Cookie Policy
Version 1.0 — In force as of 26/04/2026
PREAMBLE
This Cookie Policy (hereinafter the "Cookie Policy" or the "Notice") describes the types of cookies and other tracking tools used by Horizon Servizi Integrati S.r.l.s. (hereinafter "Stravagando" or the "Platform"), controller of the Stravagando digital platform accessible at the main address stravagando.com and related subdomains, on the mobile app for iOS and Android (hereinafter the "App"), as well as on the transactional and marketing email channels that use similar technologies (hereinafter, collectively, the "Tracking Tools").
The use of Tracking Tools by Stravagando takes place in compliance with:
(a) Regulation (EU) 2016/679 of the European Parliament and of the Council, on the protection of natural persons with regard to the processing of personal data (hereinafter "GDPR");
(b) Italian Legislative Decree No. 196 of 30 June 2003 ("Privacy Code"), as amended by Italian Legislative Decree No. 101 of 10 August 2018;
(c) Directive 2002/58/EC of the European Parliament and of the Council (ePrivacy Directive), as amended by Directive 2009/136/EC;
(d) the Guidelines of the Italian Data Protection Authority (Garante), and in particular the Decision of 10 June 2021 "Guidelines on cookies and other tracking tools" (Reg. decision No. 231/2021);
(e) the Guidelines 03/2022 of the European Data Protection Board (EDPB) on dark patterns, and the opinions of the European Data Protection Board.
This Cookie Policy supplements — and does not replace — the general Privacy Notice of the Platform, to which reference is made for all information relating to the processing of personal data carried out by Stravagando that falls outside the use of Tracking Tools. This Notice is further coordinated with the General Terms of Use (GTU), the General Terms of Sale, the Host Terms, the Referral Program Terms and the Technical Specifications of the Service of the Platform.
In the event of a conflict between this Cookie Policy and other specific notices provided to the data subject for individual processing activities, the provisions of the most recent specific notice for the relevant specific processing shall prevail; the provisions of this Notice shall remain in force for all matters not specifically governed.
ART. 1 — DEFINITIONS
For the purposes of this Cookie Policy, the following terms have the meaning indicated below.
1.1 "Cookies": small text files that the websites visited by the User or the applications used send and store on the User's device (computer, tablet, smartphone, smart-TV or other connected device), to then be retransmitted to the same sites or applications on the subsequent visit. Cookies are used to perform IT authentications, session monitoring, storage of information on User preferences, tracking of browsing behaviours, profiling and other purposes described in this Notice.
1.2 "Tracking Tools": any technology — other than or in addition to Cookies — that allows the User to be tracked, information stored on the User's device to be accessed, or information to be stored on that device, including by way of example: unique identifiers, web beacons, pixel tags, clear GIFs, embedded scripts, e-tags, device fingerprinting, Software Development Kits (SDKs) integrated into Apps, browser Local Storage and Session Storage, IndexedDB, Cache API, mobile advertising identifiers (Google Advertiser ID for Android devices, Identifier for Advertisers — IDFA — for iOS devices), email tracking pixels.
1.3 "First-Party Cookies": Cookies and Tracking Tools installed and managed directly by Stravagando for purposes connected with the operation of the Platform and the services offered.
1.4 "Third-Party Cookies": Cookies and Tracking Tools installed and managed by parties other than Stravagando (hereinafter the "Third Parties"), which act as independent controllers or as processors pursuant to Art. 28 GDPR, depending on the specific contractual relationship and the purposes pursued.
1.5 "Session Cookies": temporary Cookies that are stored only for the duration of the browsing session and automatically deleted when the browser is closed.
1.6 "Persistent Cookies": Cookies that are stored on the User's device for a predetermined period (expressed in days, months or years) and retransmitted on the subsequent visit, until expiry is reached or the User manually deletes them.
1.7 "Technical Tracking Tools": Cookies and Tracking Tools whose installation does not require the User's prior consent in that they are strictly necessary to provide a service explicitly requested by the User or to enable the transmission of a communication over an electronic network (so-called strictly necessary cookies), as well as Cookies of a technical nature used exclusively to obtain aggregate statistical information, where the requirements set out in paragraph 4.2 of the Garante's Decision of 10 June 2021 are met (anonymisation, no cross-referencing with other sources, documented opt-out of the third-party provider).
1.8 "Functional Tracking Tools": Cookies and Tracking Tools used to remember the User's choices and preferences in order to improve the browsing experience and provide advanced functionalities that are not strictly indispensable. Prior consent is required for Functional Tracking Tools, unless they qualify as Technical Tracking Tools pursuant to the preceding point.
1.9 "Analytical Tracking Tools": Cookies and Tracking Tools used to collect information in aggregate or disaggregated form on the number of visitors and on the ways in which the Platform is used, in order to analyse usage statistics, measure performance and improve services.
