Privacy Policy

Last updated: 12/09/2026

This privacy policy explains what personal data we collect on scoprigaeta.it, in the “Enea – Guida di Gaeta” and “ScopriGaeta Partner” apps, and through the WhatsApp channels of Enea and participating businesses, why we process them, how long we retain them, and how you can exercise your rights. It is drawn up in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data Controller

Alessandro Palladino
Via del Colle, Contrada Canali, 1 tr. dx — 04024 Gaeta (LT)
P.IVA IT03305780599
Email: info@scoprigaeta.it — Phone: +39 348 268 0868

For any request regarding your data, including the exercise of the rights described in section 11, the contact email is info@scoprigaeta.it.

2. What Data We Collect

• Data you provide to us — first name, last name, email address, and phone number when you fill out a contact or booking form.
• Browsing data — IP address, browser type, operating system, and similar technical data collected by analytics tools and the content delivery network.
• Conversations with the virtual assistant — see section 4 for the web chat and section 4-bis for WhatsApp.
• Partner app data — see section 5. This applies only to affiliated businesses, not to website visitors.

Which cookies and similar technologies we use, and how to grant or withdraw consent, is explained in our Cookie Policy.

3. Why We Process Data and on What Legal Basis

• Responding to requests received via forms and managing bookings and commercial partnerships — performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
• Sending promotional content via email or online tools — explicit consent (Art. 6(1)(a)), revocable at any time.
• Providing information on attractions and services, ensuring website security, and improving its operation — legitimate interest of the data controller (Art. 6(1)(f)).

Data processing is carried out using electronic tools and appropriate measures to ensure data security. We do not carry out automated decision-making processes or direct profiling.

4. The Web Chat of the Virtual Assistant “Enea”

The website offers a chat with an AI-based virtual assistant. The service does not require registration or the entry of your first name, last name, or email. However, the content may include personal data if you write it in the conversation. The WhatsApp channel is described separately in section 4-bis.

• Data processed — the content of conversations and related technical metadata (date, time, system logs).
• Why — to deliver the automated response service (performance of the requested service) and to improve our knowledge base, namely the information about Gaeta that the assistant draws upon when answering (legitimate interest of the data controller).
• Who processes it — content required for the requested feature may be transmitted to the technology providers listed in section 9. The providers involved depend on the service used: not all providers receive every request. Processing on our behalf is governed by applicable agreements. Technical logs may be retained for security, abuse prevention, and legal compliance, in accordance with the service terms. For transfers outside the European Economic Area, see section 10.
• For how long — ninety days, as stated in section 8.

ScopriGaeta does not use conversations to train its own artificial intelligence models. Reviews by authorized staff serve to correct information and improve the service, within the limits of the purposes and retention periods described in this privacy policy. Any use of content by third-party providers follows product terms and applicable settings: it should not be confused with technical storage for security purposes. Information regarding providers is detailed in section 9.

We ask you not to enter personal data in the chat — phone numbers, addresses, health or banking data. If you do so anyway, we process it in accordance with this privacy policy and reserve the right to anonymize or delete it from the logs for your protection.

How the artificial intelligence we use works, and which content undergoes human review, is explained in the Note Legali.

4-bis. Enea and Business Concierges on WhatsApp

You can use WhatsApp to ask for information from Enea or the concierge of a participating business. The first message identifies the assistant as an artificial intelligence system. When business staff intervene, the response is handled by a human operator.

To receive and reply to messages, we process your WhatsApp number, technical identifiers of the message and service number, the content you send, and data necessary to manage the conversation and delivery. The WhatsApp phone number and profile name are not automatically added to the text sent to the model. We ask that you do not send documents, health data, banking data, or other information not necessary for your request.

The WhatsApp channel uses Meta services to handle messages. For artificial intelligence features, we rely on the technology providers listed in section 9, depending on the service used. If the relevant features are enabled, a voice message may be transcribed and a photo may be analyzed; the content is transmitted to the AI provider for this processing. During human handling, attachments remain accessible to authorized staff. Images intended for analysis are processed as temporary files, which are deleted upon completion; an automated routine removes any files that might remain after an interruption. Shared location is used to search for nearby places in the website catalog, without transferring coordinates to the model.

