Personal Data Processing Notice — GuideXpress
This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and to Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (the “Italian Privacy Code”), to users of the GuideXpress mobile application and related services. We recommend reading it before creating an account, enabling location services or using the App’s features.
What has changed since the previous version
The App now includes the Meta SDK for aggregated measurement of advertising campaign effectiveness, and collects a specific, separate consent for that purpose and for sending communications. Statements in the previous version to the effect that no advertising SDK was integrated are no longer accurate and have been corrected. Without express consent, no app event is transmitted to Meta: see sections 5.7 and 12.1.
In brief
- Who we are: RDITALY S.r.l., based in Aosta, Italy. For any question: info@rditaly.com.
- What we collect: name, email, password (encrypted) and, only if you choose to, date of birth and gender. If you use social login (Apple, Google, Facebook), we receive only your name and email.
- GPS location: only if you grant permission. It powers automatic audio guides (including in the background) and shows you nearby content. During an active guided visit (discovery mode, tour, trail) we also record your position every 30 seconds, to understand how itineraries are actually walked: we keep it for 30 days, it is not linked to your account, and you can switch it off in Settings → Privacy and consents. Outside those sessions we do not record where you are.
- We do not sell your data and we do not profile you: no advertising inside the App, no personalised suggestions, no individual profile. The only thing that leaves for a third party for advertising purposes is the two measurement events described in the next point, and only with your consent.
- Campaign measurement (only if you consent): the App contains the Meta SDK, which tells us whether our ads work. It ships switched off and turns on only after your yes. Even when on, it sends two events only — App opening and completed registration — with no advertising identifier and without following you across different apps.
- Communications: you may consent to receiving news about the App. No sending channel is active yet: your choice is simply recorded.
- You can change your mind: Settings → Privacy and consents, three independent switches. Declining does not limit your use of the App in any way.
- Anonymous analytics: we analyse App usage with a random identifier, never linked to your account. You can switch it off in Settings → Privacy and consents.
- Push notifications: you can enable or disable each type of notification separately (stamps, tour feedback, communications) from the settings.
- Your data is yours: you can edit it, export it or delete your entire account with one tap from the Account section. Deletion is immediate and permanent.
- Security: password hashed with bcrypt, HTTPS connections, data encrypted at rest (AES-256), per-user database access (Row-Level Security).
- Retention: account data for as long as you are registered; analytics max 24 months; technical logs max 12 months. After that, everything is deleted.
- Minimum age: 16 to register. For younger children, a parent can enable the children’s listening mode from their own account.
This summary is provided for convenience and does not replace the full notice that follows.
1. Data Controller
The Data Controller is:
RDITALY S.r.l.
Registered office: Via Lavoratori Vittime del Col du Mont, 21 and 24 — 11100 Aosta (AO), Italy
Privacy email: info@rditaly.com
General email: info@rditaly.com
Any reference to “we”, “the Controller” or “the Company” in this notice means RDITALY S.r.l.
2. Data Protection Officer (DPO)
The Controller has voluntarily appointed a Data Protection Officer pursuant to Article 37 GDPR:
Valerio Falcicchio
Email: dpo@rditaly.com
This address is dedicated and confidential to the DPO: Article 38(5) GDPR binds the DPO to secrecy, and a generic company mailbox would expose the data subject’s communications to unauthorised staff.
Data subjects may contact the DPO on any matter relating to the processing of their personal data and the exercise of their rights under the GDPR.
3. Scope
This notice applies to:
- the GuideXpress mobile application (Apple App Store and Google Play Store);
- the guidexpress.com website and its subdomains;
- the policy.guidexpress.com portal;
- ancillary services (geolocated audio guides, gamification, push notifications, location-based exploration).
It does not apply to third-party sites or services linked from the App.
4. Categories of personal data processed
4.1 Data provided voluntarily by the user
Email/password registration:
- first and last name;
- email address;
- password (stored as a one-way hash);
- optional: date of birth and gender.
Social login (Apple, Google, Facebook): provider identifier, email, display name.
During use: avatar, system preferences, favourites, itineraries, feedback, support tickets.