1.10 "Marketing and Profiling Tracking Tools": Cookies and Tracking Tools used to link the User's actions to interest profiles, for promotional, advertising, retargeting and commercial content personalisation purposes.
1.11 "Attribution Cookies": a subset of the Marketing Tracking Tools used to track the origin of incoming traffic to the Platform and the attribution of conversions to specific campaigns, including the attribution of the Qualifying Actions of Stravagando's Referral Program to the relevant Referrers according to the last-click attribution model over a 90-day window.
1.12 "Preferences Panel" or "Cookie Manager": the technical interface made available by Stravagando on the Platform — accessible via the first-visit banner and via the permanent "Your cookie choices" or "Cookie and marketing preferences" link present in the footer and in other accessible locations — through which the User may grant, modify or withdraw their consent to the installation of non-technical Tracking Tools, in a granular manner by category.
1.13 "User": the person to whom this Cookie Policy refers, who accesses and/or uses the Platform in one or more of the following capacities, also cumulatively in the same period, pursuant to Section 3-bis of the GTU: (a) Unregistered Visitor; (b) Social User (natural person registered for the non-transactional functionalities — Profile, Social/Community, Gamification, exploration of the catalogue of Places, publication of UGC — which constitutes the basic regime applicable to each registered User); (c) Customer or Guest (User who, in addition to the capacity of Social User, searches, books or enjoys the paid Experiences offered through the integrated marketplace, pursuant to the General Terms of Sale); (d) Host (User, natural person or legal entity, who publishes and offers paid Experiences on the integrated marketplace, pursuant to the Host Terms); (e) Referrer (User who joins the Referral Program by promoting the Platform and receiving the related benefits, pursuant to the Referral Program Terms). Assuming a special capacity does not entail the loss of the basic capacity of Social User.
1.14 "Data Subject": the identified or identifiable natural person to whom the personal data processed pursuant to Art. 4, paragraph 1, no. 1) GDPR refer.
1.15 "Usage Data": the personal data collected automatically by the Platform or by the Tracking Tools and the third-party services used, including — by way of example — the IP addresses or domain names of the devices used by Users, the URI/URL addresses of the requested resources, the time of the requests, the method used to submit the requests to the server, the size of the file received in response, the numerical code indicating the status of the response, the country of origin, the characteristics of the browser and operating system used, the various time-related details of the visit (for example the time spent on each page), the details of the path followed and other parameters relating to the User's operating system or IT environment.
1.16 "Garante": the Italian Data Protection Authority, the Italian supervisory authority pursuant to the GDPR, with offices in Rome, Piazza Venezia No. 11.
ART. 2 — DATA CONTROLLER AND ROLES
2.A — Data Controller
2.1 Controller. The controller of the personal data collected through First-Party Tracking Tools is Horizon Servizi Integrati S.r.l.s., with registered office at Viale Giovanni Bovio, 103/1 65124 Pescara (PE), Italy, tax code and VAT number 02445190685, reachable at the following contacts: Email: support@stravagando.com; certified email — PEC (for formal communications): horizonserviziintegrati@pec.it.
2.2 Data Protection Officer (DPO). Where appointed, the Data Protection Officer is reachable at the address support@stravagando.com (subject: "DPO"). The appointment of the DPO is published, where applicable, in the general Privacy Notice of the Platform. Horizon Servizi Integrati S.r.l.s. reserves the right to establish in the future a dedicated email address (by way of example: support@stravagando.com), which will be communicated to data subjects by means of an update of this Notice.
2.B — Role of Stravagando and of the Third Parties
2.3 First-Party Cookies. For First-Party Tracking Tools, Stravagando acts as independent controller of the processing.
2.4 Third-Party Cookies. For Third-Party Tracking Tools, each Third Party acts, as the case may be:
(a) as independent controller of the processing, where the Third Party independently determines the purposes and means of the processing (typical case for providers of advertising and retargeting services, single sign-on identity providers, payment processors benefiting from their own regulatory framework);
(b) as processor pursuant to Art. 28 GDPR, where the Third Party processes the data on documented instructions from Stravagando (typical case for cloud hosting providers, analytics configured in anonymised mode and customer support services);
(c) as joint controller pursuant to Art. 26 GDPR, for specific processing activities in which Stravagando and the Third Party jointly determine purposes and means (typical case: use of the Meta Business Tools such as Meta Pixel and Custom Audiences in joint controllership with Meta Platforms Ireland Limited; see Art. 5.8).
The detailed list of the Third Parties used by Stravagando, with indication of the relevant role, purpose, legal basis and privacy policy, is set out in Art. 5 of this Notice and updated periodically within the Preferences Panel.
