Privacy Policy

10 July 2026

Pursuant to Regulation (EU) 2016/679 (GDPR), this notice describes how Ci vediamo in Calabria processes the personal data of platform users.

1. Data controller

The data controller is Ci vediamo in Calabria. For privacy matters you can write to info@civediamoincalabria.it.

2. Data we collect

We process:
• identification and contact data (first name, last name, email, phone), when provided through accounts, contact forms, support requests or content proposals;
• login credentials and session data: the password is stored as an encrypted hash (bcrypt); if signing in with Google or Apple, the identifiers they provide; any two-factor authentication (2FA); session and refresh tokens with related technical security information;
• favourites/wishlist, requests to become an owner or collaborator, publication requests and messages sent through the platform;
• for owners, operators and local businesses: images, descriptions, contact details, addresses, coordinates, opening hours, social profiles, any accommodation identification codes (CIN, CIR or other local codes where necessary) and information provided for publication;
• technical and log data (e.g. IP address, user-agent, application logs), also used for security and rate limiting;
• only with your prior consent, browsing and usage data collected through Google Analytics in aggregate and pseudonymised form (e.g. pages viewed, traffic source, main interactions).
• when ads are shown, technical data and consent signals processed by Google AdSense and Google's CMP, such as IP address, user-agent, page URL, advertising identifiers or cookies, consent status and ad interactions, according to the choices made in the CMP.
• data relating to premium services or featured listings voluntarily requested by owners, hosts or local business operators: promoted content type, duration, promotional text, amounts, currency, payment status, technical payment-session identifiers and consents/acceptances linked to the service;

In addition to the data already indicated, we also process:
• data relating to the acceptance of legal documents: date and version of acceptance of the Terms and Privacy Policy (termsAcceptedAt, termsVersion);
• technical device information associated with each refresh token (user-agent and IP address), retained for security and session management purposes;
• published reviews, if enabled (star rating, title, text, language) and any public reply by the owner or operator;
• user-submitted events and submitter data (name, email, account identifier);
• local business listings created by users or operators (name, description, address, coordinates, contact details, including any WhatsApp number and social profiles, opening hours, images);
• content of support communications (subject, messages, category, action history, any references to accommodations or published content);
• push notification subscription: browser push service endpoint, cryptographic keys (p256dh, auth), technical device information (userAgent);
• content of incoming emails or requests, if the related feature is active, within the limits necessary to manage the contact or support.

3. Purposes and legal basis

We process data to:
• manage accounts and profiles — performance of the contract (Art. 6.1.b GDPR);
• publish and maintain accommodation listings, local business listings, authorised contact details and informational content — performance of the contract or pre-contractual measures (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR);
• assess and manage requests to publish, modify or remove listings and content — pre-contractual measures, performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• send transactional emails and service communications — performance of the contract (Art. 6.1.b GDPR);
• comply with legal obligations, including authority requests and accountability obligations (Art. 6.1.c GDPR);
• ensure platform security, prevent abuse and fraud and apply rate limiting — legitimate interest (Art. 6.1.f GDPR);
• with your consent, analyse site use in aggregate form through Google Analytics to improve it — consent (Art. 6.1.a GDPR);
• demonstrate acceptance of legal documents — compliance with a legal obligation (Art. 6.1.c GDPR) and/or legitimate interest of the Controller (Art. 6.1.f GDPR);
• manage, moderate and publish reviews, owner replies and aggregate scores, if such features are enabled — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• receive, moderate and publish user-submitted events and business listings — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• manage support communications and contact requests — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• send push notifications — consent (Art. 6.1.a GDPR), withdrawable at any time;
• publish the local business directory — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• aggregate and display informational content from external sources — legitimate interest of the Controller (Art. 6.1.f GDPR), in compliance with applicable licences.
• with your consent and according to the choices made in Google's CMP, serve ads through Google AdSense, measure their performance, cap frequency, prevent fraud and abuse and, where allowed, personalise ads — consent (Art. 6.1.a GDPR) and, for security and fraud prevention, legitimate interest (Art. 6.1.f GDPR) where applicable.
• manage premium services or featured listings voluntarily requested by owners, hosts or local business operators, including checkout, receipts, activation, renewal, support and administrative traceability — performance of the contract, legal obligations and legitimate interest (Art. 6.1.b/c/f GDPR);

4. Data processors and third parties

To deliver the service we rely on providers that process data on our behalf or as independent controllers, each with its own policy and only when the related feature is used or configured:
• Google — sign-in with Google account;
• Google (Google Analytics) — aggregate site usage statistics, only with your prior consent;
• Google (Google AdSense and Google CMP) — advertising consent management, ad serving, measurement, fraud and abuse prevention and, if the user consents, ad personalisation;
• Apple — sign-in with Apple account;
• Stripe — management of payments relating to premium services or featured listings voluntarily chosen, only when such features are active and used;
• Resend — sending transactional emails and managing any incoming requests;
• Vercel — application hosting;
• MongoDB — database;
• a cache and rate-limiting service (Redis);
• Esri/ArcGIS and MapTiler — provision of map tiles for maps (transmit IP and User-Agent);
• Nominatim/OpenStreetMap Foundation — address geocoding for business listings (transmits IP, User-Agent and address string at entry time);
• Ticketmaster — events API, if active (transmits API key and User-Agent);
• browser push services (Google FCM, Mozilla autopush, Apple APNs) — push notification delivery.
Some of these providers may process data outside the European Union under their respective adequate safeguards.