We respond to tourist inquiries to provide the service and keep it secure, in the legitimate interest of the data controller. Communications necessary for booking management follow the legal basis of the requested service. Opting to receive them via WhatsApp is optional and separate from the booking: the purpose, source, date, and version of the text presented are recorded. This choice applies only to the specified request and sender; it is not automatically extended to other businesses or future promotional communications.

Confirmations, modifications, cancellations, receipts, and reminders may be sent from the business’s management system. Their content derives from the actual booking recorded. The delivery of a requested promotional voucher is separate: it requires a specific opt-in for that voucher and does not subscribe you to campaigns or mailing lists.

Conversations are stored in a dedicated, encrypted WhatsApp archive. They become inaccessible after 72 hours from the last incoming message; each individual content item has a maximum limit of 30 days in conversations kept active. Physical deletion is performed at regular intervals, typically within one hour of expiration, with error checking. WhatsApp content is not copied to standard web chat logs or knowledge-improvement logs. Any copies made prior to migration follow the documented retention of the previous system until they are definitively identified and removed.

Temporary data required for the queue have their own expiration periods. Coordinates are removed from the task upon completion of processing; location tasks have a maximum validity of five minutes. For notifications, we store outcomes and operational references separately, typically for up to 90 days after service completion. Proof of preferences and minimal logs preventing the restoration of revoked choices have a maximum retention window of 24 months from the recorded event. Standard administrative logs are retained for 30 days. Aggregated counters do not contain any guest text or phone numbers.

A business’s staff can only access their own channel and bookings, according to their assigned role. Administration accesses the data necessary to support the service and handle data requests. Inbox push notifications do not show conversation text. Access to details requires authentication.

You can opt out of WhatsApp communications by typing STOP or by asking the business directly. To access your data or request its deletion, you can write to info@scoprigaeta.it. Requests are verified proportionally. Deleting a chat does not cancel a booking and does not delete documents that must be retained for another purpose or legal obligation. A minimal log separate from the database ensures that a system restore does not make deleted conversations accessible again or reactivate revoked preferences.

Deletion managed by ScopriGaeta does not remove copies stored on the other party’s phone or independent processing by service providers. Meta and Google apply their own terms, including those regarding security, technical retention, and international transfers. Exports requested by staff may create copies on their device; handling these remains subject to the business’s own authorizations and procedures.

5. The «ScopriGaeta Partner» app

The ScopriGaeta Partner mobile app, available for Android and iOS, is reserved for affiliated commercial and tourism businesses. The data controller is the same as indicated in section 1.

The app does not collect data for advertising purposes and does not perform profiling for marketing purposes.

Legal bases — performance of the contract with the partner (Art. 6(1)(b)) for access, bookings, notifications, and chat; legitimate interest (Art. 6(1)(f)) for security, abuse prevention, and technical stability; consent (Art. 6(1)(a)) where specifically requested, for example for push notifications and access to the camera and gallery, granted via device system permissions and revocable at any time in device settings.

Third parties involved — Google/Firebase Cloud Messaging and Apple Push Notification service for sending notifications (they process the device token and the notification content); WhatsApp, if the partner chooses to continue a conversation with the customer on that channel: the provider’s privacy policy also applies; for concierge services and communications managed by the ScopriGaeta platform, the rules in section 4-bis also apply; Stripe, where payment processing is enabled, according to its own privacy policy — the controller does not store full card details. If the partner chooses to have a photo scanned — for example, a menu photo — to automatically transcribe its content, that image is transmitted to the artificial intelligence service provider indicated in section 4.

Account deletion — partner accounts are created and managed by Scopri Gaeta as part of the partnership. To request the deletion of the account and associated data, simply write to info@scoprigaeta.it: we will proceed within the required technical timeframe, subject to statutory retention obligations. Access is granted via individual credentials, and communications with servers travel over an encrypted channel (HTTPS).

6. The «Enea – Guida di Gaeta» app

The Enea – Guida di Gaeta mobile app, available for Android and iOS, is the city’s tourist guide and is open to everyone: it requires no registration or account. The data controller is the same as indicated in section 1. What you write in the chat is processed as described in section 4.

The app contains no advertising, does not perform profiling, and uses no analytics or tracking tools. It does not collect your name, email, phone number, or advertising identifiers, nor does it use analytics or crash-reporting libraries.