ART. 3 — CATEGORIES OF TRACKING TOOLS USED
Stravagando uses the Tracking Tools classified into the four categories described below, in line with the classification of the Garante's Decision of 10 June 2021 and with the Cookie consent framework of the European Data Protection Board.
3.A — Technical Tracking Tools
3.1 Definition. These are the Tracking Tools whose installation does not require the User's prior consent in that they are strictly necessary to provide a service explicitly requested by the User, to enable the transmission of a communication, to ensure the security of the Platform or to comply with regulatory obligations.
3.2 Purposes.
(a) Operation of the website and the App: management of browsing sessions, recognition of the User within the same session, maintenance of the authentication state (login), persistence of the booking cart, management of the checkout;
(b) Security and fraud prevention: identification of intrusion attempts, brute force, credential stuffing, automated bots, device fingerprinting for anti-fraud purposes integrated with the systems of Stripe Connect;
(c) Storage of the accessibility settings chosen by the User (font size, contrast, interface language), where configurable without profiling;
(d) Load balancing and optimisation of server performance;
(e) Storage of the User's choices regarding consent to Cookies (so-called consent log), to fulfil the obligation to document the giving of consent pursuant to Art. 7 GDPR and the Garante's Decision of 10 June 2021;
(f) Performance of regulatory obligations, including the retention of transaction logs for tax and anti-money-laundering purposes (Italian Legislative Decree 231/2007) and of the DAC7 audit logs (Italian Legislative Decree 32/2023).
3.3 Legal basis. The use of Technical Tracking Tools is based on Art. 122, paragraph 1, first sentence of the Italian Privacy Code, on Art. 6, paragraph 1, letter b) GDPR (performance of a contract to which the data subject is party or performance of pre-contractual measures at the data subject's request), on Art. 6, paragraph 1, letter c) GDPR (compliance with legal obligations) and on Art. 6, paragraph 1, letter f) GDPR (legitimate interest of the Controller in the security, fraud prevention and functionality of the Platform), depending on the specific purpose.
3.4 Consent. Prior consent of the User is not required for Technical Tracking Tools. Disabling such Tools through the browser settings may result in the total or partial impossibility of using the Platform and enjoying the services.
3.B — Functional Tracking Tools
3.5 Definition. These are the Tracking Tools used to remember the User's choices and preferences in order to improve the browsing experience and provide advanced functionalities that are not strictly indispensable.
3.6 Purposes.
(a) storage of the selected language for the interface (where different from the browser language);
(b) storage of the selected currency for the display of prices;
(c) storage of the destination city or of selected search filters in order to populate subsequent visits consistently;
(d) storage of Notebooks and Experiences marked as favourites for unauthenticated Users;
(e) single sign-on via Google or Facebook account, where the User chooses such authentication method.
The preferences referred to in letters (a)-(d) are as a rule stored by means of First-Party technical localStorage on the User's device, and do not entail the use of Third-Party Cookies.
3.7 Legal basis. The use of Functional Tracking Tools is based on Art. 6, paragraph 1, letter a) GDPR — prior consent of the User expressed freely, specifically, in an informed and unambiguous manner through the Preferences Panel.
3.C — Analytical Tracking Tools
3.8 Definition. These are the Tracking Tools used to collect information on the number of visitors and on the ways in which the Platform is used.
3.9 Distinction between aggregate and disaggregated analytics.
(a) Aggregate analytics treated as technical are Tracking Tools used exclusively to obtain aggregate statistical information, where the conditions set out in paragraph 4.2 of the Garante's Decision of 10 June 2021 are cumulatively met: (i) anonymisation of the IP address by masking at least the fourth portion (e.g. 192.168.1.XXX); (ii) absence of cross-referencing of the data with other First- or Third-Party sources; (iii) absence of transfer to Third Parties for the provider's own purposes; (iv) configuration of the provider in a manner that does not allow reconciliation with other identities (e.g. disabling of signal sharing with advertising services of the same provider). For such analytics prior consent is not required, but the Notice remains published in any event.
(b) Disaggregated analytics or analytics not treated as technical are Tracking Tools that do not fully comply with the conditions of the preceding point (a) (e.g. individual cross-page path tracking, session replay, identifying heatmaps, personalised funnel analysis). For such analytics prior consent is required.
3.10 Purposes. Measurement of traffic and of the Platform's performance; analysis of browsing behaviour on pages, sections and functionalities; identification of errors and technical issues; optimisation of the conversion funnel; A/B testing of interfaces; production of statistical reports for internal use.
3.11 Legal basis.
(a) For aggregate analytics treated as technical: Art. 122, paragraph 1 of the Italian Privacy Code and Art. 6, paragraph 1, letter f) GDPR (legitimate interest of the Controller in improving the Platform).
(b) For disaggregated analytics: Art. 6, paragraph 1, letter a) GDPR — prior consent of the User.
