Privacy Policy

The data controller of personal data collected via the Site is GuardaMe. The controller's full identification details (registered name, VAT number, registered office, reference email address) are shown in the Contact section of the Site.

GuardaMe is not currently required to appoint a Data Protection Officer (DPO) under Article 37 GDPR; an internal contact point for privacy matters is however always available via the Contact page.

GuardaMe processes the following categories of personal data:

• Account registration data (optional) - first name, last name, email address, password (stored hashed using bcrypt), and optionally preferred language and approximate geographic location (reference municipality) for result personalisation.
• Site usage data - IP address, browser and device type, pages visited, favourited activities, session duration, referrer page.
• Contact and support data - name, email address and message content when you write to us via the Contact page.
• Technical security data - server access logs, failed authentication attempts, session tokens, anti-abuse and anti-spam protection data.
• Administration data (admin accounts only) - TOTP secret for two-factor authentication.
• Measurement identifiers - a random identifier for the browser or app installation and one for each visit, generated on your device without any name or e-mail attached. They let us count returning visitors and join a visit to an account after login.
• Usage events - pages and activities opened, cards shown and clicked, searches performed, shares, favourites, start and end of each visit, together with the IP address and the type of device.
• Location data - only if you allow it: the coordinates of the device are turned into a reference municipality (for example “Lecce”), which is what we keep; the precise coordinates are not stored.
• Mobile app data - for the “Me” app: the same measurement identifiers and usage events, the device model class (iPhone or iPad) and the app version.
• Notification data (apps only) - the push token the operating system assigns to that installation, the app language, and your notification switches. The token identifies the installation, not you, and is deleted on logout or when you turn notifications off.

GuardaMe does not knowingly collect data falling within the special categories under Article 9 GDPR (racial or ethnic origin, political or religious beliefs, health, sexual life, biometric or genetic data).

Personal data are processed for the following purposes, each grounded in a specific lawful basis under Article 6 GDPR:

• Service provision (account creation, favourites management, locale and language personalisation) - lawful basis: performance of a contract to which the data subject is party (Art. 6.1.b).
• Responding to contact requests - lawful basis: legitimate interest in answering users who initiate the communication (Art. 6.1.f).
• Site security, prevention of abuse, fraud and unauthorised access - lawful basis: legitimate interest in protecting the Site and its users (Art. 6.1.f).
• Aggregate usage statistics via Google Analytics in aggregated and anonymised mode - lawful basis: legitimate interest in service improvement, subject to the specific consent required for analytics cookies (see Cookie Policy).
• Compliance with legal obligations - lawful basis: legal obligation (Art. 6.1.c), e.g. for judicial or police authority requests.
• Advertising - the Site is financed by advertisements served by Google AdSense. Where the visitor consents through the privacy message, Google and the selected partners process browsing data and identifiers to select and measure personalised advertisements - lawful basis: consent (Art. 6.1.a). Without consent only non-personalised advertisements are shown. The app contains no advertising.
• Measurement of our own content (which activities are opened, searched for or saved) - lawful basis: consent for the identifiers stored on the device (Art. 122 Italian Privacy Code) and legitimate interest in improving the editorial offering (Art. 6.1.f). These data are not used for advertising profiling.

Providing registration and contact data is optional; refusal results in the inability to access features that require an account (favourites, profile) or to receive a response from the support team.

GuardaMe may share personal data with the following parties, each appointed as a processor under Article 28 GDPR or acting as an independent controller for its own purposes:

• Amazon Web Services EMEA SARL (Luxembourg / EU data centres) - hosting of the Site, of the database and of the backups.
• Google Ireland Ltd. (with the global infrastructure of Google LLC) - Google Analytics 4, Google Maps Platform and Google Places, Google reCAPTCHA v3 on the contact form, Google's generative models used to produce illustrations for activities, and, for the apps, Firebase Cloud Messaging (push notifications) and Firebase Crashlytics (crash reports). Google AdSense is currently suspended and loads nothing; if advertising returns, Google acts as an independent controller for it.
• Meta Platforms Ireland Ltd. - Instagram and Facebook players used to show the original post of an event.
• Twilio Inc. / SendGrid (USA) - sending service e-mails (verification, password reset, replies to contact messages, notices). Recipient address and message content are transmitted.
• Anthropic PBC (USA) - AI model used to translate and write the descriptions of activities. Only content about published activities is sent; no user data.
• Apify Technologies s.r.o. (Czech Republic) and Lovable - collection of public event announcements from social pages of organisers, which feeds the events catalogue. No Site user data is transmitted.
• Infomaniak Network SA (Switzerland) - domain and DNS management, and the mailbox of the addresses published on the Site.
• Cloudflare, Inc. (USA) - protection and content delivery network. Active only once the Site is served through that network; Cloudflare processes the IP address as an independent controller for its own security purposes.

GuardaMe does not sell personal data and does not take automated decisions producing legal effects on the data subject.

Some of the providers listed above are based in the United States. The transfer of data outside the European Economic Area takes place only with appropriate legal safeguards, under the mechanisms provided by Chapter V GDPR:

• the EU-US Adequacy Decision (Data Privacy Framework, European Commission Decision 2023/1795) for certified providers (Google LLC, Meta Platforms Inc., Cloudflare Inc., Anthropic PBC where applicable);
• otherwise, Standard Contractual Clauses approved by the European Commission (Decision 2021/914), supplemented where necessary by additional measures.