4.2 Data collected automatically
Location: real-time and background GPS coordinates (only with the user’s permission).
Device and usage: pseudonymous UUID, device model, OS, App version, language, FCM token, interactions with the App, crash reports.
Gamification: POIs visited, stamps earned, wallet transactions, tour completion.
Through the Meta SDK (only with the consent described in section 5.7): a per-installation identifier generated by the SDK (it is not the device advertising identifier, it is not shared across different apps, and it is regenerated on reinstallation); two app events only — App opening and completed registration, the latter with no parameters whatsoever; basic technical information (device type, OS, App version, country). We do not transmit to Meta your email, name, GPS location or the content you view.
4.3 Data received from third parties
In the case of social login, only the data listed in section 4.1, according to the privacy settings on your provider account.
4.4 Special categories of data
The Controller does not request and does not process special categories of data (Article 9 GDPR).
4.5 Data relating to minors
The App is intended for users aged 16 or over. The children’s listening mode can only be enabled manually by the adult account holder. In that scenario no data about the child is collected.
Should the Controller become aware of data relating to children under 16 without parental authorisation, it will delete it immediately.
5. Purposes of processing and legal bases
5.1 Provision of the Service (Article 6(1)(b) GDPR)
Account, App features, audio guides, favourites, gamification, technical support.
5.2 Location (consent — Article 6(1)(a) GDPR)
Consent is collected at two levels: OS permission plus in-app notice.
| Purpose | Type | Data collected |
|---|---|---|
| Nearby content | Core | GPS coordinates held in memory (not persisted) |
| Automatic audio guides | Core | GPS coordinates held in memory (not persisted) |
| Recording POI visits for stamps | Core | The visit event (not the coordinates) |
| Map navigation | Core | Coordinates transmitted to Mapbox |
| Position recorded every 30 seconds during an active guided session (analytics) | Improvement | Full-precision coordinates, including with the App in the background and the screen off, associated with the device identifier and not with your account. Kept for 30 days. Can be switched off in Settings → Privacy and consents |
| Position during audio events (analytics) | Improvement | Pseudonymised coordinates, max 24 months |
The coordinate and the fact of the visit are two different things. Coordinates are processed on the basis of consent only. The record that a point of interest was visited (identifier and timestamp, without coordinates), which feeds scores and stamps, is processed for the performance of the service (Article 6(1)(b)) and is retained even if you withdraw your consent to location.
You may withdraw consent at any time from your device settings.
5.3 Push notifications (consent — Article 6(1)(a) GDPR)
Stamps, tour feedback, informational communications. Each category can be disabled independently.
5.4 Legal obligations (Article 6(1)(c) GDPR)
Tax and accounting obligations and requests from public authorities.
5.5 Legitimate interest (Article 6(1)(f) GDPR)
Security, diagnostics, pseudonymised analytics. GPS coordinates are never processed on the basis of legitimate interest — neither the periodic ones nor those tied to audio events: all of them rest on consent (section 5.2). Analytics data processed on this basis is not shared with Meta or with any other advertising provider.
Legitimate interest covers the downstream processing, not the writing on the device. There are two layers: generating and reading the technical identifier on the device falls under Article 122 of the Italian Privacy Code (Article 5(3) of the ePrivacy Directive), where legitimate interest cannot be invoked — the Italian Data Protection Authority is explicit: “under no circumstances will it be possible to invoke […] the controller’s legitimate interest to justify the use of […] tracking tools” (our translation). For that layer the Controller relies on the exemption in section 7.2 of the Authority’s Guidelines of 10 June 2021 for first-party analytics tools: statistical processing carried out in-house, no third-party recipient, identifier confined to a single application, and no decision directed at an individual user. Processing of the data on the Controller’s systems remains on legitimate interest (Article 6(1)(f)).
You may object at any time by writing to info@rditaly.com.
5.6 Legal claims (Article 6(1)(f) GDPR)
For the period strictly necessary.
5.7 Advertising campaign measurement and communications (consent — Article 6(1)(a) GDPR)
Two distinct purposes, which can be consented to separately. Both rest on consent alone and neither is necessary to use the App.
