Privacy Policy
Last updated July 29, 2026 at 19:45
1. Data Controller
ITAWORLD COMPANY SRL SEMPLIFICATA
Registered office: Via Spontone 9/AB, 18100 Imperia (IM), Italy
VAT number: 01758350084
ITAWORLD COMPANY SRL SEMPLIFICATA is the Data Controller for the personal data described in this document.
2. Types of data collected
The Personal Data collected by the Service, either directly or through third parties, includes: first name, last name, email address, phone number, IP address (only in the limited cases described below), Usage Data, approximate geolocation (only with the user's permission), and any content voluntarily uploaded, including text, photos, and videos.
Full details on each data category are provided in the sections below. Personal Data may be freely provided by the user through the Service's forms or collected automatically as Usage Data while browsing.
Unless otherwise specified, all data requested in forms is mandatory; failure to provide it may make it impossible to handle the relevant request. Where a field is optional, that is expressly indicated in the form itself.
Users who are unsure which data is mandatory may contact the Owner using the details provided in Section 1.
The use of Cookies or other tracking tools by the third-party providers listed in Section 3 serves the purpose of providing the Service requested by the user, in addition to the other purposes described in this document and in the Cookie Policy.
Users are responsible for any third-party Personal Data obtained, published, or shared through the Service (for example, when submitting an event on behalf of an organizer) and warrant that they have the third party's consent to provide that data to the Owner.
3. Purposes of processing and data collected
3.1 Contacting the user
Contact form (
imperiatoday.com/contact) By filling in the contact form, the user authorizes the Owner to use the provided data to reply to requests for information or other requests indicated in the form. Data collected: first name, last name, email address, phone number.Advertise form (
imperiatoday.com/advertise) By filling in this form, the user authorizes the Owner to use the provided data to handle requests relating to advertising placements on the Service. Data collected: first name, last name, email address, and any additional information voluntarily provided.3.2 Managing user submissions ("Submit a place" / "Submit an event")
These forms allow a user to suggest a place or propose an event for publication on the Service. Data collected: first name, last name, email address, phone number (for event submissions only), and any content voluntarily provided, including text, photos, and videos.
Photos and videos attached to an event submission are stored in a private area of the Supabase storage provider, accessible only to the editorial team for review and never publicly reachable until any approval and publication takes place. Users must not upload images or videos showing identifiable third parties without their consent and must submit only content they are entitled to share.
If a place or event submission is published, the Owner may contact the user again to request additional details, a name credit, or further materials, as indicated in the relevant form.
3.3 Analytics
The services in this section allow the Owner to monitor and analyze traffic and may be used to observe user behavior.
Google Analytics (Google Ireland Limited / Google LLC) A web analytics service. Google may use the collected data to contextualize and personalize ads in its own advertising network. The Service loads Google Analytics only after the user has given consent through the cookie banner, which can be reopened at any time through the "Manage cookie preferences" link in the site footer. Data collected: Cookies, Usage Data. Place of processing: United States and other countries where Google operates infrastructure. See Google's Privacy Policy and opt out page.
Vercel Analytics and Speed Insights (Vercel Inc.) These services measure aggregated traffic and page performance. For that aggregated service-generated data, Vercel independently determines the purposes and means of processing and acts as an independent controller under its own Privacy Policy, separately from its role as a processor for hosting the Service. Data collected: aggregated Usage Data; Vercel's documentation states that no tracking cookies are used. Place of processing: United States.
Internal usage log The Owner also maintains a lightweight log of page views and interactions, such as which place or event pages are viewed and clicks on "Get directions" or "Visit website." This log is recorded only after the user has given consent through the cookie banner, in the same way as Google Analytics. It relies on a persistent identifier stored in the browser's local storage (not a cookie) to distinguish returning visitors. It does not record IP addresses, names, or other data that could directly identify the user, and it is not shared with third parties.
3.4 Spam and abuse prevention
Cloudflare Turnstile (Cloudflare, Inc.) A challenge-response service used on public forms to distinguish real users from automated bots, protecting the Service and other users from spam and abuse. The service runs automatically and usually requires no user interaction. Data collected: Usage Data, plus device and browser signals processed by Cloudflare to assess the request. Place of processing: see the Turnstile Privacy Policy.
3.5 Displaying external content and maps
OpenFreeMap Provides the map tiles displayed on map pages. Loading the map sends a standard request to the service, limited to the viewed map area; no account or identifying information is required. More details are available from the OpenFreeMap project.
OSRM / Project OSRM A public open-source routing service. When a user explicitly requests directions on the map, only the minimum data needed to calculate the route is sent, namely origin and destination coordinates, with no other identifying data attached. Data collected: approximate geolocation coordinates. More details on this public routing infrastructure are available at project-osrm.org.
Google Maps embed Used only as a fallback embedded map on a place or event page when exact coordinates are not yet available. In that case Google may set its own cookies and process data according to its own Privacy Policy.
3.6 Geolocation
On the map page, the user may select the "locate me" function to center the map on the current position; this triggers the browser's geolocation permission request. If permission has already been granted, the map may request the position automatically when the page loads for the same purpose.