You may obtain a copy of the safeguards applied by contacting GuardaMe via the Contact page.

GuardaMe retains personal data only for as long as is strictly necessary to achieve the purposes for which they were collected. In particular:

• Account registration data - until the user deletes the account, plus 30 days of technical retention to enable possible restoration or residual obligations.
• Server technical logs and security data - typically 90 days, subject to extensions justified by security incidents or requests from competent authorities.
• Contact and support data - up to 24 months from the last communication, unless a legal obligation requires longer retention.
• Data collected via cookies and measurement tools - according to the periods indicated in the Cookie Policy.
• Usage events, searches, visits and town counters - a maximum of 14 months, after which they are deleted or irreversibly aggregated.
• E-mail delivery logs (address, template, status) - 24 months.
• Contact messages - up to 24 months from the last exchange.

At the expiry of the indicated periods, data are deleted or irreversibly anonymised.

The Site uses technical and preference cookies and - subject to consent under Article 122 of the Italian Privacy Code - analytics and third-party cookies. Detailed information on categories, individual cookies, providers and retention periods is available in the Cookie Policy, which forms an integral part of this Privacy Policy. You can change your preferences at any time via the cookie-management banner available at the foot of every page of the Site.

The “Me” app for iPhone, iPad and Android uses the same account and the same servers as the Site, with these differences:

• It contains no advertising, no advertising cookie and no Google Analytics.
• It does not track you across other companies' apps or websites, and asks for no advertising identifier (IDFA).
• It measures use of its own content exactly as described above, with a random identifier for the installation and one per session.
• Location is requested only when you use the “near me” features, through the system permission, and can be withdrawn at any time in the device settings. Only the reference municipality is stored.
• The contact form inside the app requires a signed-in account, since the anti-spam check used on the Site cannot run in an app.
• Deleting the account from the app deletes the same data as deleting it from the Site.
• Crash reports. If the app crashes, a technical report (device model, operating system version, app version and the app's state at that moment) is sent to Google Firebase Crashlytics, which processes it on our behalf. The report contains no name, e-mail or account identifier, is not used for advertising, and is kept for 90 days.
• Notifications. If you allow notifications, the app stores a device token so that we can send you reminders for events you saved, suggestions of events and places near you, and new items matching your interests. We send no advertising by notification. Each type can be switched off in your profile, and the token is deleted when you log out, disable notifications or uninstall the app. Messages are delivered by Google Firebase Cloud Messaging and, on iPhone and iPad, by the Apple Push Notification service, which act as our processors. For “near you” messages we use the last position known to the app, only if you allowed location. We keep a record of what was sent (type, time, outcome) so that the daily limits and the quiet hours are respected.

The App Store and Google Play product pages show the stores' summaries of the data collected, which match this section.

Under Articles 15-22 GDPR you have the right, at any time, to:

• Access (Art. 15) - obtain confirmation of processing and a copy of your personal data;
• Rectification (Art. 16) - request the correction of inaccurate data or completion of incomplete data;
• Erasure (Art. 17, "right to be forgotten") - request deletion of your data in the cases provided by law;
• Restriction (Art. 18) - request restriction of processing in the cases provided by law;
• Portability (Art. 20) - receive your data in a structured, commonly used and machine-readable format, and transmit them to another controller;
• Objection (Art. 21) - object to processing based on legitimate interest, except for compelling grounds that justify continuation;
• Withdrawal of consent (Art. 7.3) - where processing is based on consent, with effect for the future.

Requests may be submitted via the Contact page. GuardaMe responds within 30 days, extendable by a further 60 days for complex requests.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (website: garanteprivacy.it) or with any other competent supervisory authority.

The Site is not intended for minors under 14. Under Article 2-quinquies of the Italian Privacy Code (introduced by Legislative Decree 101/2018), a minor aged 14 or over may independently consent to the processing of their data for information-society services; below that age the consent or authorisation of the holder of parental responsibility is required.

GuardaMe does not knowingly collect data from minors under 14. Should a parent or guardian become aware that a minor has provided personal data without authorisation, deletion may be requested via the Contact page.

GuardaMe applies appropriate technical and organisational measures to protect personal data against destruction, loss, alteration, unauthorised disclosure or access. These measures include, among others: encrypted HTTPS transmission with HSTS, passwords stored via bcrypt hashing, two-factor authentication for administrator accounts, database access segregation, security logs and regular backups.

However, no system can guarantee absolute security. In the event of a personal-data breach posing a risk to the rights and freedoms of data subjects, GuardaMe will make the notifications required by Articles 33 and 34 GDPR within the prescribed timeframes.

GuardaMe reserves the right to update this Privacy Policy at any time, including to adapt to regulatory changes, new Site features or new providers. Material changes will be communicated by notice on the Site and, for registered users, by email, with reasonable advance notice before they take effect. The date of the most recent update is shown at the bottom of this page.

For any request concerning this Policy or the exercise of GDPR rights, you can contact GuardaMe via the Contact page. Responses are typically provided within 30 days of receipt.