Privacy Policy

Personal Data Processing Notice — GuideXpress

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and to Italian Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018 (the “Italian Privacy Code”), to users of the GuideXpress mobile application and related services. We recommend reading it before creating an account, enabling location services or using the App’s features.

1. Data Controller

The Data Controller is:

RDITALY S.r.l.
Registered office: Via Lavoratori Vittime del Col du Mont, 21 and 24 — 11100 Aosta (AO), Italy
Privacy email: info@rditaly.com
General email: info@rditaly.com

Any reference to “we”, “the Controller” or “the Company” in this notice means RDITALY S.r.l.

2. Data Protection Officer (DPO)

The Controller has voluntarily appointed a Data Protection Officer pursuant to Article 37 GDPR:

Valerio Falcicchio
Email: dpo@rditaly.com

This address is dedicated and confidential to the DPO: Article 38(5) GDPR binds the DPO to secrecy, and a generic company mailbox would expose the data subject’s communications to unauthorised staff.

Data subjects may contact the DPO on any matter relating to the processing of their personal data and the exercise of their rights under the GDPR.

3. Scope

This notice applies to:

• the GuideXpress mobile application (Apple App Store and Google Play Store);
• the guidexpress.com website and its subdomains;
• the policy.guidexpress.com portal;
• the my.guidexpress platform, limited to receiving the bookings made by guests through the hotel concierge;
• ancillary services (geolocated audio guides, gamification, push notifications, location-based exploration, hotel concierge, marketing communications, questionnaires, competitions and promotional initiatives).

It does not apply to third-party sites or services linked from the App.

4. Categories of personal data processed

4.1 Data provided voluntarily by the user

Email/password registration:

• first and last name;
• email address;
• password (stored as a one-way hash);
• optional: date of birth and gender.

Social login (Apple, Google, Facebook): provider identifier, email, display name.

During use: avatar, system preferences, favourites, itineraries, feedback, support tickets, answers to questionnaires and surveys, data on participation in competitions and promotional initiatives, communication preferences (content types and channels chosen).

Hotel concierge (only if activated, section 5.8): accommodation facility, departure date chosen by the guest (no later than 60 days after activation), surname, mobile number and period of stay (activation date and end date); for each booking, the service booked, day and time slot, number of people and, where applicable, room number and notes. A non-reversible cryptographic fingerprint is calculated from the facility, mobile number and surname (section 5.8). The facility’s QR code is read with the device camera: no image is saved or transmitted.

Acceptance of the notice and terms: the date on which the account accepted the terms of service; the version of this notice accepted, with date, time and App version (section 15).

4.2 Data collected automatically

Location: real-time and background GPS coordinates (only with the user’s permission).

Device and usage: pseudonymous UUID, device model, OS, App version, language, FCM token, interactions with the App, crash reports.

Gamification: POIs visited, stamps earned, wallet transactions, tour completion.

“News” communications: which communications from GuideXpress the user has read, for the sole purpose of correctly showing the unread-messages indicator on all of their devices. This data is kept for up to 400 days and deleted with the account.

Through the Meta SDK (only with the consent described in section 5.7): a per-installation identifier generated by the SDK (it is not the device advertising identifier, it is not shared across different apps, and it is regenerated on reinstallation); two app events only — App opening and completed registration, the latter with no parameters whatsoever; basic technical information (device type, OS, App version, country). We do not transmit to Meta your email, name, GPS location or the content you view.

Interaction with marketing communications (only with the consent described in section 5.7(b)): delivery, opening of and clicks on emails, push notifications and in-app messages, also detected through pixels and tracked links in emails; date, time and device of the interaction; history of consents and unsubscriptions.

4.3 Data received from third parties

In the case of social login, only the data listed in section 4.1, according to the privacy settings on your provider account. If you use the hotel concierge, we receive from the facility’s platform (my.guidexpress) the confirmation or cancellation of bookings, including those made at the facility’s kiosk and matched to you using the fingerprint described in section 5.8.

4.4 Special categories of data

The Controller does not request and does not process special categories of data (Article 9 GDPR). Questionnaires contain no questions about such categories.

4.5 Data relating to minors

The App is intended for users aged 16 or over. The children’s listening mode can only be enabled manually by the adult account holder. In that scenario no data about the child is collected.

Should the Controller become aware of data relating to children under 16 without parental authorisation, it will delete it immediately.

5. Purposes of processing and legal bases

5.1 Provision of the Service (Article 6(1)(b) GDPR)

Account, App features, audio guides, favourites, gamification, technical support.

