Privacy & Cookie policy

Privacy and Cookie Policy

Versione 1.1 — giugno 2026

1. Data controller

The Data Controller of personal data collected through the VisitBrembo.it portal is:

VisitBrembo Association
Via A. Locatelli, 111
C.F.: 95237460167
VAT: IT04659680161
Email: info@visitbrembo.it

For any inquiries regarding the processing of personal data, you can contact the Controller at the above addresses.

2. Data collected and purpose of processing

The VisitBrembo.co.uk portal collects personal data under the following circumstances:

2.1 Site navigation (technical data)

During browsing, technical data such as IP address, browser type, operating system, pages visited and access times are automatically recorded by the servers. This data is processed exclusively for security purposes, technical diagnostics and aggregate traffic analysis. They are not associated with identified individuals.

Legal basis: legitimate interest of the Owner (Art. 6, par. 1, lett. f GDPR).

2.2 Contact form

Through the contact form, name, email address and the text of the message are collected. The data are used only to respond to the request received and are not kept beyond the time necessary to handle the communication.

Legal basis: esecuzione di misure precontrattuali o consenso dell’interessato (art. 6, par. 1, lett. b/a GDPR).

2.3 Newsletter subscription

Chi sceglie di iscriversi alla newsletter fornisce il proprio indirizzo email. Il dato viene trattato per l’invio di comunicazioni informative e promozionali relative alla Valle Brembana (eventi, itinerari, iniziative). Il servizio è gestito tramite Brief (Sendinblue SAS, Francia), che opera in qualità di responsabile del trattamento. I dati sono archiviati su server situati nell’Unione Europea.

Legal basis: consenso dell’interessato (art. 6, par. 1, lett. a GDPR), revocabile in qualsiasi momento tramite il link di disiscrizione presente in ogni email.

2.4 AI Chatbot

The portal provides an artificial intelligence-based virtual assistant to guide visitors in discovering the area. Typed questions are transmitted to a processing server and processed via third-party APIs (OpenAI). I messaggi non vengono associati all’identità dell’utente e non vengono conservati in forma nominativa. Si raccomanda di non inserire nel chatbot dati personali sensibili.

Legal basis: Legitimate interest of the Controller/expressed consent during use (Art. 6(1)(f/a GDPR).

3. Statistical analysis of the site

The site uses Google Analytics (Google LLC) per raccogliere dati anonimi e aggregati sulle modalità d’uso del portale (pagine visitate, durata delle sessioni, provenienza geografica approssimativa). Il tracciamento avviene solo previo consenso esplicito dell’utente tramite il banner cookie. Google Analytics è configurato con anonimizzazione dell’indirizzo IP. Per maggiori informazioni: policies.google.com/privacy.

4. Data Retention.

Personal data are kept for the time strictly necessary for the purposes for which they were collected:

• Navigation technical data: maximum 12 months.
• Contact form: until the closing of the application, but no later than 24 months.
• Newsletter: fino alla revoca del consenso da parte dell’iscritto.
• Chatbot interactions: current session; no named retention beyond the session.

5. Sharing with third parties

I dati personali non vengono venduti né ceduti a terzi per finalità commerciali. Possono essere comunicati esclusivamente ai seguenti soggetti, nella misura necessaria all’erogazione dei servizi:

• Brief (Sendinblue SAS, France) - newsletter management
• Google LLC - statistical analysis (Google Analytics)
• OpenAI LLC - processing requests to the chatbot
• Netsons Ltd. - portal technical infrastructure management

Where applicable, the transfer of data to non-EU countries is done on the basis of Standard Contractual Clauses approved by the European Commission, or other guarantee mechanisms provided by the GDPR.

6. Diritti dell’interessato

According to the Regulation (EU) 2016/679 (GDPR), every user has the right to:

• Access their personal data (art. 15);
• Obtain correction of inaccurate data (Art. 16);
• richiedere la cancellazione dei dati “diritto all’oblio” (art. 17);
• Request restriction of processing (Art. 18);
• Request data portability (Art. 20);
• object to the processing (art. 21);
• revoke consent at any time, without prejudice to the licentiousness of the processing based on the previously given consent.

Le richieste possono essere inviate al Titolare all’indirizzo indicato nella sezione 1. Il Titolare risponde entro 30 giorni dalla ricezione. In caso di risposta non soddisfacente è possibile proporre reclamo al Data Protection Authority (garanteprivacy.co.uk).

7. Cookie Policy

7.1 What are cookies

I cookie sono piccoli file di testo che i siti web salvano nel browser dell’utente durante la navigazione. Permettono al sito di ricordare le preferenze dell’utente, analizzare il comportamento di navigazione e, nel caso di cookie di terze parti, tracciare attività su più siti.

7.2 Types of cookies used

Technical cookies (strictly necessary)
Essential for the operation of the site. Do not require consent. They include session management cookies, consent preferences, and site security.

Analytical cookies (with consent)
They allow us to measure the performance of the site and understand how users use it. They are activated only after explicit consent. The portal uses Google Analytics with IP anonymization.

Third-party cookies (with consent)
The site may include embedded content from external services (e.g. Google Maps, YouTube). These services may set their own cookies and are activated only after explicit consent.

List of cookies used on the site

7.3 Consent management

Al primo accesso al sito viene mostrato un banner che consente all’utente di scegliere quali categorie di cookie accettare. Il consenso è facoltativo per tutte le categorie non tecniche. È possibile modificare le proprie preferenze in qualsiasi momento tramite il pulsante qui sotto o il link Cookie management available in the footer of the site.

Gestisci preferenze cookie

7.4 How to disable cookies

In addition to management via the banner, you can disable cookies directly from your browser settings. Disabling technical cookies may affect the proper functioning of the site.

8. Data security

The portal takes appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, or accidental disclosure. Among the measures taken: encrypted connection (HTTPS / SSL), application firewall (WAF), protection against brute-force attacks.

9. Updates to this policy

The Owner reserves the right to update this policy in the event of changes in regulations, technology, or in the services offered. The updated version will always be available at this URL. In case of substantial changes, registered users (newsletter subscribers) will be notified accordingly.

Ultima revisione: 29 giugno 2026