3.D — Marketing and Profiling Tracking Tools
3.12 Definition. These are the Tracking Tools used for profiling, targeted advertising and personalisation of the commercial content offered to the User on the Platform and on third-party sites, apps and social networks.
3.13 Purposes.
(a) Profiling of the User's browsing behaviours in order to offer commercial content consistent with their interests (e.g. categories of Experiences viewed, destination cities, price ranges);
(b) Remarketing and retargeting towards Users who have visited the Platform without completing a booking, by means of advertising campaigns on Meta's platforms;
(c) Lookalike audiences: creation of audiences similar to those of Stravagando's Users in order to extend the reach of advertising campaigns, by sending hashed or pseudonymised identifiers to Third Parties;
(d) Measurement of conversions generated by advertising campaigns (conversion tracking) and attribution of incoming traffic;
(e) Referral Program Attribution Cookies: tracking of the origin of the traffic generated by Referrers through Referral Links and attribution of the Qualifying Actions over a 90-day moving window according to the last-click attribution model, for the purposes described in the Referral Program Terms;
(f) Personalisation of transactional and marketing emails (newsletter, Experience suggestions, post-booking communications) by means of tracking pixels and unique identifiers, where the User has given consent to receive marketing communications.
3.14 Legal basis. The use of Marketing and Profiling Tracking Tools is based on Art. 6, paragraph 1, letter a) GDPR — prior consent of the User expressed freely, specifically, in an informed and unambiguous manner through the Preferences Panel, in a granular manner by category and — where required — by individual Third Party.
3.15 Automated profiling. Except as specifically indicated for individual Third Parties, the use of Marketing and Profiling Tracking Tools does not entail solely automated decision-making that produces legal effects on the User or significantly affects them pursuant to Art. 22 GDPR. Any significant decisions — such as the suspension of the account or the outcome of anti-fraud checks — are subject to human review under the terms described in the applicable GTU, Host Terms and Referral Program Terms, and are governed in detail by the general Privacy Notice (Art. 11 — Automated decision-making and profiling).
ART. 4 — GIVING, MODIFYING AND WITHDRAWING CONSENT
4.A — First-visit banner
4.1 Characteristics of the banner. When the Platform is accessed by a User who has not yet expressed their preferences, or pursuant to paragraph 4.4, a short-notice banner ("Cookie Banner") is displayed, which sets out:
(a) the indication of the presence of Tracking Tools and of their purposes;
(b) the reference to this Cookie Policy;
(c) the three choice commands, equivalent in size, position, background colour and contrast: "Accept all", "Necessary only" and "Customise".
In accordance with the Garante's Decision of 10 June 2021 and the EDPB Guidelines 03/2022 on dark patterns, the "Necessary only" command — equivalent to the rejection of all non-technical Tracking Tools — has equal prominence and immediacy compared with the "Accept all" command. Closing the banner by means of the "X" close button alone does not constitute the giving of consent: in such case only Technical Tracking Tools will be used and the banner will be displayed again on subsequent visits under the terms of paragraph 4.4.
4.2 Granularity. By clicking "Customise", the User accesses the Preferences Panel and may give consent in a granular manner for each of the categories referred to in Art. 3, and possibly by individual Third Party where the Platform offers such level of granularity.
4.B — Preferences Panel
4.3 Permanent access. The Preferences Panel is accessible at any time by means of:
(a) the "Your cookie choices" or "Cookie and marketing preferences" link present in the footer of all pages of the Platform;
(b) the "Privacy" section of the registered User's Panel;
(c) the settings of the mobile App;
(d) a direct link included in every marketing email;
(e) a direct request to Customer Service by email to support@stravagando.com.
The choices made by the User are stored in a server-side consent log retained by Stravagando for 10 years for evidentiary and accountability purposes pursuant to Art. 5, paragraph 2 GDPR. This server-side log is distinct from the local consent record stored on the User's device — described in Art. 5.4 below — which has a duration of only 6 months and serves exclusively to determine the need to display the banner again pursuant to paragraph 4.4.
4.C — Re-display of the banner and duration of the choice
4.4 Re-display. The banner is displayed again to the User:
(a) after six months have elapsed since the last expression of preferences, unless the User has expressly accepted all Tracking Tools and the purposes have not subsequently been modified;
(b) on the occasion of significant changes to the processing purposes, to the list of Third Parties or to the categories of Tracking Tools used;
(c) where the User accesses from a different device or browser or deletes the local consent record;
(d) upon the natural expiry of the local consent record.
4.D — Withdrawal
4.5 Withdrawal as simple as the giving. The User may withdraw the consent given at any time, easily and with the same ease with which it was given, through the Preferences Panel. Withdrawal does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.
