Personal data processing notice
Privacy Policy
This notice explains clearly how personal data is processed when people use FavignanaTips, contact the editorial team, create an account, manage a business or use the portal’s digital services.
Optional measurement features and external content follow the choices made in the Privacy preferences panel.
Last updated:
Privacy Policy contents
1.Data controller
The data controller is Elimi S.r.l.s., registered office at Via Giacinto Bruzzesi 30, 91025 Marsala (TP), Italy. Tax code and VAT number: 02785970811.
Privacy contact: info@favignanatips.it. Certified email (PEC): elimisrls@pec.it. The Controller has not appointed a Data Protection Officer (DPO).
2.Scope of this notice
This notice covers www.favignanatips.it and its public and restricted features. Third-party websites and services reached through external links apply their own privacy notices.
3.Categories of data processed
- technical and browsing data needed to deliver, protect and maintain the site;
- language, consent and interface preferences stored in the browser;
- first name, surname, email, optional telephone number, reason, subject and text submitted through the contact form;
- account data, authentication sessions and access-recovery operations;
- business and advertiser data, listing content, published contact details and images;
- identity and tax information required for billing, together with payment and subscription status;
- messages voluntarily sent to the EGUSA assistant;
- aggregated statistical data about business-listing usage;
- data about administrative operations recorded for security and control.
4.Processing methods and security
Data is processed using digital tools and technical and organisational measures appropriate to the stated purposes. Restricted areas are protected by authentication and authorisation controls. Relevant administrative activity is logged without including passwords, tokens and other data excluded from the register.
No Internet-connected system can guarantee absolute security; the site nevertheless applies measures intended to prevent unauthorised access, abuse, loss or alteration of data.
5.Purposes and legal bases
| Purpose | Main data | Legal basis | Provision |
|---|---|---|---|
| Responding to enquiries | Identity, contact details and request content | Steps taken at the data subject’s request prior to entering into a contract and handling the request | Required to receive a response |
| Accounts and authentication | Email, credentials and session data | Performance of the requested service or contractual relationship | Required to use the restricted area |
| Businesses and advertisers | Listing, representative and commercial relationship data | Performance of the contract and management of the commercial relationship | Required for business services |
| Service emails | Email, account data and operation details | Performance of the contract or requested service | Required for operational communications |
| Payments and billing | Identity, tax, payment and subscription data | Performance of the contract and compliance with legal obligations | Required to purchase a plan |
| EGUSA assistant | User messages and technical request data | Delivery of the service requested by the user | Optional; messages are needed to generate a reply |
| Aggregated first-party statistics | Viewed business, event type and date/time | Controller’s legitimate interest in understanding listing usage | Automatic and without visitor identifiers |
| Google Analytics 4 | Usage and technical data collected after activation | Consent to the Analytics category | Optional |
| Security | Relevant technical data, sessions, events and logs | Controller’s legitimate interest | Required to protect the site and its users |
| Technical operation | Data strictly necessary for the requested feature | Technical necessity to deliver the service and legitimate interest, where applicable | Required for the feature used |
6.Contact form
The form records the submitted data, language, and the date and time when the privacy notice was accepted. The message is stored in the site’s system and forwarded by email to info@favignanatips.it. Submission frequency is temporarily limited to counter abuse.
7.Accounts and authentication
The authentication system manages registration, sign-in, sessions, account confirmation and password recovery. The browser stores the technical information needed to maintain the session. The administration area also uses an HttpOnly session cookie lasting 8 hours.
8.Businesses and advertisers
Owners or representatives may create, claim and manage listings, images, contact details and content. Commercial services may involve a person’s name or company name, tax code, VAT number, recipient code, certified email, billing email and address.
9.Advertisers and advertising campaigns
Anyone purchasing advertising space through the Advertiser Area provides advertiser profile data: company name, contact person, email, telephone, VAT number and any notes. For each campaign, Italian and English texts, images, destination links, advertising space, duration, selected options, status, publication dates, payment data and the review outcome (approval or rejection, with any staff message) are processed. Processing is based on performance of the contract and legal obligations.
Only the advertisement content intended for publication (texts, images and links) is published on the site; account and billing data are never published. Communications to the advertiser are service emails about the campaign status (payment received, review, approval or rejection), sent to the account email; no newsletters or marketing communications are sent.
Advertisement statistics derive solely from anonymous event records indicating the campaign, the advertising space, the event type (view or click) and the day, and are used only to obtain aggregated totals per campaign and day; no IP addresses, cookies, identifiers or other visitor data are recorded, and no external services or profiling techniques are used. When an advertiser account is deleted, campaigns are deleted, while payments, billing data and the administrative register are retained to meet legal obligations and protect rights.
10.Payments and billing
Payments for plans (subscriptions) and for advertising services (one-time payments) are managed through Stripe. FavignanaTips retains the information needed to link a payment to a business or to an advertising campaign, including amount, currency, status, external identifier and payment date. Full card details do not pass through FavignanaTips application systems.
