This notice explains how we process personal data for visitlamaddalena.org in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable ePrivacy rules. Bracketed items in [orange] must be completed before publication and the whole notice reviewed by legal counsel.
The controller responsible for your personal data is:
We operate visitlamaddalena.org, the official destination platform for the La Maddalena archipelago, under mandate from the Comune di La Maddalena. We determine the purposes and means of the processing described here and are therefore the data controller.
As a controller established outside the EU that offers services to individuals in the EU, we [have appointed / are appointing] a representative in the European Union: [EU representative name and contact — to be confirmed with counsel].
We do not intentionally collect special-category data, and the platform is not directed at children (see section 9).
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Respond to your enquiries and provide the services you request | Performance of a contract / taking steps at your request; legitimate interests |
| Analytics to understand and improve the site | Consent |
| Marketing pixels and social content | Consent |
| Site security, fraud prevention, service integrity | Legitimate interests |
| Complying with legal and accounting obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time (see section 5 and section 7) without affecting processing already carried out.
We share data only with service providers acting on our instructions under data-processing agreements, including:
We do not sell your personal data.
We use a consent banner (Cookiebot) that blocks all non-essential cookies and tracking technologies until you choose to accept them. Essential cookies needed to run the site are always active; analytics, advertising and embedded social content load only with your consent. You can review or change your choices at any time:
Some of our providers are located in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or applicable adequacy frameworks. You may request a copy of the relevant safeguards using the contact details above.
Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; data portability; and withdraw consent at any time. To exercise any of these, email [privacy@visitlamaddalena.org]. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority in your country of residence.
We keep enquiry and contact data for [retention period, e.g. 24 months] after our last contact; analytics data according to the retention set in Google Analytics; and other data only for as long as necessary for the purpose or as required by law.
This platform is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with data, contact us and we will delete it.
We may update this policy from time to time. The current version and its date are shown at the top of this page. Material changes will be signalled on the site.