(a) Measuring campaign effectiveness. We promote GuideXpress with ads on Meta’s platforms (Facebook and Instagram) and we need to know whether they lead to installs and registrations. For this the App includes the Meta SDK, which — only after consent — transmits the two events described in section 4.2.
Measurement is aggregated: install attribution goes through operating-system mechanisms (SKAdNetwork on iOS, Meta Install Referrer on Android), which by design carry no advertising identifiers. We do not collect the advertising identifier (IDFA / Advertising ID), we do not request tracking authorisation (App Tracking Transparency) and we do not track across different apps. Technical detail in section 12.1.
(b) Informational and promotional communications. Consent to receive updates about new features, content and initiatives. As at the date of this notice no sending channel is active and no communication is being sent: the consent is merely recorded.
How we collect consent. It is requested after the notice and before completing registration, on a dedicated screen, in both the email and the social sign-up paths. Users who were already registered are asked once only, on the same screen. The consent is:
- granular: the two purposes are separate and independent;
- not pre-ticked: the switches are presented off (Recital 32 GDPR; CJEU C-673/17 Planet49);
- freely given: accepting and declining carry equal visual weight, and declining does not limit the App’s features;
- demonstrable (Article 7(1) GDPR): we record the purpose, the outcome, the exact version of the text shown, the occasion, the App version, and the date and time. The text is stored in versioned form and cannot be altered retroactively.
Withdrawal (Article 7(3) GDPR). Each consent can be withdrawn at any time, as easily as it was given, from Settings → Privacy and consents. Withdrawing the measurement consent switches the SDK off immediately and discards events not yet transmitted.
Meta’s role: two phases, two capacities.
- Collection in the App and transmission — joint controllership (Article 26 GDPR). Limited to the collection of the two events and their transmission, the Controller and Meta Platforms Ireland Ltd. act as joint controllers. This is not an interpretation: the Meta Business Tools Terms list among the covered tools “the Facebook SDK for App Events” and the parties “acknowledge and agree that they are joint controllers pursuant to Article 26 GDPR“. The arrangement consists of those Terms and the Controller Addendum.
- Subsequent processing — independent controllership. For what Meta does with the data after receiving it, “Meta Ireland remains an independent controller“. We have no control over that processing.
Essence of the joint controllership arrangement (Article 26(2)). The Controller is responsible for the legal basis of its own processing, for this notice, for collecting and managing consent and for configuring the SDK; Meta is primarily responsible for informing users about its own processing and for handling requests concerning the data it holds. Contact point for the Controller: the address in section 2; requests we cannot handle ourselves are forwarded to Meta.
Regardless of this allocation, you may exercise your rights against either of the two joint controllers (Article 26(3)): no contractual allocation can be relied upon against you.
6. Processing methods and security measures
- Encryption: TLS 1.2+, AES-256 at rest, bcrypt for passwords, iOS Keychain / Android Keystore for on-device credentials.
- Access control: Row-Level Security, SECURITY DEFINER for critical functions, max 5 login attempts.
- Pseudonymisation: separate analytics schema, UUID not linked to the account, no correspondence tables.
- Continuity: encrypted backups (max 30 days), dev/production segregation.
- Organisation: staff training, data breach procedure (72h), DPIA available on request.
7. Recipients
| Category | Entities | Role |
|---|---|---|
| Cloud infrastructure | Supabase, Inc. | Processor (Article 28) |
| Push notifications | Google LLC (FCM) | Processor |
| Maps | Mapbox, Inc. | Processor |
| Social login | Apple, Google, Meta | Independent controllers |
| Campaign measurement | Meta Platforms Ireland Ltd. | Joint controller (Article 26) for collection and transmission; independent controller for subsequent processing. Only with consent (section 5.7), limited to the two events |
| Ticketing | RDITALY (Perfex CRM) | Internal |
| Professional advisers | Law firms, accountants | Processors/controllers |
| Public authorities | Judicial and tax authorities | Independent controllers |
Data is not sold, transferred or rented to third parties. One exception, stated precisely: the two events communicated to Meta under section 5.7, only where express consent exists, which Meta uses as an independent controller including for its own advertising purposes. Outside that case we do not make data available to third parties for marketing, commercial profiling, targeted advertising or retargeting. Under no circumstances are your email, name, location or viewed content communicated to Meta.