4.6 Effects of withdrawal. Following withdrawal, the Tracking Tools for which consent has been withdrawn will no longer be used for new processing operations. Any data already collected remains subject to processing until the purposes for which it was lawfully collected are achieved, in accordance with the retention periods referred to in Art. 7 below. The User may request the erasure of the previously collected data by exercising the GDPR rights pursuant to Art. 8 of this Notice.
4.E — Cross-device and cross-platform
4.7 Synchronisation of preferences. The preferences expressed by the registered User are — where technically possible and where the User logs into their account — synchronised across all devices and all platforms (website, iOS App, Android App, email) on which they use Stravagando's services, by associating the preferences with their unique account identifier.
4.8 Unregistered Users. For unregistered Users, preferences are stored locally on the specific device/browser used and are not synchronised across different devices. A User accessing from a different device will be presented with the first-visit banner.
ART. 5 — LIST OF TRACKING TOOLS AND THIRD PARTIES
5.A — Disclaimer and link to the Panel
5.1 Dynamically updated list. The detailed and updated list of the Tracking Tools used, including name, purpose, legal basis, duration, third-party provider, country of processing, link to the third-party provider's privacy policy and opt-out mechanism, is available and updated in real time within the Preferences Panel. Further technical details on the operational configuration of the individual Tools — such as anonymisation parameters, sampling thresholds, provider-specific retention — are published in the Technical Specifications of the Service, updated periodically. This Art. 5 provides a descriptive overview by category of the Third Parties used as at the last revision of this Notice, without claiming to be exhaustive in comparison with the version of the Preferences Panel, which prevails.
5.B — Technical Tracking Tools (First Party)
5.2 Session and authentication functionalities.
Session Cookies managed by Stravagando's application infrastructure for authentication and persistence of the browsing session.
Duration: session (deleted when the browser is closed) or persistent for up to 30 days in "Stay connected" mode.
Legal basis: Art. 6, paragraph 1, letter b) GDPR.
5.3 Anti-fraud and security functionalities.
Cookies and fingerprinting for device identification, velocity check and risk analysis during booking and payment, integrated with Stripe's anti-fraud systems.
Duration: variable, from session to 24 months for pseudonymised risk identifiers.
Legal basis: Art. 6, paragraph 1, letter f) GDPR (legitimate interest in fraud prevention).
5.4 Local storage of preferences (consent log).
The choices made by the User regarding Tracking Tools are stored locally on the User's device by means of browser localStorage (key lolliexp_consents) — a technology which, although not technically a Cookie, performs an analogous function of persisting the preference —, in order to determine the need to display the banner again pursuant to Art. 4.4. For authenticated Users, the preference is additionally synchronised server-side (see Art. 4.3 and 4.5).
Duration / re-display: the choice is considered valid for 6 months, after which the banner is automatically displayed again for renewal of the preference. (This local storage is distinct from the server-side consent log referred to in Art. 4.3, retained for 10 years for evidentiary purposes.)
Legal basis: Art. 6, paragraph 1, letters c) and f) GDPR (compliance with legal obligations pursuant to Art. 7, paragraph 1 GDPR and the Garante's Decision of 10 June 2021).
5.C — Payments and anti-fraud (Stripe)
5.5 Stripe Payments Europe Ltd.
Service: payment processing, escrow, Connect and anti-fraud (Radar).
Tracking Tools: First- and Third-Party technical Cookies, device fingerprinting, unique payment-session identifiers.
Category: Technical Tracking Tools (essential for payment execution and fraud prevention).
Place of processing: Ireland (registered office of the European controller) and the United States (parent company Stripe Inc.). For transfers outside the EEA, Stripe has adopted the Standard Contractual Clauses approved by the EU Commission pursuant to Art. 46, paragraph 2, letter c) GDPR.
Privacy policy: https://stripe.com/privacy
Legal basis: Art. 6, paragraph 1, letter b) GDPR.
5.5-bis Cloudflare Turnstile (anti-bot CAPTCHA).
Anti-bot verification service of the CAPTCHA type, provided by Cloudflare, Inc., used to prevent automated access and abuse in the Platform's forms (registration, login, form submission).
Tracking Tools and data processed: IP address, user-agent and verification token; Cloudflare Turnstile is designed to operate without advertising tracking Cookies.
Category: Technical Tracking Tools (essential for the security of the Platform).
Place of processing: Cloudflare's edge network; for transfers outside the EEA, the Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework apply.
Privacy policy: https://www.cloudflare.com/privacypolicy/
Legal basis: Art. 6, paragraph 1, letter f) GDPR (legitimate interest in security and abuse prevention).
5.D — Analytical Tracking Tools (with consent)
5.6 Google Analytics 4 and Firebase Analytics.
Google Analytics 4 (web) and Firebase Analytics (mobile App), provided by Google Ireland Limited and Google LLC, configured with anonymisation of the IP address and disabling of signal sharing for advertising purposes.
