Privacy

Last updated: 31 October 2026. Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

In short

• You can read the whole portal without giving a single piece of data and without accepting anything.
• I don’t use profiling cookies, there’s no banner to dismiss, no Google Analytics and no advertising pixels.
• The fonts are on my server: when you open a page, your browser doesn’t contact Google.
• I count visits myself, on my own server, without saving your IP address and without recognising you from one visit to the next.
• I give your data only to those needed to make things work: whoever hosts the site, whoever sends the mail, whoever collects payments. Never for advertising, never sold.

1. Data controller

Controller	Luigi Laita, private individual
Registered office	Details coming soon
VAT number (Partita IVA)	Not applicable: myTursi is currently a private project
Privacy contact	info@mytursi.it
Data protection officer	Not appointed: the cases of art. 37 GDPR do not apply.

2. What I process, why, and for how long

2.1 Visiting the site

The server hosting myTursi records, like every web server, the technical data of each request: IP address, date and time, page requested, browser and operating system, and any referring page. This is used to run the site and to detect faults and attacks.

Legal basis: legitimate interest in a secure and working website (art. 6.1.f GDPR). Retention: details coming soon

2.2 Visit statistics and QR codes

I count how many times a page is opened and how many times one of the QR code stickers you find around town is scanned. It helps me understand what’s useful and tell each business how many times its page was viewed.

From each visit I keep only: day and time, type of device (phone, tablet, computer), operating system, source category (direct, internal, search engine, social media), the page path without the part after the question mark, and the sticker number if one was scanned.

I don’t store the IP address, I don’t store the full browser details, I don’t store the address of the site you came from. I use neither cookies nor JavaScript to count: counting happens on my server. Two visits from the same device can’t be linked to each other. Visits from logged-in editors, or from partners viewing their own page, aren’t counted.

Legal basis: legitimate interest in measuring use of the portal in aggregate form (Art. 6(1)(f) GDPR). Retention: these rows contain no personal data at all — no IP address, no identifier, nothing that could trace back to a person or link two visits. They are numbers per day. That’s why they are kept: they’re used to compare one year with another.

2.3 Newsletter

If you subscribe to the newsletter I process your first name, last name and email address. I use double opt-in: after signing up you receive a message with a link to open, and only then are you subscribed.

To be able to prove that consent was given, I keep the email address, the date and time of confirmation and the IP address in shortened form: for IPv4 I remove the last block (for example 93.45.12.0), for IPv6 the last two. This data can’t be traced back to a person.

Legal basis: consent (art. 6.1.a GDPR and art. 130 of the Italian Privacy Code). Retention: as long as you remain subscribed. Proof of consent is kept as long as you are subscribed: it shows that the subscription was yours. Unconfirmed subscriptions are deleted after 2 days.

How to unsubscribe: at the bottom of every message there’s a link to unsubscribe. One click is enough, no explanations needed.

Recipient: MailerLite, which sends the messages on my behalf (see section 4).

2.4 Reports from residents

Through the “Reports” form you can report something that’s wrong in town. I process: type of report, text and — only if you enter them yourself; they’re optional — name and email address, plus any photo you choose to attach.

Photos don’t end up in the site’s public gallery: they stay in a protected folder, visible only to whoever runs the portal. A photo taken with a phone carries the place and time it was taken and the device model: I strip all that out as soon as the photo arrives, before even storing it. What’s left is the image, nothing more. If your phone sends a HEIC photo — as iPhones do — I convert it to JPG myself: you don’t have to change any settings, and no photo is rejected because of its format.

I keep an internal log of the handling: who did what and when, and to which address a reply was written.

Legal basis: legitimate interest in collecting and forwarding reports (Art. 6(1)(f) GDPR); for name and email, your consent, given by entering them. Retention: after twelve months I remove from the report everything that reveals who sent it: name, email address and the address I replied to. The report itself stays, without a name, with its text and photo. It helps me know that the problem existed and recognise it if it comes back; for that, I don’t need to know who wrote it.

Recipients: the report is forwarded by e-mail to my inbox and, if it concerns a municipal service or waste collection, may be passed on to whoever is responsible (details coming soon).

