accountants, auditors, lawyers, insurers, and public authorities when the law requires it, including customs authorities for deliveries outside the EU.
Our service providers act as data processors under written agreements with us. We do not sell your personal data.
6. Transfers outside the EU
Some providers (Cloudflare, GoDaddy, Google, Microsoft, Stripe, PayPal) are part of groups based in the United States, so your data may be accessed from or stored in the U.S. or other countries. When this happens we rely on:
- the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023) for providers certified under it, and
- the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) in our agreements with the providers, as an additional safeguard.
If you order a delivery outside the EU (for example to the United States), the courier and the customs authorities of the destination country receive the data needed to deliver your parcel. This transfer is necessary to perform the contract you asked for (Art. 49(1)(b) GDPR).
You can ask us for a copy of the relevant safeguards at sales@bananakit.com.
7. How long we keep your data
| Data | Retention |
|---|---|
| Orders, invoices and accounting records | 10 years from the end of the financial year, as required by Italian law |
| Data needed to handle withdrawals, returns and guarantee claims | For the duration of the guarantee (at least 26 months from delivery) and, if there is a dispute, until it is finally resolved |
| Customer account | Until you delete the account, or after 36 months of inactivity |
| Messages and contact form requests not linked to an order | 24 months from our last exchange |
| Questions flagged in the assistant | Up to 90 days |
| Server and security logs | Up to 12 months |
| Cookies | As shown in the Cookie Policy. Your cookie choice is stored for 6 months |
After these periods we delete or anonymise the data.
8. Your rights
You have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- have your data deleted, where the law allows;
- restrict processing in certain cases;
- receive your data in a portable format, for data you gave us under a contract or consent;
- object at any time to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing carried out before. For cookies, use the “Cookie preferences” link at the bottom of every page.
To exercise your rights, write to sales@bananakit.com. We will reply within one month. We may ask you for information to confirm your identity.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
9. Automated decisions
We do not make decisions about you based solely on automated processing, and we do not profile you to personalise prices. Our payment providers carry out automated fraud checks on payments. If a payment is refused, you can contact us.
10. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls and providers bound by confidentiality and security obligations.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. If changes are significant, we will tell you on the site or by email.
Part B. U.S. and California Privacy Notice
This part applies to residents of California and other U.S. states with comprehensive privacy laws. It supplements Part A. “Personal information” has the meaning given by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).
1. Notice at collection
We collect the categories of personal information listed below for the purposes described here. We may “share” some online identifiers and browsing information with Google for advertising measurement, only if you accept marketing cookies. You can opt out at any time on our Do Not Sell or Share My Personal Information page. We do not sell personal information for money.
2. Categories of personal information we collect
In the past 12 months we have collected:
| Category (CCPA) | Examples | Source | Purposes | Disclosed for a business purpose to | Sold or shared? | Retention |
|---|---|---|---|---|---|---|
| Identifiers | Name, postal address, email, phone, IP address, online identifiers, order number | You; your device | Orders, delivery, customer service, security, account | Hosting, payment, email, shipping and IT service providers; customs authorities | Online identifiers shared with Google only with your marketing consent | Order records 10 years; other data as in Part A, section 7 |
| Customer records (Cal. Civ. Code §1798.80(e)) | Name, address, phone, limited payment details | You; payment providers | Orders and payment | Payment, shipping and IT service providers | No | 10 years |
| Commercial information | Products bought, order history, returns | You | Orders, returns, guarantee, accounting | Payment, shipping and IT service providers; customs authorities; advisers | No product-level details shared. A purchase event (without product details) may be shared with Google with your marketing consent | 10 years |
| Internet or network activity | Pages visited, interactions with the site, cookie data | Your device | Security, statistics (with consent), ad measurement (with consent) | Hosting and security providers; Google (with consent) | Shared with Google only with your marketing consent | As in the Cookie Policy; logs up to 12 months |
| Approximate location | Country or region derived from IP address or shipping address | Your device; you | Delivery, taxes, language, security | Hosting, shipping and IT service providers | No | As for the related data |
| Audio, electronic or visual information | Photos you send us of a damaged or faulty product | You | Returns and guarantee | IT service providers | No | As for the related order |
| Professional information | Company name and VAT number, if you buy as a business | You | Invoicing and tax checks | Tax authorities, IT service providers | No | 10 years |
| Sensitive personal information | Account login and password | You | Account access only | IT service providers | No | Until the account is deleted, or after 36 months of inactivity |
We do not collect precise geolocation. We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA, so we do not offer a “limit the use” link. We do not use your purchases to infer characteristics about you.
3. Business purposes
We use personal information to process and deliver orders, take payment, provide customer service, handle returns and guarantee claims, keep the site secure, detect fraud, comply with law, improve our products and, only with your consent, measure our advertising.
4. Your rights
Subject to the law, you have the right to:
- Know and access the personal information we have collected about you, its sources, purposes and recipients;
- Delete your personal information;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of your personal information;
- Not be discriminated against for exercising your rights. We will not deny you goods, charge you a different price or give you a different level of service because you exercised a privacy right.
5. How to make a request
- Email sales@bananakit.com with the subject “U.S. Privacy Request”.
- Call us at +39 011 6400211.
- To opt out of sale or sharing, use the Do Not Sell or Share My Personal Information page or the “Cookie preferences” link.
Verification. To protect you, we verify requests to know, delete or correct by matching information you give us (for example your email address and a recent order number) with the information we hold. We do not need to verify opt-out requests.
Authorized agents. You may use an authorized agent. We will ask for your signed permission and may ask you to confirm your identity directly with us.
Response time. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we will tell you why.
Appeals. If we decline your request, you can appeal by replying to our decision with the subject “Appeal”. We will answer within the time required by your state’s law. If you are not satisfied, you can contact your state Attorney General.
6. Global Privacy Control
We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing: marketing cookies stay off for that browser, and the site shows that your opt-out request has been honored.
7. Do Not Track (CalOPPA)
Browsers’ “Do Not Track” signals have no common standard, so our site does not respond to them as such. We respond to the GPC signal as described above. Third parties (Google) can collect information about your online activities over time and across websites only if you accept statistics or marketing cookies on our site.
8. Other U.S. states
If you live in a state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Utah, Texas or Oregon), you can exercise the rights to access, correct, delete, obtain a copy of your data and opt out of targeted advertising, as described above. We do not sell personal information and do not use it for profiling that produces legal or similarly significant effects.
9. California “Shine the Light”
We do not disclose personal information to third parties for their own direct marketing purposes.
10. Children
Our site and products are for adults only. We do not knowingly collect personal information from anyone under 18, and we do not sell or share personal information of consumers under 16. If you believe a minor has given us data, contact us and we will delete it.
11. Updates
We review this notice at least once every 12 months. Last updated: 4 October 2026.
Contact
Major Prodotti Dentari S.p.A., Via Luigi Einaudi 23, 10024 Moncalieri (TO), Italy. Email: sales@bananakit.com. PEC: majordental@pec.it. Phone: +39 011 6400211.