Purpose: measurement and analysis of the use of the Platform (web and App), conversion rates, disaggregated browsing behaviour.
Place of processing: Ireland; United States (with SCC and the EU-US Data Privacy Framework, where the certification is maintained by the provider).
Privacy policy: https://policies.google.com/privacy
Category: Analytical Tracking Tools. On the web, Google Analytics 4 is loaded via Google Tag Manager with Consent Mode v2 in default-deny mode: the tags are activated exclusively after the User's consent for the analytics category has been obtained. On the mobile App, Firebase Analytics is subject to the same consent.
Legal basis: Art. 6, paragraph 1, letter a) GDPR — consent.
5.E — Single Sign-On (Functional)
5.7 Single sign-on (SSO).
Sign in with Google (Google Ireland Limited) and Login with Facebook (Meta Platforms Ireland Limited), offered as alternative authentication options.
Category: Functional Tracking Tools; the authentication flow is activated by the User who chooses such access method.
Privacy policy: https://policies.google.com/privacy ; https://www.facebook.com/policy.php
5.F — Marketing and Profiling Tracking Tools
5.8 Meta Pixel, Meta Conversions API and Meta Business Tools (joint controllership).
Meta Pixel (web), Meta Conversions API (server-side), Meta App Events SDK (mobile App), Meta Custom Audiences and Meta Lookalike, provided by Meta Platforms Ireland Limited.
Purpose: measurement of conversions, retargeting and creation of custom audiences for Stravagando's advertising campaigns on web and App.
Place of processing: Ireland; United States (with SCC and the EU-US Data Privacy Framework, where applicable).
Privacy policy: https://www.facebook.com/policy.php
Legal basis: Art. 6, paragraph 1, letter a) GDPR — consent. On the web, the Meta Pixel is loaded via Google Tag Manager with Consent Mode v2 in default-deny mode and is activated exclusively after consent for the marketing category; the Meta Conversions API transmits the data server-side subject to the same consent. On the mobile App, the Meta App Events SDK is subject to the marketing consent and, on iOS, to the App Tracking Transparency authorisation (see par. 5.10).
Role: for the Meta Business Tools listed above, Horizon Servizi Integrati S.r.l.s. and Meta Platforms Ireland Limited act as joint controllers pursuant to Art. 26 GDPR, for the operations of collection and initial transmission of the data. The summary content of the joint-controllership arrangement is published by Meta at https://www.facebook.com/legal/controller_addendum and a copy of it may be provided at the data subject's request at the address support@stravagando.com. For subsequent processing carried out independently by Meta on its own platforms, Meta acts as independent controller.
5.9 Referral Program Attribution Cookie.
Stravagando First-Party Cookie.
Purpose: to track the origin of new Users who register through the Referral Link of a Referrer participating in Stravagando's Referral Program, according to the last-click attribution model over a 90-day moving window.
Duration: 90 days (extendable by reinstallation on the next qualifying click).
Category: Marketing Tracking Tools (consent required). In the absence of consent, attribution may take place exclusively through the direct entry of the Referral Code by the Referred User at the time of registration, as provided for by the Referral Program Terms.
5.G — Mobile App SDKs and identifiers
5.10 App Tracking Transparency and IDFA (iOS).
On iOS, any access to the Identifier for Advertisers (IDFA) and the use of marketing SDKs (Meta App Events SDK) are subject to the User's explicit authorisation by means of Apple's App Tracking Transparency (ATT) prompt, in addition to the consent expressed in the Platform's preference management system.
On Android, advertising identifiers (Google Advertiser ID) are used exclusively after consent for the marketing category.
Category: Marketing Tracking Tools (consent required).
5.11 Firebase Analytics (mobile App).
Firebase Analytics, provided by Google, is described in par. 5.6 as an analytical tool subject to consent for the analytics category.
5.12 Sentry (error monitoring).
Sentry (Functional Software, Inc. / Sentry, EU — Germany) is used as an SDK for monitoring the stability and errors of the App and the Platform. It does not use Cookies for advertising tracking purposes and collects a pseudonymous identifier and technical breadcrumbs for diagnostic purposes; it is mentioned here for the sake of informational completeness.
Category: technical/security tool.
5.H — Email marketing
5.13 Email tracking pixels.
The transactional and marketing emails sent by Stravagando contain open-tracking pixels and link tracking for the measurement of open rates, click-through and conversion, managed through the provider Mailgun (Sinch / Mailgun Technologies, Inc.).
Place of processing: United States (with SCC and the EU-US Data Privacy Framework, where applicable).
Category: for transactional emails, legal basis Art. 6, paragraph 1, letter b) GDPR (performance of the contract). For marketing emails, legal basis Art. 6, paragraph 1, letter a) GDPR — consent, revocable at any time by means of the opt-out link present in every email.
