Privacy Policy
Version 1.0 · in force since 14 September 2026
1. Data controller
The controller of personal data collected through the Visit Pornassio website and mobile app is the Municipality of Pornassio, Via Roma 28, 18024 Pornassio (IM), Italy, tax code 00246290084, certified email comune@pec.pornassio.org.
Development, hosting and technical maintenance are carried out by Riccardi Gaetano, VAT 01775860081, Via Chiapparo 40 int. 1, 18024 Pornassio (IM), appointed as data processor under Article 28 of Regulation (EU) 2016/679.
2. In short
This service is designed to collect as little personal data as possible. We use no profiling cookies and no third-party tracking, we do no profiling or automated decision-making, we never sell or share data for commercial purposes, and the mobile app requires no registration.
3. What we process and why
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, email address, subject and message | Replying to your request | Art. 6(1)(b) GDPR | 24 months from last contact |
| Web server logs | IP address, timestamp, requested page, browser type | Security, troubleshooting and abuse prevention | Art. 6(1)(f) GDPR: legitimate interest in service security | 30 days maximum |
| Technical session cookies | Session identifier | Running the site and protecting forms | Consent not required for strictly necessary cookies | Session duration |
| App favourites and settings | Saved places, chosen language | Remembering your preferences | Stored on your device only, never transmitted to us | Until the app is uninstalled |
| Location in the app | Device GPS coordinates | Showing your position on the map and distances to places | Art. 6(1)(a) GDPR: consent, revocable at any time in your device settings | Processed on device only, never transmitted or stored |
4. Providing your data
Providing data through the contact form is optional, but without it we cannot reply. Browsing the site and the app requires no data at all.
5. Security
Processing is carried out with appropriate technical and organisational measures under Art. 32 GDPR: HTTPS encryption on every page, access restricted to authorised staff, hashed credentials, regular backups and security updates. IP addresses linked to messages are stored only as irreversible hashes.
6. Recipients
Data may be processed by our hosting and email providers, appointed as processors under Art. 28 GDPR. Data is never disclosed to third parties for purposes other than those stated, except where required by law.
7. Transfers outside the EEA
Data is processed on servers located within the European Union. Any transfer to a third country would take place only under an adequacy decision of the European Commission or standard contractual clauses under Art. 44 et seq. GDPR.
8. Third-party components
Maps use data and tiles from OpenStreetMap. Requesting tiles discloses your IP address to the OpenStreetMap Foundation servers, which apply their own privacy policy.
9. Your rights
You may exercise the rights under Articles 15 to 22 GDPR at any time: access, rectification, erasure, restriction, portability and objection. Where processing is based on consent, you may withdraw it freely without affecting the lawfulness of processing carried out beforehand. Write to comune@pec.pornassio.org; we reply within one month.
10. Complaints
If you believe the processing of your data infringes the law you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, or with the supervisory authority of your country of residence.
11. Children
The service is not directed at children under 14, the age set by Italian law for consent to information society services. We do not knowingly collect data from children below that age.
12. Changes
This policy may be updated. The version in force, with its effective date, is always published on this page.