5.2 Location (consent — Article 6(1)(a) GDPR)

Consent is collected at two levels: OS permission plus in-app notice.

Purpose	Type	Data collected
Nearby content	Core	GPS coordinates held in memory (not persisted)
Automatic audio guides	Core	GPS coordinates held in memory (not persisted)
Recording POI visits for stamps	Core	The visit event (not the coordinates)
Map navigation	Core	Coordinates transmitted to Mapbox
Position recorded every 30 seconds during an active guided session (analytics)	Improvement	Full-precision coordinates, including with the App in the background and the screen off, associated with the device identifier and not with your account. Kept for 30 days. Can be switched off in Settings → Privacy and consents
Position during audio events (analytics)	Improvement	Pseudonymised coordinates, max 24 months

The coordinate and the fact of the visit are two different things. Coordinates are processed on the basis of consent only. The record that a point of interest was visited (identifier and timestamp, without coordinates), which feeds scores and stamps, is processed for the performance of the service (Article 6(1)(b)) and is retained even if you withdraw your consent to location. GPS coordinates are never used for marketing purposes or for personalising communications.

You may withdraw consent at any time from your device settings.

5.3 Push notifications (consent — Article 6(1)(a) GDPR)

Stamps, concierge (booking confirmations and cancellations), notification shown while GPS tracking is active, informational and promotional communications. Each category can be disabled independently. Promotional notifications and in-app messages require both the operating-system permission and consent to marketing communications under section 5.7(b): notification permission alone does not count as consent to marketing.

5.4 Legal obligations (Article 6(1)(c) GDPR)

Tax and accounting obligations and requests from public authorities.

5.5 Legitimate interest (Article 6(1)(f) GDPR)

Security, diagnostics, pseudonymised analytics. GPS coordinates are never processed on the basis of legitimate interest — neither the periodic ones nor those tied to audio events: all of them rest on consent (section 5.2). Analytics data processed on this basis is not shared with Meta or with any other advertising provider. Legitimate interest is never used as a basis for sending marketing communications, not even in the form provided for by Article 130(4) of the Italian Privacy Code (so-called soft spam): all promotional communications rest solely on the consent in section 5.7(b).

Legitimate interest covers the downstream processing, not the writing on the device. There are two layers: generating and reading the technical identifier on the device falls under Article 122 of the Italian Privacy Code (Article 5(3) of the ePrivacy Directive), where legitimate interest cannot be invoked — the Italian Data Protection Authority is explicit: “under no circumstances will it be possible to invoke […] the controller’s legitimate interest to justify the use of […] tracking tools” (our translation). For that layer the Controller relies on the exemption in section 7.2 of the Authority’s Guidelines of 10 June 2021 for first-party analytics tools: statistical processing carried out in-house, no third-party recipient, identifier confined to a single application, and no decision directed at an individual user. Processing of the data on the Controller’s systems remains on legitimate interest (Article 6(1)(f)).

You may object at any time by writing to info@rditaly.com.

5.6 Legal claims (Article 6(1)(f) GDPR)

For the period strictly necessary.

5.7 Advertising campaign measurement, marketing communications and their personalisation (consent — Article 6(1)(a) GDPR and Article 130 of the Italian Privacy Code)

Three distinct purposes, which can be consented to separately. All of them rest on consent alone and none is necessary to use the App.

(a) Measuring campaign effectiveness. We promote GuideXpress with ads on Meta’s platforms (Facebook and Instagram) and we need to know whether they lead to installs and registrations. For this the App includes the Meta SDK, which — only after consent — transmits the two events described in section 4.2.

Measurement is aggregated: install attribution goes through operating-system mechanisms (SKAdNetwork on iOS, Meta Install Referrer on Android), which by design carry no advertising identifiers. We do not collect the advertising identifier (IDFA / Advertising ID), we do not request tracking authorisation (App Tracking Transparency) and we do not track across different apps. Technical detail in section 12.1.

(b) Informational and promotional communications (direct marketing). With your consent we may send you:

• news and updates about new features, cities, audio guides, itineraries and App content;
• promotions, offers and discounts relating to the App and GuideXpress services;
• partner offers and deals: shops and businesses, accommodation facilities, museums, tourism bodies and other entities affiliated with GuideXpress, including opportunities to convert points and stamps into vouchers. These communications are sent by us: your data is not communicated to partners;
• questionnaires, satisfaction surveys and market research, including with points or other rewards; the answers are used to improve the service and are analysed in aggregated form;
• invitations to events, special tours, launches and initiatives, including those organised together with partners;
• competitions, prize promotions, challenges and promotional leaderboards, each governed by its own rules;
• requests to review or rate the App on the stores.

