This page explains what data we collect on Valtiberina Travel, why we process it, and what rights you have. It covers the whole site, with two exceptions noted further down.
Data controller
The data controller is Davide Crestini, who runs Valtiberina Travel as a private individual, not as a company. For any question about this notice, or to exercise your rights, write to info@valtiberina.travel.
Why we collect data, and on what legal basis
We use the data collected on the site for two distinct purposes, each with a different legal basis.
Detailed statistics — Google Analytics
If you consent via the cookie banner, we use Google Analytics (GA4) to understand which pages work best and where visitors come from. The legal basis is your consent (Art. 6(1)(a) GDPR): without consent, Google Analytics never activates. You can change your mind at any time from the "Cookie preferences" link at the bottom of the site — see the cookie policy for details on the cookies used.
Aggregate, cookieless measurement — Vercel
Regardless of your consent, we use Vercel Web Analytics and Vercel Speed Insights to count visits in aggregate and measure the site's performance. These tools don't set cookies or any other identifier on your device and don't identify you individually. The legal basis is legitimate interest (Art. 6(1)(f) GDPR) in understanding how the site is used and keeping it fast — an interest we consider balanced by the fact that nothing personal is tracked.
Who receives the data
A few providers process data on our behalf, or receive it as part of how the site runs:
- Google (Google Analytics) — processes browsing statistics, only once you've given consent.
- Vercel — hosts the site and provides Web Analytics and Speed Insights.
- Sanity — manages the site's editorial content (text, images, itineraries); it doesn't receive visitors' browsing data.
- Tally — the platform hosting the questionnaire linked to the prize competition. The questionnaire lives on an external site: if you fill it in, your data, including the contact details needed for the prize, is collected directly by Tally, not by us.
Data transfers outside the European Union
Google and Vercel are based in the United States. Both are certified under the EU-US Data Privacy Framework, the mechanism the European Commission recognises as an adequate safeguard for transferring personal data to the United States.
How long we keep the data
Data collected via Google Analytics is retained for 14 months, after which it's automatically deleted. Vercel Web Analytics and Speed Insights don't retain data attributable to an individual visitor, since they're aggregate, cookieless tools.
Map submissions (Curiosities)
From the map you can submit a curiosity about a spot in the valley. It is entirely voluntary: if you don't fill the form in, we collect nothing.
We collect the text you write, the point you choose on the map and, if you choose to give them, your name and your source. The name and the source are published alongside the curiosity; so are the text and the coordinates. Your email address is optional and is never published: it exists only so we can come back to you if something needs checking.
Every submission lands in the editorial team's private Slack channel (Slack Technologies), where it is read and either approved or rejected. Before it is sent, Cloudflare Turnstile checks that a person rather than a bot is writing: to do that, Cloudflare receives your IP address and some technical characteristics of your browser. Turnstile sets no cookies on your device, and Cloudflare states that it does not use this data to profile you or for advertising.
A rejected submission exists only in the Slack message and disappears with it. An approved one becomes a curiosity in our CMS: the text, the point, the name and the source become public on the map, while the email stays in the private Slack channel alone and never enters the CMS.
You can ask us at any time to correct or remove a curiosity you submitted, by writing to info@valtiberina.travel.
Your rights
You can exercise the rights set out in Articles 15-21 of the GDPR at any time, by writing to info@valtiberina.travel:
- access — find out what data we process about you;
- rectification — correct inaccurate or incomplete data;
- erasure — ask for your data to be deleted;
- restriction — ask us to suspend processing in certain cases;
- portability — receive your data in a structured format;
- objection — object to processing based on legitimate interest.
We respond within one month of your request, as required by Art. 12 of the GDPR.
Complaining to the Garante
If you believe the processing of your data breaches the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it), the Italian supervisory authority.
What this notice doesn't cover
The newsletter sign-up form on the homepage is currently just a mock-up: it doesn't send data anywhere. If we ever switch on real sign-ups, this notice will be updated accordingly.
The questionnaire linked to the prize competition isn't embedded in this site: the button takes you to Tally, an external service, where the questionnaire lives and where any data you provide is collected. That's why no separate consent is needed on this page — but we've still listed Tally among the recipients above.