Location data is used solely for this function and, if directions are requested, is transmitted to OSRM as described in Section 3.5. That data is not stored by the Owner beyond the current browsing session. Users may withdraw permission at any time through the browser's site settings.
4. Method and place of processing
Methods of processing
The Owner adopts appropriate security measures to prevent unauthorized access, disclosure, alteration, or unauthorized destruction of data. Processing is carried out using IT and telematic tools, according to organizational procedures strictly related to the stated purposes.
In addition to the Owner, data may be accessible to the third-party providers listed in Section 3 and to parties involved in operating the Service. The updated list of those parties may be requested at any time using the contact details in Section 1.
Some third-party providers listed in Section 3 act as Data Processors on behalf of the Owner, in particular Supabase for database and file storage and Vercel for hosting the Service. Others act as independent Data Controllers for the data they receive, including Google for Google Analytics and Google Maps, Cloudflare for Turnstile, and Vercel for aggregated data collected through Vercel Analytics and Speed Insights. Where a provider acts as an independent controller, the Owner has no control over and no visibility into the provider's further processing beyond what is described in that provider's privacy policy.
The Owner has not appointed a Data Protection Officer (DPO), as this is not mandatory under Article 37 GDPR considering the nature, scale, and purposes of the processing described in this document.
Legal basis of processing
The Owner may process users' Personal Data where at least one of the following applies:
the user has given consent for one or more specific purposes, such as analytics cookies or browser-based geolocation;
providing the data is necessary for the performance of a contract with the user or for pre-contractual steps requested by the user;
processing is necessary to comply with a legal obligation to which the Owner is subject;
processing is necessary for the Owner's legitimate interests, for example preventing spam and abuse through Cloudflare Turnstile or maintaining basic internal usage statistics.
Upon request, the Owner will clarify the specific legal basis applicable to any given processing activity.
Place of processing
Data is processed at the Owner's operating offices in Italy and at the infrastructure of the third-party providers listed in Section 3, which may also be located outside the European Union, in particular in the United States for Google and Vercel services. Where an extra-EU transfer takes place, the applicable safeguards are described in the relevant providers' privacy policies.
5. Retention period
Data collected through the Contact and Advertise forms is retained until the relevant request has been fully handled and for a reasonable period afterward for administrative and record-keeping purposes, after which it is deleted.
Data collected through the "Submit a place" and "Submit an event" forms is retained until the submission has been reviewed and, if the content is published, for as long as needed to provide credit or manage follow-up communication with the submitter. Photos and videos not used in published content are periodically removed.
The internal usage log contains no name, email address, or IP address, but only event type, page identifier, and timestamp. As a precaution, that data is still retained for no longer than 24 months from collection; older log entries are deleted afterward.
Data processed by third-party services is retained according to each provider's own policy, as referenced in Section 3.
Once the applicable retention period expires, Personal Data is deleted and the rights described in Section 6 can no longer be exercised in relation to deleted data.
6. Users' rights
Users may exercise the following rights at any time and free of charge in relation to data processed by the Owner:
withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
object to processing based on a legal basis other than consent;
access their data and obtain confirmation that processing exists, together with a copy of the data;
verify and request rectification of inaccurate data;
obtain restriction of processing where applicable;
request erasure of data where applicable;
receive data in a portable format, where technically feasible;
lodge a complaint with a competent supervisory authority.
Requests may be sent to the Owner using the contact details in Section 1 and will be handled as early as possible and in any event within one month.
7. Additional information
System logs and maintenance For operation and maintenance purposes, the Service and the third-party providers listed in Section 3 may collect files that record interaction with the Service (system logs), which may include IP addresses for those technical purposes only.
Information not contained in this policy Further details regarding the collection or processing of Personal Data may be requested from the Owner at any time using the contact details in Section 1.
How Do Not Track requests are handled The Service does not support "Do Not Track" requests. To determine whether any third-party services used honor such requests, their respective privacy policies listed in Section 3 should be consulted.
Children's privacy The Service is not directed to children, and the Owner does not knowingly collect Personal Data from anyone under the age of 16.
Changes to the Privacy Policy The Owner reserves the right to change this Privacy Policy at any time by giving notice on this page. It is recommended to review it periodically, referring to the last updated date. If changes affect processing based on consent, the Owner will collect new consent where required.
8. Definitions and legal references
Personal Data (or Data) Any information that directly or indirectly allows the identification or identifiability of a natural person.
Usage Data Information collected automatically through the Service, which may include IP addresses or domain names of the devices used, URI addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the server response status code, the country of origin, browser and operating system features, and other parameters relating to the user's IT environment.
User The individual using the Service who, unless otherwise specified, coincides with the Data Subject.
Data Subject The natural person to whom the Personal Data refers.
Data Processor The natural or legal person, public authority, service, or other body that processes Personal Data on behalf of the Data Controller, as described in this policy.
Data Controller ITAWORLD COMPANY SRL SEMPLIFICATA, as identified in Section 1.
Service imperiatoday.com and the means through which the user's Personal Data is collected and processed.
European Union (or EU) Unless otherwise specified, any reference to the European Union also includes all states belonging to the European Economic Area.
Cookies Small sets of data stored on the user's device.
This Privacy Policy has been prepared, among other things, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the applicable Italian personal-data protection law.