Privacy and Cookie Policy

1. Who processes your data

Funivie.it (the ‘Site’) is an independent information portal about cable cars, ski resorts and mountains in Italy. This notice describes how visitors' personal data is processed under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code), as amended by Legislative Decree 101/2018.

Data controller: [TITOLARE DA COMPLETARE] - legal name, legal form, registered office, VAT or tax number. Until this line is filled in, the identification of the controller required by Article 13(1)(a) GDPR is incomplete.

For anything concerning personal data you can write to us at: [email protected].

2. What data we process

We do not ask you to register and we build no user profiles. This is the data that passes through here:

• Technical browsing data. IP address, browser and device type, page requested, date and time. This data is generated automatically by every web request and ends up in the logs of the server and of the Cloudflare network that protects the Site. It is used to deliver the page to you and to stop abuse.
• Usage statistics, only if you accept them. With Google Analytics 4 we collect page views, language, device type, approximate geographic area and the source of the visit. The IP address is anonymised and Google Signals, the advertising signals that link several devices belonging to the same person, are switched off.
• Clicks on commercial links, only if you accept statistics. When you click a link to a partner we record an event called affiliate_click with three pieces of information: the partner (for example GetYourGuide or Stay22), the subject of the link and the path of the page the click came from. We do not record who you are.
• Contact form data. Name, email address, subject and body of the message you send us. The form is processed by our own server and sent directly to our mailbox, with no external form-forwarding service. To limit repeated submissions we keep your IP address only in pseudonymised form (a hash computed with a secret key) and delete it automatically 24 hours after your last submission.
• Preferences stored on your device. The choice you make on the cookie banner and the dismissal of offer boxes stay in the browser's local storage. They are never sent to us.

We do not process special categories of data (Article 9 GDPR), we do not profile you, we take no automated decisions about you and we do not pass data to third parties for their own purposes.

3. Why we process it and on which legal basis

Every processing operation has a precise legal basis. These are ours:

• Running the Site and delivering the pages you ask for: our legitimate interest in providing the service (Article 6(1)(f) GDPR).
• Security: protecting the Site from bots, intrusion attempts and abuse: our legitimate interest (Article 6(1)(f) GDPR). This is the only purpose for which we rely on legitimate interest for automatically collected data.
• Usage statistics with Google Analytics 4: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code). Analytics is not a legitimate interest: without your consent nothing starts.
• Recognising accommodation bookings that started from the Site, through the Stay22 script: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code).
• Answering your messages: the consent you give by ticking the box in the form and, when you write to us about a collaboration, the performance of pre-contractual steps (Article 6(1)(a) and 6(1)(b) GDPR).
• Meeting legal obligations and defending a legal claim (Article 6(1)(c) and 6(1)(f) GDPR).

Where the basis is consent you can change your mind whenever you want, without explaining why: the next section tells you how. Withdrawal applies to the future and does not make earlier processing unlawful.

4. Cookies and similar technologies (Cookie Policy)

Before you have chosen, the Site installs nothing that is not technical. The Google Analytics script and the Stay22 script are not even downloaded: your consent is what loads them, at the moment you give it. If you refuse, or close the banner without accepting, nothing starts.

We treat data saved in the browser's local storage as cookies too: EDPB Guidelines 2/2023, paragraph 44, bring it under Article 5(3) of the ePrivacy Directive, implemented in Italy by Article 122 of the Privacy Code, exactly like a cookie. That is why you find it in the tables below.

Always on: technical tools

They make the Site work and remember your choices. They need no consent, but we list them anyway.

Only with your consent

These are not installed unless you accept. If you accepted and change your mind, below you will find how to remove them.

How to withdraw consent

Your choice is saved in the browser's local storage under the entry funivie_cookie_consent. To decide again, clear the site data in your browser: on your next visit the banner comes back and you can refuse.

The path is almost always the same: browser settings, ‘cookies and site data’, search for funivie.it, delete the stored data. Clearing it also removes the Google Analytics cookies and the Stay22 identifiers already present.

If you would rather not think about it, you can set your browser to block third-party cookies or to clear site data when it closes.

5. External services your browser contacts

Some parts of the Site make your browser contact other parties' servers. When that happens those parties see your IP address: that is how a web request works. This is the full list.

• Open-Meteo (api.open-meteo.com): supplies weather forecasts and altitude data. Your browser calls it when you open a page showing the weather. It installs no cookies. Its servers are in Europe and North America.
• OpenStreetMap (tile.openstreetmap.org): supplies the map tiles, downloaded when a page contains a map. It installs no cookies.
• Cloudflare: the content delivery network that sits in front of the Site. All traffic passes through it before reaching us; Cloudflare filters attacks and may set the technical cookie __cf_bm.
• Email: mail addressed to funivie.it, including contact form messages, is routed by Cloudflare Email Routing to our mailbox, hosted by Google (Gmail).
• Third-party webcams: the live images are not ours. When you open a webcam the page loads, in a frame, the stream of one of the roughly 70 operators that run them, including Feratel and Panomax. The frame starts only at your request, is isolated with the sandbox attribute and does not pass on the address of the page you came from.
• When you click a commercial link: you pass through one of our redirect pages (addresses starting with /go/, excluded from search engines) and arrive at GetYourGuide, at Booking.com through Stay22, at Google Maps or at the lift company's official site. From that moment the destination site's privacy notice applies, not ours.