2.5 Requests via the “Become a partner” form and contact by email

I process what you write: name, business name, a contact (email or phone) and the question. This data isn’t stored on the site: it arrives by email in my mailbox and stays there.

Legal basis: pre-contractual measures at your request (art. 6.1.b GDPR). Retention: in the mailbox, details coming soon

2.6 Partner account: businesses on the portal

Anyone who lists their business has a personal account. I process:

• Contact person: first and last name, email address, password (stored only in encrypted form: I don’t know it and never send it).
• Business: name, category, description, address, phone, WhatsApp, email, website, social media profiles, opening hours, closures, offers, services, photos and videos.
• Billing details: company name, VAT number (Partita IVA), tax code (Codice fiscale), recipient code or PEC, billing address. For sole traders the tax code is personal data in every respect.
• Management: creation and activation date, expiry, status, chosen plan, payment identifiers.

I also keep a log of status changes (activated, suspended, rejected) with the business name, email address, reason, author and time. It’s used to reconstruct what happened to an account, and keeps the most recent entries.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR); for billing details, legal obligation (Art. 6(1)(c) GDPR). Retention: for the whole duration of the relationship. Tax documents for 10 years, as required by law. Rejected requests and the related account are deleted automatically after 30 days.

What partners write on their own page — opening hours, phone, photos — is public by their choice: that’s exactly how they get found. Billing details, on the other hand, don’t appear anywhere on the site.

2.7 Payments

Payments for the subscription plans don’t go through me. When the time comes you’re taken to Stripe’s checkout, which collects the card details and billing address directly. Card details never enter my systems.

I pass on to Stripe your email address, the chosen plan and, for the invoice, company name, VAT number and recipient code. From Stripe I receive the customer and subscription identifiers.

Legal basis: performance of the contract (art. 6.1.b GDPR). Note: the start-up phase is currently under way, during which no payment is triggered and no data reaches Stripe.

2.8 Service messages to partners

I write to partners to: give access, communicate a change of status, remind them of holiday opening hours fourteen days ahead, and send the monthly visit report. It’s not advertising: it concerns the service you requested.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

2.9 Monthly report and contact count

Every month I tell each business how many times it appeared in the listings, how many times its page was opened and how many times one of the contact buttons was pressed (phone, WhatsApp, email). The button goes through an intermediate address of mine that counts the click and takes you straight to the destination.

Here too I don’t record who you are: I only count how many. Appearances in the listings are stored as one row per business per day, with nothing about the person.

Legal basis: legitimate interest in measuring the service provided to the partner (Art. 6(1)(f) GDPR).

2.10 The map on a business page

On each business page, under “Where to find us”, there’s a Google Maps map. It doesn’t load by itself. In its place you’ll find a box with a button: until you press it, nothing is sent to Google.

When you press “Show map”, the box is loaded from Google’s servers: at that moment your IP address, your browser’s technical data and any cookies Google already has on your device reach them. I receive nothing from that request and don’t use it to recognise you.

Your choice stays in your browser, in local storage, under the entry mytursi_mappa: that way the map opens straight away on the other pages and I don’t ask you every time. It’s not a cookie, it doesn’t reach me and it doesn’t leave your device. If you delete the site data in your browser, the question comes back.

Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which may pass data on to Google LLC in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, for which the European Commission has recognised an adequate level of protection (Art. 45 GDPR). Google’s rules are at policies.google.com/privacy.

Legal basis: your consent, which you give by pressing the button (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You withdraw it by deleting the site data in your browser. If you don’t open the map, the address stays written below and the “Directions” button takes you to Google in a new page, whenever you want.

2.11 Events you suggest

On the “Events” page you can suggest an event to me. Besides the event details, I ask for your name, your phone number and, if you like, your email. They serve one purpose only: to be able to call you if something is unclear before the event goes online. They don’t appear on the site and don’t end up on any mailing list.

The submission stays in the site’s database. If I publish it, the event becomes public, but your contact details stay visible only to me. If I don’t publish it, I delete it once the event has passed.

Legal basis: carrying out what you asked for, i.e. assessing your submission (Art. 6(1)(b) GDPR), and legitimate interest in checking what I publish (Art. 6(1)(f) GDPR).