8. Transfers outside the EEA
| Provider | Data | Safeguard |
|---|---|---|
| Google LLC | FCM token, ID, email, name | EU-U.S. DPF + SCCs |
| Apple Inc. | Apple ID, relay email, name | EU-U.S. DPF + SCCs |
| Meta Platforms (login) | Facebook ID, email, name | EU-U.S. DPF + SCCs |
| Meta Platforms (measurement SDK) | Per-installation SDK identifier, two app events, basic technical information. No advertising identifier, no account data, no location | Our counterparty is Meta Platforms Ireland Ltd. (joint controller, section 5.7); any onward transfer to the United States is arranged by Meta as an independent controller, under safeguards verifiable on the DPF register. Without consent the SDK neither logs nor transmits any app event |
| Supabase, Inc. | Account, preferences, stamps, avatar | SCCs + supplementary measures (encryption in transit and at rest, pseudonymisation, minimisation) |
| Mapbox, Inc. | GPS coordinates, IP | SCCs + supplementary measures |
A copy of the safeguards is available on request at info@rditaly.com.
9. Retention periods
| Category | Period |
|---|---|
| Account data | For the duration of registration (immediate deletion on request) |
| Gamification | Until the account is deleted |
| Push tokens | Until notifications are disabled or the account is deleted |
| Consent register (purpose, outcome, text version, occasion, App version, date and time) | For the duration of registration; removed with the account. The versioned text is stored separately and cannot be traced to any user |
| Data transmitted to Meta (section 5.7) | Determined by Meta as an independent controller. We keep no copy in our systems |
| Coordinates recorded periodically during guided sessions | 30 days, then automatic deletion |
| Technical logs / crashes | Max 12 months |
| Pseudonymised analytics | Max 24 months |
| Support tickets | 24 months from closure |
| Tax records | 10 years (Article 2220 of the Italian Civil Code) |
| Legal claims | Until the proceedings are concluded, plus the applicable limitation period |
10. Your rights
- Access (Article 15) — confirmation and a copy of your data
- Rectification (Article 16) — correction of inaccurate data
- Erasure (Article 17) — the right to be forgotten
- Restriction (Article 18) — restriction of processing
- Portability (Article 20) — data in JSON format
- Objection (Article 21) — to legitimate interest
- Automated decision-making (Article 22) — the Controller carries out none
- Withdrawal of consent (Article 7(3)) — at any time, including the consents in section 5.7, from Settings → Privacy and consents
- Complaint (Article 77) — to the Italian Data Protection Authority or to the supervisory authority of the EU Member State where you reside, where you work, or where the alleged infringement took place
11. How to exercise your rights
- In the App: Account → Settings (immediate deletion); Settings → Privacy and consents (withdrawal of consents)
- Email: info@rditaly.com, or directly to the DPO: dpo@rditaly.com
- Post: RDITALY S.r.l., Via Lavoratori Vittime del Col du Mont, 21 and 24 — 11100 Aosta (AO), Italy
We respond within 30 days (extendable by 2 months). Exercising your rights is free of charge.
11.1 Account deletion
From the App (Account → Delete account): immediate removal of profile, favourites, stamps, wallet, visits, notifications, tokens, avatar, consent register and local data. Residual data: backups (max 30 days), pseudonymised analytics (not linkable), data subject to legal retention obligations. Events already transmitted to Meta are subject to Meta’s policies as an independent controller.
12. Cookies and tracking technologies
The App does not use cookies. It generates a random local UUID for aggregated analytics, linked neither to your account nor to the hardware. Kept for a maximum of 24 months. The re-identification risk has been assessed in the DPIA.
12.1 The Meta SDK: what it does, what it does not do, how it is configured
The App includes the Meta SDK (the Core component, for app events only). We describe its configuration in verifiable terms, because the difference between aggregated measurement and advertising tracking is not visible to the user.