ART. 6 — TRANSFERS OUTSIDE THE EEA
6.1 Principle. Some of the Tracking Tools used involve the transfer of personal data outside the European Economic Area (EEA), in particular to the United States of America, the United Kingdom and other third countries.
6.2 Guarantees adopted. For transfers outside the EEA, Stravagando relies on the following safeguard instruments pursuant to Chapter V GDPR:
(a) Adequacy decisions of the EU Commission pursuant to Art. 45 GDPR, where applicable (e.g. United Kingdom, Switzerland, Israel, Canada in part, Andorra, Argentina, Japan, New Zealand, Republic of Korea, Uruguay);
(b) EU-US Data Privacy Framework: for transfers to the United States, where the third-party provider is certified under the framework approved by the EU Commission with the Adequacy Decision of 10 July 2023;
(c) Standard Contractual Clauses (SCC) approved by the EU Commission with Implementing Decision 2021/914, pursuant to Art. 46, paragraph 2, letter c) GDPR, supplemented by suitable additional technical and organisational measures where necessary on the basis of the Transfer Impact Assessment conducted by Stravagando;
(d) Binding Corporate Rules approved pursuant to Art. 47 GDPR, where applicable to the third-party provider;
(e) Derogations pursuant to Art. 49 GDPR, in specific and residual cases (e.g. explicit consent of the data subject, performance of a contract at the data subject's request, reasons of public interest).
6.3 Transparency. For each Third-Party Tracking Tool, the Preferences Panel indicates the country of processing and — where outside the EEA — the safeguard mechanism adopted.
ART. 7 — DURATION AND RETENTION
7.1 Duration of Cookies. The duration of each Cookie and Tracking Tool is indicated in the Preferences Panel. By way of guidance:
(a) Session Cookies: deleted when the browser is closed or after a predetermined period of inactivity;
(b) Persistent functional Cookies: duration varying from 7 days to 12 months;
(c) Analytical Cookies: maximum duration of 14 months (Google Analytics 4 default) or 24 months;
(d) Marketing Cookies: duration varying from 30 days to 24 months depending on the provider;
(e) Referral Program Attribution Cookie: 90 days;
(f) Local consent record: 6 months.
7.2 Retention of the data collected. The personal data collected by means of Tracking Tools are retained for the time strictly necessary to pursue the purposes for which they were collected, in accordance with the criteria indicated in the general Privacy Notice of the Platform. In summary:
(a) security and anti-fraud data: 24 months, save where longer retention is needed for investigative requirements;
(b) analytics data: up to 26 months for Google Analytics 4 and similar tools (with automatic deletion of individual records and retention of aggregates only);
(c) profiling and marketing data: up to 24 months from the last interaction, or until withdrawal of consent if earlier;
(d) Referral Program attribution data: for the duration of the contractual relationship with the Referrer + 24 months (dispute management);
(e) server-side consent log: 10 years from the collection of consent or from its withdrawal, for evidentiary purposes.
ART. 8 — RIGHTS OF THE DATA SUBJECT
8.1 Rights recognised. The data subject may exercise at any time the following rights provided for in Arts. 15-22 GDPR:
(a) right of access to their personal data (Art. 15) — to obtain confirmation of the processing and a copy of the data processed;
(b) right to rectification (Art. 16) — to obtain the correction of inaccurate data or the completion of incomplete data;
(c) right to erasure or "right to be forgotten" (Art. 17) — to obtain the erasure of the data in the cases provided for by law;
(d) right to restriction of processing (Art. 18);
(e) right to data portability (Art. 20) — to receive, in a structured, commonly used and machine-readable format, the data concerning them and to transmit it to another controller;
(f) right to object to the processing (Art. 21), including the right to object at any time to the processing of their data for direct marketing purposes;
(g) right not to be subject to solely automated decisions (Art. 22), subject to the exceptions provided for by law;
(h) right to withdraw consent at any time (Art. 7, paragraph 3 GDPR), without prejudice to the lawfulness of the processing based on consent before its withdrawal;
(i) right to lodge a complaint with the competent supervisory authority (Art. 77), in particular with the Italian Data Protection Authority (Garante) in the case of Italy, in accordance with the procedures published on the website https://www.garanteprivacy.it.
8.2 Methods of exercise. The rights may be exercised:
(a) through the Preferences Panel of the Platform for the modification/withdrawal of consent to Cookies and to marketing purposes;
(b) through the "Privacy" section of the registered User's Panel for requests for access, rectification, erasure, portability;
(c) by means of a written request sent to support@stravagando.com (subject: "Exercise of privacy rights") or to horizonserviziintegrati@pec.it (for formal requests via certified email — PEC), accompanied by an identity document for the verification of the applicant's identity;
(d) by paper mail to the address of the Controller indicated in Art. 2.1.