7. Photo contest — concluded edition

The photo contest hosted on the website has ended and is no longer open for submissions or voting. Some of the data collected during the contest is still retained according to the terms outlined below: this section remains published for as long as that retention period lasts.

Participant data — first name, last name, email address, phone number (optional), and the uploaded image file, processed to manage registration, verify requirements, publish the entry in the gallery, contact winners, and deliver prizes. Legal basis: performance of contractual and pre-contractual measures arising from acceptance of the contest rules (Art. 6(1)(b) GDPR). Images were published alongside the author’s name or the provided pseudonym.

Voter data and anti-fraud systems — during the voting process, IP addresses (in pseudonymized form), connection timestamps, and technical device identifiers generated via device fingerprinting (browser, screen resolution, operating system) were collected. These were used to ensure one vote per person, block bots and automated scripts, and validate the final leaderboard. Legal basis: the controller’s legitimate interest in IT security and ensuring fair competition (Art. 6(1)(f) GDPR); consent was not required for this processing.

Retention — participant data is retained for the time necessary to fulfill legal and tax obligations related to the awarding of prizes. Winning photos remain published as an archive of the contest, unless a removal request is made by the author. Technical voter data (IP and fingerprint) is stored for a maximum of six months from the close of the contest, after which it is deleted or irreversibly anonymized.

Who had access — internal staff and technical collaborators who manage the website, jury members (limited to images and names), and prize providers, solely for winners’ data and only when necessary for redeeming the prize.

8. How long we retain data

• Contact and booking data — twelve months from the last communication, or until your request for deletion.
• Contest data — in accordance with the terms in Section 7.
• Partner app data — for the duration of the collaboration relationship and, for statutory requirements, within the timeframes prescribed by law. Notification tokens are removed upon logout or uninstallation of the app.
• Conversations in the Enea web chat — ninety days, then automatically deleted by a daily routine. The same retention window applies to the log of questions used to improve the knowledge base.
• WhatsApp conversations and communications — distinct timeframes for chats, content, receipts, and preferences, as described in Section 4-bis.
• Technical diagnostic logs — sixty days.

9. Who data may be disclosed to

• technical service providers: hosting (Hostinger) and content delivery network;
• Google LLC, for analytics and tag management tools;
• technology providers for artificial intelligence features, content processing, technical support, and communication: Anthropic, Google, OpenAI, and Meta, depending on the service used and the purposes described in Sections 4 and 4-bis;
• the providers listed in Section 5 for the partner app (Google/Firebase, Apple, WhatsApp, Stripe);
• WordPress and Elementor plugins and technical tools necessary for the website’s operation.

The categories of shared data depend on the specific function: they may include the content of inquiries, attachments submitted for processing, and necessary technical data. For maintenance and support purposes, authorized staff may use support tools while limiting data to what is strictly necessary for verification or reporting. The list of providers does not imply that the complete archive of conversations is systematically sent to each of them.

When processing data on our behalf, providers operate in accordance with data processing agreements under Article 28 GDPR. For any processing carried out for their own purposes, such as managing their accounts and fulfilling obligations applicable to the service, they may act as independent controllers under their respective privacy policies. The mere listing of a provider on this page does not constitute consent to additional processing purposes.

Provider privacy policies: Anthropic; Google; OpenAI; Meta — WhatsApp. Terms, retention periods, and available controls may vary across products and account types.

We do not sell or transfer your data to third parties for their own commercial purposes.

10. Where data is stored and transfers outside the EU

Using the providers listed in Section 9 may involve processing and transferring data outside the European Economic Area. The safeguards provided by the GDPR apply to these transfers: European Commission adequacy decisions, where applicable to the recipient, or standard contractual clauses and additional measures where necessary. You can request information about the safeguards applicable to the processing of your data and how to obtain a copy by writing to info@scoprigaeta.it.

11. Your rights

You can at any time:

• access your data and request a copy;
• request its rectification or deletion;
• request restriction of processing or object to it;
• request data portability;
• withdraw previously given consent, without affecting the lawfulness of processing carried out prior to withdrawal;
• lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority) (www.garanteprivacy.it).

These are the rights provided for in Articles 15–22 of the GDPR. To exercise them, write to info@scoprigaeta.it.

12. Changes to this privacy policy

We may update this privacy policy at any time. The version in effect is the one published on this page, with the update date indicated at the top.