Privacy Policy

Last updated: 21/08/2026

This privacy policy explains what personal data we collect on scoprigaeta.it and in the «Enea – Guida di Gaeta» and «ScopriGaeta Partner» apps, why we process it, how long we keep it, and how you can exercise your rights. It is drafted in accordance with Regulation (EU) 2016/679 (GDPR).

1. Data Controller

Alessandro Palladino
Via del Colle, Contrada Canali, 1 tr. dx — 04024 Gaeta (LT)
P.IVA IT03305780599
Email: info@scoprigaeta.it — Phone: +39 348 268 0868

For any request regarding your data, including exercising the rights described in Section 10, the contact address is info@scoprigaeta.it.

2. What Data We Collect

• Data provided directly by you — first name, last name, email, and phone number, when you fill out a contact or booking form.
• Browsing data — IP address, browser type, operating system, and similar technical data collected by analytics tools and the content delivery network.
• Conversations with the virtual assistant — see Section 4.
• Partner app data — see Section 5. This applies only to affiliated businesses, not to website visitors.

Which cookies and similar technologies we use, and how to grant or withdraw consent, is explained in our Cookie Policy.

3. Why We Process Data and Legal Bases

• Responding to requests received through forms and managing bookings and business partnerships — performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).
• Sending promotional content via email or online tools — explicit consent (Art. 6.1.a), revocable at any time.
• Providing information on attractions and services, ensuring website security, and improving its operation — legitimate interest of the controller (Art. 6.1.f).

Data processing is carried out using electronic tools and appropriate measures to ensure data security. We do not carry out automated decision-making processes or direct profiling.

4. The «Enea» Virtual Assistant

The website offers a chat feature powered by an AI-based virtual assistant. The service is anonymous: it does not require registration or the entry of your first name, last name, or email address.

• Data processed — the content of conversations and related technical metadata (date, time, system logs).
• Purpose — to deliver the automated response service (performance of the requested service) and to improve our knowledge base, namely the information about Gaeta from which the assistant draws when responding (legitimate interest of the controller).
• Who processes it — to generate the response, the conversation text is transmitted to a third-party AI service provider, acting as a data processor and processing it only for the time necessary to generate the response. This processing involves a transfer outside the European Economic Area, subject to the safeguards described in Section 10.
• Retention period — ninety days, as specified in Section 8.

Conversations are not used to train artificial intelligence models, neither ours nor the provider’s. We review them to understand what information is missing or unclear and to update our knowledge base: the service improves because we refine the information we provide to the assistant, not because the model learns from your questions.

Please do not share personal data in the chat — phone numbers, addresses, health or banking details. If you do so anyway, we will process them in accordance with this privacy policy and reserve the right to anonymize or delete them from the logs to protect your privacy.

How the artificial intelligence we use works, and which content undergoes human review, is explained in the Legal Notice.

5. The «ScopriGaeta Partner» App

The ScopriGaeta Partner mobile app, available for Android and iOS, is reserved for affiliated commercial and tourism businesses. The data controller is the same as specified in Section 1.

The app does not collect data for advertising purposes and does not perform profiling for marketing purposes.

Legal bases — performance of the contract with the partner (Art. 6.1.b) for access, bookings, notifications, and chat; legitimate interest (Art. 6.1.f) for security, abuse prevention, and technical stability; consent (Art. 6.1.a) where specifically required, for example for push notifications and access to camera and photo gallery, granted via device system permissions and revocable at any time from device settings.

Third parties involved — Google/Firebase Cloud Messaging and Apple Push Notification service for sending notifications (they process the device token and the notification content); WhatsApp, if the partner chooses to continue a conversation with the customer on that channel, in which case WhatsApp’s privacy policy applies; Stripe, where payment management is active, according to its own privacy policy — the controller does not store complete card details. If the partner chooses to have a photograph scanned — for instance, a photo of a menu — to automatically transcribe its content, that image is transmitted to the AI service provider indicated in Section 4.