3. Cookies and similar tools

This site uses no profiling cookies and no third-party tracking tools. That’s why you won’t find any banner: under Art. 122 of the Italian Privacy Code and the Italian Data Protection Authority’s Guidelines of 10 June 2021, technical cookies don’t require consent.

Cookies	What it’s for	Duration
wordpress_logged_in, wordpress_sec	Keeps a person logged in who has signed in to the partner area or the administration. It isn’t set for people browsing without logging in.	Session, or 14 days with “remember me”
wp-settings	Display preferences for the administration, only for those who access it.	1 year

I don’t load fonts, videos or scripts from third-party servers: everything needed to display a page is on my server. The only exception is the Google map, and it loads only if you open it (section 2.10).

In the browser’s local storage (localStorage) I save just one entry, and only if you opened the map: mytursi_mappa, which remembers your choice. It’s not a cookie, it isn’t sent to me and it isn’t used to recognise you. I don’t use sessionStorage.

For visit statistics I use Matomo, installed on the myTursi server, without cookies and with a shortened IP address.

4. Who I share the data with

I don’t sell or pass on data to anyone for advertising purposes. Data is processed by me and, where necessary, by the providers listed here, appointed as data processors under Art. 28 GDPR.

Who	What it does	Where
Hetzner Online GmbH	Hosts the website and the database	European Union
IONOS SE	Mailbox and sending of messages	European Union
MailerLite	Sends the newsletter	European Union
Stripe Payments Europe	Collects payments for the plans	Ireland, with group companies in the United States
Open-Meteo	Weather forecast for Tursi	European Union

The request to the weather service comes from my server and contains only Tursi’s coordinates: your device never contacts that service and your IP address doesn’t reach it.

The map on the business pages is a different case: there your browser contacts Google, so your IP address reaches them. Google is not my data processor but an independent third party; details are in section 2.10.

Data may also be disclosed to tax and accounting advisers for legal obligations, and to the judicial authorities when the law requires it.

5. Transfers outside the European Union

As a rule, data stays within the European Union. The exception is Stripe: the contract is with the Irish company, but some operations may involve the US parent company. The transfer is based on the standard contractual clauses approved by the European Commission and on the EU-US Data Privacy Framework.

6. How long I keep the data

What	How long
Newsletter subscription	As long as you stay subscribed
Unconfirmed subscriptions	2 days
Proof of consent to the newsletter	As long as you stay subscribed
Partner account and business data	For the duration of the relationship
Tax documents	10 years (legal requirement)
Rejected registration requests	30 days, then automatic deletion
Name and address of the person reporting	12 months, then removed
Text of the report, without name	kept, as a record of the town’s problems
Visit statistics (no personal data)	Kept
Server logs	Details coming soon

7. Your rights

At any time, under Articles 15 to 22 GDPR, you can ask me:

• to know what data of yours I hold and to receive a copy;
• to correct it if it’s wrong or incomplete;
• to delete it;
• to restrict its use;
• to receive it in a machine-readable format, or have it transferred to another controller;
• to object to processing based on legitimate interest;
• to withdraw your consent if you gave it, without affecting the lawfulness of what was done before.

Write to info@mytursi.it. I reply within a month. If you’re not satisfied, you can contact the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — garanteprivacy.it — or go to court.

8. Minors

The portal isn’t aimed at children and doesn’t ask for age. For services that require consent, such as the newsletter, in Italy consent is valid from the age of 14 (Art. 2-quinquies of the Italian Privacy Code); below that, the consent of whoever holds parental responsibility is required. If you notice that a child under 14 has signed up, write to me and I’ll delete everything.

9. Obligation to provide data

Browsing requires no data. For the newsletter I need email, first and last name: without them I can’t subscribe you. For the partner account I need the business details and, for invoicing, the tax details: without them I can’t activate the service. In reports, name and address are optional; without them I can’t reply to you.

10. Automated decisions

I don’t make automated decisions about you and I don’t do any profiling.

11. Security

The site runs encrypted (HTTPS). Passwords are stored only in encrypted form. Photos from reports are kept in a folder that can’t be reached from the web. Access to the administration is reserved for those entitled to it.

12. Changes

When the portal changes, this page changes with it. At the top you’ll always find the date of the last update. If the change concerns something important, I’ll also mention it in the newsletter.