Typefaces are hosted on our own servers: the Site never contacts Google Fonts. It does not use Google AdSense or any other ad network, embeds no YouTube or Vimeo video and loads no social network scripts. The share buttons are plain links and install nothing.

The privacy notices of the external providers: Google , Stay22 , Cloudflare , Open-Meteo , OpenStreetMap .

6. Transfers outside the European Union

If you accept non-technical cookies, some data may leave the European Economic Area. We are telling you because Article 13(1)(f) GDPR requires it.

Google. Google Analytics data is processed by Google Ireland Limited and may be transferred to Google LLC in the United States. The transfer relies on the European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, to which Google LLC adheres, and in the alternative on the standard contractual clauses under Article 46(2)(c) GDPR.

Stay22. The script that rewrites accommodation links belongs to Stay22 Technologies Inc., a company based in Canada, a country covered by a European Commission adequacy decision for organisations subject to PIPEDA. Stay22 states that it also uses providers located in the United States and in Europe.

Cloudflare. Traffic passes through the network of Cloudflare, Inc. (United States), which adheres to the EU-US Data Privacy Framework.

You can ask us for a copy of the safeguards in place by writing to the address given in the section on your rights.

7. How long we keep the data

We keep data for as long as it is needed and no longer:

• Technical logs of the server and of the Cloudflare network: as long as security and diagnostics require, and in any case no more than 12 months.
• Google Analytics statistics: user-level and event-level data is kept according to the property setting, which cannot exceed 14 months. Aggregated reports stay longer but cannot be traced back to a person.
• Messages sent through the contact form: 24 months from the last reply, then deleted, unless they are needed to defend a legal claim.
• Preferences stored on your device: they stay until you clear the Site data in your browser, except the dismissal of offer boxes, which expires after 7 days.
• Data a law requires us to keep: for the period that law sets.

8. Your rights and how to exercise them

The GDPR gives you rights you can exercise free of charge:

• Access (Article 15): find out whether we process data about you and get a copy of it.
• Rectification (Article 16): have inaccurate data corrected or incomplete data completed.
• Erasure (Article 17): have your data deleted, in the cases the law provides for.
• Restriction (Article 18): freeze the processing while a dispute is being checked.
• Objection (Article 21): object to processing based on legitimate interest, describing your situation.
• Portability (Article 20): receive the data you gave us in a machine-readable format.
• Withdrawal of consent (Article 7(3)): at any time and as easily as you gave it, with effect for the future.

To exercise these rights write to: [email protected].

We answer within one month, extendable by two months for complex requests, as Article 12(3) GDPR provides. If we cannot identify you, and often we cannot because we collect no identifying data while you browse, we will say so and explain why (Articles 11 and 12(2) GDPR).

If you believe we are handling your data badly you can turn to the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or to the supervisory authority of the country where you live or work. You can also go to court.

9. How the Site is funded

The Site is free and shows no advertising. It is funded by affiliate commissions: if you book a ticket, a stay or a service through one of our links, the provider pays us a percentage. You pay the same price you would pay arriving from anywhere else.

Every commercial link carries the technical attributes rel="sponsored nofollow" and passes through one of our redirect addresses starting with /go/. Where the link sits inside an offer box, the box carries the affiliate notice. The active partners are GetYourGuide for lift tickets and Stay22, with Booking.com, for accommodation. Links to the lift companies' official sites are not paid.

A commercial agreement does not change the technical data, the prices and the information we publish about a resort: those come from the sources listed below.

10. Where the published data comes from

The information you read on the Site comes from open, verifiable sources:

• OpenStreetMap, for the position, the line and the technical data of the lifts. The data belongs to OpenStreetMap and its contributors and is distributed under the Open Database License (ODbL).
• Wikimedia Commons, for the photographs. Every photo keeps author, licence and a link to the original file on the credits page.
• Open-Meteo, for weather forecasts and altitude data.
• Open Data Hub South Tyrol, for the list and the addresses of the webcams.
• Official sites of lift companies and resort consortia, for ski pass prices, opening dates and timetables. They are transcribed by hand and carry the date they were checked.

If you find something wrong, tell us: we correct it or take it down.

11. Changes to this notice

We may update this notice when something changes on the Site or in the tools it uses. The date at the top of the page shows the last change. If the change concerns tools that need consent, we ask you again.