BSmart

BSmart is the leading Italian digital learning environment for primary and secondary education, operated by Bsmart srl in Milan. It distributes the digital textbooks of the largest Italian publishers (Zanichelli, Hoepli, Pearson Italia, Bulgarini and others), runs interactive exercises, hosts class group spaces and feeds back pedagogical progress to teachers and parents. The platform is offered to schools through a contract with the Italian Ministry of Education or through direct publisher subscription.

What BSmart does

BSmart provides a web application and native iOS, Android, Windows and macOS apps that authenticate the teacher or pupil, deliver the digital textbook, run quizzes and exercises, and feed progress back to the teacher dashboard. It supports homework assignment, group activities, audio reader for accessibility (DSA), and integrates with the SPID identity provider for schools that have adopted it.

Data and cookies set

BSmart processes pupil and teacher full name, school class, account credentials, parent contact when supplied, the textbooks owned by the pupil, the chapters read, the exercises completed and the scores. Strictly necessary cookies (bsmart_session, bsmart_csrf) maintain the session. Optional functional cookies remember the reading mode and font size. The mobile apps use device tokens (FCM, APNs) for push notifications.

GDPR and ePrivacy implications

The school is the data controller and Bsmart srl is the data processor under Article 28 GDPR. The legal basis is the school service contract (Art 6(1)(b)) plus the legal obligation to comply with school regulations (Art 6(1)(c)). Italian Garante has issued specific guidance on digital learning that strictly limits secondary uses, prohibits third country transfers without supplementary measures, and requires informing the school council and parents. Parental consent under Art 8 GDPR applies for processing personal data of pupils under 14 in Italy.

Consent requirements

Strictly necessary cookies for authentication require no consent. Optional functional cookies and push notifications require granular consent obtained, for under 14s, from the parent or legal guardian. Marketing communications from the publisher are prohibited unless a separate, freely given consent is obtained outside the school relationship.

Data transfers and hosting

Bsmart commits to keep all school related data within Italian and EU data centers. The sub processor list is published in the vendor privacy policy and limited to EU/EEA entities. Any school chosen integration (for example a Google Workspace login) must be reviewed separately. Apple APNs and Google FCM apply for mobile push, with their own transfer mechanisms.

Practical compliance steps

Sign the Bsmart school DPA. Carry out the DPIA before adopting the platform. Inform the school council, pupils and parents through the school privacy notice and the dedicated information document for digital learning. Obtain parental consent for pupils under 14 for optional features. Verify the sub processor list yearly. Disable third party logins not vetted by the school. Audit the role permissions of teachers and administrators.