The SDK reaches the device already inert. The parameters governing its activity are set to false in the App configuration (FacebookAutoLogAppEventsEnabled and FacebookAdvertiserIDCollectionEnabled on iOS, the corresponding manifest attributes on Android). Without this configuration the SDK would start transmitting at the very first launch, before the user has seen the consent screen. It is activated only after consent is given and deactivated immediately upon withdrawal.
| Practice | Status | How it is prevented |
|---|---|---|
| Collection of the advertising identifier | Excluded | Disabled at configuration level and reset to false on every alignment, even where consent has been given. On Android the AD_ID permission is removed from the final package |
| App Tracking Transparency (iOS) | Not requested | The relevant component is not compiled into the App: the system tracking prompt does not appear because there is no tracking to authorise |
| Tracking across different apps | Excluded | A consequence of the two points above: without a shared identifier there is no key to correlate the user across apps |
| Profiling or advertising inside the App | Absent | The App displays no ads and receives no content from Meta |
Install attribution. On iOS through SKAdNetwork, an operating-system mechanism that sends the postback directly to the ad network in aggregated form (the App declares Meta’s two SKAdNetwork identifiers). On Android through the Meta Install Referrer, which uses no advertising identifiers.
Additional permissions on Android. Including the SDK entails declaring certain permissions relating to Google’s Privacy Sandbox APIs (ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_CUSTOM_AUDIENCE, ACCESS_ADSERVICES_TOPICS). They are declared by the library and visible to anyone inspecting the package. We do not use the interest-inference (Topics) or custom-audience (Protected Audience) features: the only relevant function is aggregated attribution.
Verifiability. The above follows from configuration choices present in the published package, not from mere undertakings: the absence of the advertising-identifier permission and the absence of the App Tracking Transparency component can be inspected in the binaries distributed by the stores.
13. Personalisation, automated processing and marketing
| Processing | Data | Legal basis | Profile? |
|---|---|---|---|
| Proximity-based home screen | Current GPS | Consent | No |
| Age-adapted listening | Date of birth | Contract | No |
| Content ordering by selected city | Chosen city | Contract | No |
| Digital stamps | POIs visited | Contract | No |
| Analytics | Screens, events | Legitimate interest | No |
| Campaign measurement | Per-installation SDK identifier, two events | Consent | No — aggregated measurement, no profile built by the Controller |
No profiling, no segmentation, no personalised suggestions.
13.1 Marketing and advertising: the exact perimeter
What we do not do. We display no ads in the App. We use no targeted advertising or retargeting based on your behaviour in the App. We do not transfer data to third parties for their own promotional purposes, save for the one exception stated. We build no individual profiles and we do not segment users.
What we do, and on what consent. The App includes the Meta SDK for the aggregated measurement of the effectiveness of the campaigns through which GuideXpress is promoted on Meta’s platforms (sections 5.7 and 12.1), solely on the basis of an express, granular and withdrawable consent, limited to two events. Meta receives them as an independent controller and may also use them for its own advertising purposes: this is why consent is requested in a specific and separate manner.
A separate consent has also been set up for sending informational and promotional communications. As at the date of this notice no channel is active and no communication is being sent.
A commitment kept. The previous version stated that, in order to introduce marketing processing, the Controller would request a specific, freely given, informed and granular consent before activation. That is exactly what has been done. The same commitment remains in force: any further processing for marketing purposes, and in particular any move to measurement based on advertising identifiers, will be preceded by an update to this notice and a fresh request for consent.
14. Provision of data
Mandatory data is necessary for the account. Optional data (date of birth, gender, avatar, GPS, notifications, the consents in section 5.7) is freely given; refusal only limits the corresponding features — and for the consents in section 5.7 it limits nothing at all.
15. Changes to this notice
Non-substantial changes: published directly. Substantial changes: 30 days’ notice plus a fresh consent where required. Continued use does not amount to tacit consent.
The introduction of campaign measurement (section 5.7) is a substantial change: for that reason it is conditional on an express, prior consent, collected in the App before any data is transmitted. No new processing takes place for those who do not consent.
16. Governing law and jurisdiction
Italian law and the GDPR. The consumer’s forum or the Court of Aosta.