5. Retention

We retain data for periods consistent with the purposes of processing and applicable obligations. In particular:
• account and profile data: until the account is deleted, except for data that must be kept longer for legal obligations or rights protection;
• refresh tokens: until technical expiry or revocation;
• publication, modification or removal requests and their outcome: for the time needed for handling and administrative traceability;
• images, descriptions, contact details and identification codes of accommodations or businesses: until the content is removed or the authorisation is withdrawn, save further retention needs;
• technical logs and security data: for the time strictly necessary;
• reviews: for the duration of the service or until account deletion, with anonymisation where appropriate;
• push subscription: until consent is withdrawn or account is deleted;
• support tickets and incoming requests: for the time necessary for management and legal defence;
• local content aggregated from external sources: news up to 75 days from publication, past events removed periodically;
• Terms and Privacy acceptance records: retained for the duration of the GDPR accountability obligation.
• data relating to premium purchases, featured listings, payments and receipts: for the time necessary for administrative, accounting and tax management and rights protection;

When an account is deleted, personal data no longer needed is removed or anonymised, leaving only what is indispensable for legal obligations or rights protection.

6. Security

We adopt appropriate technical and organizational measures: encrypted connections (HTTPS), password hashing (bcrypt), authentication via JWT tokens with rotating refresh tokens, rate limiting, security headers and role-based access control.

7. Transfers outside the EU

Where providers such as Google (including Google Analytics), Apple, MongoDB, Vercel, Resend or the Redis service used for technical functions process data outside the European Economic Area, the transfer takes place on the basis of appropriate safeguards provided for by the GDPR (e.g. standard contractual clauses, the EU-US Data Privacy Framework or other permitted mechanisms). Esri/ArcGIS, MapTiler, Nominatim/OpenStreetMap Foundation, Ticketmaster and browser push services (Google FCM, Mozilla autopush, Apple APNs) may similarly process data outside the EEA under their own adequate safeguards.
The reference to Google also includes Google AdSense and Google CMP when advertising is configured on the site.

8. Your rights

You may exercise the rights of access, rectification, erasure, restriction, portability and objection by writing to the controller. You also have the right to lodge a complaint with the data protection supervisory authority.

If you have an account, you can also export your personal data from your account area and request deletion of your account. In that case personal data is removed or anonymized within the limits allowed by legal, accounting and rights-protection obligations.

9. Changes to this notice

This notice may be updated over time. Material changes will be made available on this page together with the relevant update date.

10. Contact requests and data published in listings

When a user uses a contact form or views contact details published in a listing, we process the data necessary to show the information, forward the request or manage support. These contact features do not constitute a booking and do not require payment to the platform for the stay. Any payments managed by the platform relate only to premium services or featured listings voluntarily chosen by owners, hosts or local business operators. Owners and operators remain responsible for the accuracy of the contact details and information they authorise for publication. Legal basis: performance of the contract or pre-contractual measures (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR).

11. Content aggregated from external sources

The platform aggregates news, events and points of interest from external sources (RSS feeds, open data, APIs). Such content may include personal data of third parties (e.g. the name of an event organiser) processed for purely informational purposes on the basis of the Controller's legitimate interest, in compliance with applicable licences. Anyone who believes that aggregated content contains their own inaccurate or outdated personal data may contact the Controller at the details indicated in the Contacts section.

12. Minors

The service is intended for adults. We do not knowingly collect personal data of individuals under 18 years of age. Should we become aware of having processed data of a minor, we will proceed with immediate deletion. Anyone who notices this circumstance is invited to contact us at the details indicated in the Contacts section.

13. Contact

To exercise your rights or for any request, write to info@civediamoincalabria.it.

14. Providing data

Providing the data required to create an account, send requests, propose content or use reserved features is optional, but necessary to provide the requested feature. Registration is free and does not require purchasing services, publishing premium listings, concluding bookings or taking on economic commitments. Premium or featured services are optional and are processed only if the interested user voluntarily chooses them. Consent for analytics, advertising or push notifications is always optional and withdrawable; refusal does not prevent browsing of essential features.

15. Automated decision-making

We do not use automated decision-making processes that produce legal effects or similarly significantly affect users. Any statistics, security systems, rate limiting, content moderation or ranking are used to protect and organize the service and may be subject to human review when they affect content or accounts.