Account deletion — partner accounts are created and managed by Scopri Gaeta as part of the partnership relationship. To request the deletion of your account and associated data, simply write to info@scoprigaeta.it: we will proceed within the necessary technical timeframes, subject to statutory retention obligations. Access takes place using individual credentials, and communications with servers travel over an encrypted channel (HTTPS).

6. The «Enea – Guida di Gaeta» App

The mobile app Enea – Guida di Gaeta, available for Android and iOS, is the city’s tourist guide and is open to everyone: it requires no registration or account. The Data Controller is the same as indicated in point 1. What you write in the chat is processed as described in point 4.

The app contains no advertising, performs no profiling, and uses no analytics or tracking tools. It does not collect names, emails, phone numbers, or advertising identifiers, and it does not use analytics or crash-reporting libraries.

7. Photo contest — concluded edition

The photo contest hosted on the website has ended and is no longer open for entries or voting. Part of the data collected during the contest is still retained under the terms indicated below: this section remains published for as long as that retention lasts.

Participants’ data — first name, last name, email address, phone number (optional), and the uploaded image file, processed to manage registration, verify eligibility requirements, publish the entry in the gallery, contact winners, and deliver prizes. Legal basis: performance of contractual and pre-contractual measures arising from acceptance of the contest rules (Art. 6.1.b GDPR). Images were published alongside the author’s name or provided pseudonym.

Voters’ data and anti-fraud systems — during voting, IP addresses (in pseudonymized form), connection times, and technical device identifiers generated via device fingerprinting (browser, resolution, operating system) were collected. They served to guarantee the uniqueness of each vote, block bots and automated scripts, and validate the final ranking. Legal basis: legitimate interest of the controller in cybersecurity and the fairness of the competition (Art. 6.1.f GDPR); consent was not required for this processing.

Retention — participants’ data is retained for the time necessary to fulfill legal and tax obligations related to the awarding of prizes. Winning photos remain published as an archive of the contest, unless removal is requested by the author. Voters’ technical data (IP and fingerprint) is stored for a maximum of six months from the close of the contest, after which it is deleted or irreversibly anonymized.

Who had access — internal staff and technical contractors managing the website, jury members (limited to images and names), and prize providers, solely for winners’ data and only when necessary for the delivery of the prize.

8. How long we retain data

• Contact and booking data — twelve months from the last communication, or until your deletion request.
• Contest data — according to the terms in point 6.
• Partner app data — for the duration of the collaborative relationship and, for legal obligations, within the terms established by applicable law. Notification tokens are removed upon logout or app uninstallation.
• Conversations with the Enea assistant — ninety days, then automatically deleted by a daily procedure. The same timeframe applies to the query log used to improve the knowledge base.
• Technical diagnostic logs — sixty days.

9. Who data may be shared with

• technical service providers: hosting (Hostinger) and content delivery network;
• Google LLC, for analytics and tag management tools;
• a third-party artificial intelligence service provider, to generate responses for the Enea assistant (point 4);
• the providers indicated in point 5 for the partner app (Google/Firebase, Apple, WhatsApp, Stripe);
• WordPress and Elementor plugins and technical tools necessary for the website’s operation.

We do not sell or transfer your data to third parties for their own commercial purposes.

10. Where data is stored and transfers outside the EU

Data is hosted on servers located in France, and therefore within the European Union. However, the use of services from non-EU providers — such as Google — may involve a transfer outside the European Economic Area: in that case, the transfer takes place on the basis of standard contractual clauses approved by the European Commission.

11. Your rights

You may at any time:

• access your data and request a copy;
• request its rectification or erasure;
• request the restriction of processing or object to it;
• request data portability;
• withdraw consent already given, without affecting the lawfulness of the processing carried out beforehand;
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

These are the rights provided for in Articles 15–22 of the GDPR. To exercise them, please write to info@scoprigaeta.it.

12. Changes to this policy

We may update this policy at any time. The version in effect is the one published on this page, with the update date indicated at the top.