Privacy policy

This notice explains how personal data is processed for people using Visit Monti Dauni, that is the website www.visitmontidauni.it and the Visit Monti Dauni app, under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree no. 196 of 30 June 2003, as amended by Legislative Decree no. 101 of 10 August 2018.

Who processes the data

Data controller: GAL Meridaunia soc. cons. a r.l., Piazza Municipio 2, 71023 Bovino (FG), Italy, VAT number 02303810713, certified e-mail (PEC) meridaunia@pec.it.

Data protection officer (DPO): Rete del Mediterraneo, Via Galliani 18, 71121 Foggia (FG), Italy, e-mail presidente@retedelmediterraneo.com, PEC retedelmediterraneo@pec.it.

The portal is run on behalf of GAL Meridaunia by Rete del Mediterraneo, which processes the data as a data processor.

What data we process and why

Browsing

The server records technical data for each visit: IP address, page requested, date and time, outcome of the request and browser type. This is needed to run the website and protect it from abuse and attacks (legitimate interest, Article 6(1)(f) GDPR) and is deleted after 14 days. We do not use it for visitor statistics or profiling.

Requests to accommodation, restaurants, organisers and producers

With the forms on each page (booking request, table request, request to take part or for information) we collect name, e-mail, phone number if given, dates, number of people and message. The request is e-mailed to the address shown on the page and, in copy, to the portal's editorial team; a copy is kept in the portal's management system. The business that receives it replies directly and processes the data as an independent controller. Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Requests are kept for 24 months.

A booking request is not a booking: you agree the terms of your stay or service directly with the business.

Contact form

Name, e-mail, topic and message go to the portal's editorial team, which uses them only to reply (Article 6(1)(b) GDPR). They are kept for 24 months.

Your account

To create an account we collect first name, last name, e-mail and password. The password is stored encrypted and nobody can read it. The account also holds the language of your e-mails, your favourites, the requests you sent, your reviews and your stories. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR). The data is kept until you delete your account, which you can do at any time from your account page: favourites, reviews and stories are deleted with it, while requests already sent stay with the businesses that received them. Accounts from the previous portal have been moved over with the same e-mail and password.

Reviews and stories

Reviews and stories are published after a check by the editorial team, with your first name and the initial of your last name, the date and, for stories, the photo you uploaded. You can edit or delete them from your account.

For the newsletter we process your e-mail address and the dates of subscription and confirmation. The subscription is only valid after you click the confirmation link you receive by e-mail; every newsletter has a link to unsubscribe. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. The data is kept until you unsubscribe.

Business managers

Anyone asking to manage a page through "Become a host" gives their name, e-mail, phone number, role and business. The phone number is only used to verify the request and is never published. If the request is approved, the manager gets access to the management panel, with name, e-mail, encrypted password and linked pages. Legal basis: providing the requested service (Article 6(1)(b) GDPR). The data is kept while the manager uses the panel; requests that are not approved are kept for 24 months.

Location

On the website, the "Near me" button on the maps asks your browser for your location: it is only used to centre the map on your device and is not sent to us. The app may ask for permission to access your location to show nearby places and, along trails, alerts when you are near a point of interest or leave the trail, and for permission to send you notifications. You can withdraw these permissions at any time in your phone's settings; without them some features are not available.

Required data

The fields marked as required in the forms are needed to handle your request: without them it cannot be sent. We do not ask for, and do not want to receive, special categories of data (for example health data): if you write them in a message, we process them only to reply.

Who receives the data

the businesses you send a request to, which process it as independent controllers;
authorised staff of GAL Meridaunia and Rete del Mediterraneo who edit the portal;
technical providers acting as processors: the provider that develops and maintains the portal, Hetzner Online GmbH for the servers (in Germany) and the backups (in Finland), Resend for sending e-mails, Google (Firebase Cloud Messaging) and Apple for the app notifications, which receive the phone's code and the text of the notification;
public authorities, where required by law.

Data is never sold or used for advertising. Reviews and stories, once published, are visible to everyone.

Transfers outside the European Union

Servers and backups are in the European Union. The portal's e-mails (confirmations, requests, newsletter) are sent through Resend, based in the United States: the transfer relies on the European Commission's adequacy decision for transfers to the United States (EU-U.S. Data Privacy Framework) or on the standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR). The same applies to the app notifications, delivered by Google and Apple.

How long we keep the data

browsing data: 14 days;
requests to businesses, messages to the editorial team and business manager requests that are not approved: 24 months;
account, favourites, reviews and stories: until you delete the account or the content;
newsletter: until you unsubscribe; after unsubscribing, the address is kept for 30 days, the time needed to remove it from the sending service as well; unconfirmed subscriptions are deleted after 30 days;
backups: up to 12 months, then overwritten.

Security

The portal only uses encrypted connections (HTTPS), stores passwords encrypted, limits access to the data to authorised people and keeps encrypted backups.

Minors

Accounts and the newsletter are for people aged 14 and over (Article 2-quinquies of Legislative Decree 196/2003).

Your rights

At any time, under Articles 15 to 22 GDPR, you can ask for:

confirmation of whether data about you is processed, and access to it;
the purposes of the processing, the categories of data, the recipients and the retention period;
correction and erasure of the data;
restriction of processing;
data portability, that is receiving the data in a structured, commonly used and machine-readable format and passing it to another controller;
to object to processing, including for direct marketing, and to decisions based solely on automated processing, including profiling;
to withdraw consent, without affecting the lawfulness of processing based on consent before its withdrawal.

You can exercise your rights by writing to GAL Meridaunia soc. cons. a r.l., Piazza Municipio 2, 71023 Bovino (FG), Italy, or to the PEC address meridaunia@pec.it, or to the data protection officer at the contacts above. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Cookies

The website only uses technical cookies needed for it to work. Details are in the cookie policy.

Third-party websites

The portal links to other websites (for example businesses' websites, maps for directions, social networks), which have their own privacy notices: the controller is not responsible for how they process data.

Changes

This notice may be updated: the date of the latest update is shown on this page.