11.Service emails
The site sends only operational emails connected with accounts, security, requests, plans and completed actions. Emails are delivered through the email service managed by the provider of the platform’s application infrastructure.
12.EGUSA assistant
Messages sent to EGUSA are transmitted to the site’s servers and, through the connected technical service that routes artificial intelligence requests, to a Google Gemini model that generates the response. The application does not store the conversation in its database.
The conversation remains in the browser session and expires after 6 hours of inactivity. The IP address is used temporarily in memory to limit abuse and is not recorded by the application for this purpose.
13.First-party statistics and Google Analytics
First-party statistics record only the business viewed, event type, and date/time. They do not use cookies or record IP addresses, names, emails, user agents or visitor identifiers.
Google Analytics 4 is loaded only after consent to the Analytics category. Without a choice, after Reject all, or with Analytics disabled, the service remains inactive. Withdrawal blocks subsequent transmissions and removes Analytics cookies from the site.
14.External maps and videos
OpenStreetMap maps and YouTube or Vimeo videos are loaded in the browser only after External content has been enabled. Before activation, local placeholders are shown and no request is sent to those providers.
When content is activated, the browser may communicate the IP address, requested URL and technical data to the provider and may receive the provider’s cookies or other technologies.
15.Weather, Smart Cala and geocoding
Weather and marine information comes from Open-Meteo through the site’s servers. Smart Cala combines that data with place classifications and does not use personal data to produce its guidance.
Address search in the restricted area uses OpenStreetMap Nominatim and, as an alternative, the Photon endpoint operated by komoot. Requests are made through the site’s servers.
16.Recipients and providers
Data may be processed by authorised personnel and technical providers only to the extent needed to deliver the services. Providers actually involved, depending on the feature used, include:
- the provider of the application infrastructure and of the technical services required to operate the platform, for hosting, application functions, email delivery and routing of requests to artificial intelligence services;
- Supabase for database, authentication and storage;
- Stripe for payments, subscriptions and fraud prevention;
- Google Analytics for optional statistics;
- Google Gemini, reached through the connected technical service, to generate EGUSA responses;
- Open-Meteo for weather and marine data;
- OpenStreetMap Foundation for maps and Nominatim;
- komoot for the Photon endpoint used as a geocoding alternative;
- Google/YouTube and Vimeo for embedded videos activated by the user.
17.Provider roles
Each provider’s role depends on the service, settings and applicable relationship. OpenStreetMap Foundation states that it operates as an independent controller for the services it manages. Stripe states that it may act as a processor or as an independent controller depending on the activity. For other services, the roles set by their applicable terms and configurations apply.
18.International transfers
Some providers may process personal data outside the European Economic Area. In such cases, transfers are made under the mechanisms provided by applicable law and relevant to the relationship and service used, such as adequacy decisions or appropriate contractual safeguards.
Current information on processing locations and transfer mechanisms is available in the privacy notices and documents of the relevant providers.
19.Data retention
| Category | Period or criterion |
|---|---|
| Enquiries | Until the request is handled and afterwards for the period needed for administrative requirements or the protection of rights |
| Accounts | Until account deletion, except for data that must be retained to comply with legal obligations |
| Businesses and advertisers | For the duration of the relationship and afterwards for the period needed to comply with legal obligations or protect rights |
| Billing and payments | For the periods required by applicable tax and civil law |
| Service emails | For the time needed to manage the relationship and communications |
| EGUSA conversation in the browser | For the browser session and, in any event, 6 hours after the last activity |
| EGUSA conversation in the application | Not retained in the application database |
| Technical and security logs | For the time needed for security and the prevention and management of incidents or abuse |
| Administrative register | For the time needed for security, service management and the protection of rights |
| First-party statistics | For the period needed for aggregated statistical purposes |
| Preferences and cookies | According to the periods stated in the Cookie Policy |
20.Provision of data
Data requested for accounts, contacts, business management, payments and operational features is required to provide the selected service. Failure to provide it prevents completion of the relevant operation. Google Analytics and external content are optional and remain inactive until accepted.
21.Data subject rights
Where Articles 15-22 GDPR apply, data subjects may request access, rectification, erasure, restriction of processing, portability and objection. Consent may also be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
22.How to exercise your rights
Requests may be sent to info@favignanatips.it or by certified email (PEC) to elimisrls@pec.it. To protect the data subject, the Controller may request information needed to verify identity and identify the data concerned.
23.Complaint to a supervisory authority
Data subjects have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali, following the instructions at www.garanteprivacy.it, or with the competent supervisory authority where they live or work or where they believe an infringement occurred.
24.Profiling and automated decision-making
FavignanaTips does not perform individual profiling, assign personal scores, personalise the service based on individual behaviour, or make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
Smart Cala uses weather data and place classifications, not personal data, to produce its guidance.
26.Updates to this notice
This notice may be updated to reflect legal, contractual or technical changes. The date shown at the beginning of the page identifies the published version.