8.3 Response times. Stravagando provides a response to requests for the exercise of rights within 1 month of receipt, extendable by a further 2 months in cases of particular complexity or of a high number of requests, pursuant to Art. 12, paragraph 3 GDPR, with prior communication to the data subject of the reasons for the extension within the first month of handling the matter.
ART. 9 — BROWSER AND DEVICE SETTINGS
9.1 Control via the browser. In addition to the mechanisms made available by Stravagando, the User may configure their browser to view, delete and block Cookies. Each browser has its own settings; updated operational instructions are available on the official pages of the main browsers:
(a) Google Chrome: https://support.google.com/chrome/answer/95647
(b) Mozilla Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
(c) Apple Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac
(d) Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge
(e) Opera: https://help.opera.com/en/latest/web-preferences/
9.2 Limits of the browser settings. The browser settings do not allow granular control by category of Cookie equal to that available in the Preferences Panel of the Platform. The full disabling of Cookies via the browser may result in the total or partial impossibility of using the Platform.
9.3 Mobile advertising identifiers. On mobile devices, the User may limit advertising tracking through the operating system settings:
(a) iOS: "Settings > Privacy & Security > Tracking" and disabling of consent to tracking for Apps, with the consequent transmission of an IDFA equal to a string of zeros by Stravagando's App;
(b) Android: "Settings > Privacy > Ads" and activation of "Delete advertising ID" or "Opt out of Ads Personalisation".
9.4 Do Not Track signal. The browser's Do Not Track (DNT) signal is considered by Stravagando as a further expression of the User's preference, although its technical interpretation is not standardised to date. The management of consent to Tracking Tools takes place in any event primarily by means of the banner and the Preferences Panel described in Art. 4.
ART. 10 — MINORS
10.1 Minimum age. The Platform is intended for adults or for minors who have reached the minimum access threshold provided for by the legislation applicable to their residence. Stravagando does not knowingly collect personal data of minors under 14 years of age in Italy (threshold pursuant to Art. 2-quinquies of the Italian Privacy Code for consent to data processing in the context of information society services) nor, for Users resident in other EU Member States, under the threshold established by the local legislation pursuant to Art. 8, paragraph 1 GDPR.
10.2 Procedure for requesting erasure. Where a parent or legal guardian believes that their minor child has provided Stravagando with personal data in breach of the age limitations, they may request its erasure by email to support@stravagando.com, with the consequent prompt removal of the data and deletion of any account.
ART. 11 — AMENDMENTS TO THIS COOKIE POLICY
11.1 Updates. Stravagando reserves the right to amend this Cookie Policy at any time, in particular to reflect regulatory changes, technological developments, the introduction of new Tracking Tools or new Third Parties, or the updating of processing purposes.
11.2 Communication. Significant amendments — such as the introduction of new categories of Tracking Tools, new purposes or new Third Parties — are communicated to the User by means of:
(a) notice on the platform with a minimum prior notice of 30 days before it takes effect;
(b) email to the registered address, where the User holds an account;
(c) re-display of the first-visit banner for the new giving of consent, where required.
11.3 Previous versions. The previous versions of the Cookie Policy are archived and available at the data subject's request for the purpose of historical reconstruction of the processing.
11.4 Current version. The current version of the Cookie Policy bears the date of entry into force at the top of the document and replaces every previous version.
ART. 12 — CONTACTS AND COMPLAINTS
12.1 Data Controller.
Trade name: Stravagando Company name: Horizon Servizi Integrati S.r.l.s. Registered office: Viale Giovanni Bovio, 103/1 65124 Pescara (PE), Italy Tax Code / VAT No.: 02445190685 General support email: support@stravagando.com
PEC: horizonserviziintegrati@pec.it
12.2 Data Protection Officer (DPO).
Email: support@stravagando.com (subject: "DPO")
12.3 Complaint to the supervisory authority.
Italian Data Protection Authority (Garante per la protezione dei dati personali) Piazza Venezia No. 11 — 00187 Rome (RM), Italy Website: https://www.garanteprivacy.it Email: protocollo@gpdp.it PEC: protocollo@pec.gpdp.it Complaint form available at: https://www.garanteprivacy.it/home/modulistica-e-servizi-online
For Users resident in other EU Member States, the possibility remains of lodging a complaint with the supervisory authority of the State of residence, of work or of the place of the alleged infringement, pursuant to Art. 77 GDPR. The list of EU supervisory authorities is available on the website of the European Data Protection Board: https://www.edpb.europa.eu.
Document approved and adopted by Horizon Servizi Integrati S.r.l.s.
Version: 1.0 Date of entry into force: 26/04/2026 Reference document: Decision of the Italian Data Protection Authority of 10 June 2021 — Guidelines on cookies and other tracking tools (Reg. decision No. 231/2021)