Channels. Email to the address associated with the account; push notifications; in-app messages (banners, cards, information pop-ups) shown while using the App. We do not make calls and do not send SMS or messages on messaging apps: these channels would require a telephone number, which we collect only for the hotel concierge (section 5.8) and never for marketing purposes, and they would be activated only with a new specific consent. Generic content about App features, visible in the same way to all users and not based on personal data, is not a marketing communication within the meaning of this section.

Measurement of communications. To know whether a message has been delivered, opened or clicked, we use pixels and tracked links in emails and we record the delivery and opening of notifications and in-app messages. This serves to assess the effectiveness of mailings, to regulate their frequency and to avoid sending messages to those who do not read them. It falls within consent (b) and is not used to build individual profiles without consent (c).

(c) Personalisation of communications (profiling for marketing purposes). With a further, separate consent we may tailor the content, timing and channel of the communications under point (b) to your interests, derived from: cities and itineraries chosen or completed, points of interest visited and stamps earned, language, favourites, stated preferences, answers to questionnaires, interaction with communications and, if you have provided them, age group and gender. We do not use GPS coordinates, the content of support tickets or data received from Meta. Personalisation constitutes profiling (Article 4(4) GDPR) but produces no legal effects concerning you and does not similarly significantly affect you: it is not an automated decision within the meaning of Article 22 GDPR. Consent (c) presupposes consent (b); without (c), if you have given (b), you receive communications that are the same for everyone or selected only on the basis of language and country.

How we collect consent. It is requested after the notice and before completing registration, on a dedicated screen, in both the email and the social sign-up paths. Users who were already registered are asked once only, on the same screen. Those who gave consent to communications on the basis of version 2.2 of this notice will be asked again for the expanded scope: until then they will receive only communications falling within what was described at the time of consent. The consent is:

• granular: the three purposes are separate and independent;
• not pre-ticked: the switches are presented off (Recital 32 GDPR; CJEU C-673/17 Planet49);
• freely given: accepting and declining carry equal visual weight, and declining does not limit the App’s features; participation in questionnaires, competitions, leaderboards and points programmes is not conditional on consent to marketing;
• demonstrable (Article 7(1) GDPR): we record the purpose, the outcome, the exact version of the text shown, the occasion, the App version, and the date and time. The text is stored in versioned form and cannot be altered retroactively.

Withdrawal (Article 7(3) GDPR). Each consent can be withdrawn at any time, as easily as it was given, from Settings → Privacy and consents. Withdrawing the measurement consent switches the SDK off immediately and discards events not yet transmitted. For marketing communications you can also use the unsubscribe link in every email or disable promotional notifications, and you can limit yourself to a single channel (for example continuing to receive emails but not push notifications). Withdrawing consent (b) automatically also withdraws consent (c) and deletes the personalisation profile. Withdrawal does not affect the lawfulness of communications sent previously.

Meta’s role: two phases, two capacities.

• Collection in the App and transmission — joint controllership (Article 26 GDPR). Limited to the collection of the two events and their transmission, the Controller and Meta Platforms Ireland Ltd. act as joint controllers. This is not an interpretation: the Meta Business Tools Terms list among the covered tools “the Facebook SDK for App Events” and the parties “acknowledge and agree that they are joint controllers pursuant to Article 26 GDPR“. The arrangement consists of those Terms and the Controller Addendum.
• Subsequent processing — independent controllership. For what Meta does with the data after receiving it, “Meta Ireland remains an independent controller“. We have no control over that processing.
• Essence of the joint controllership arrangement (Article 26(2)). The Controller is responsible for the legal basis of its own processing, for this notice, for collecting and managing consent and for configuring the SDK; Meta is primarily responsible for informing users about its own processing and for handling requests concerning the data it holds. Contact point for the Controller: the address in section 2; requests we cannot handle ourselves are forwarded to Meta.

Regardless of this allocation, you may exercise your rights against either of the two joint controllers (Article 26(3)): no contractual allocation can be relied upon against you.

Providers for communications (b) and (c). Questionnaires are published on our website guidexpress.com and the answers are collected in our systems. For sending emails and managing consents and contacts we use providers acting as processors (Article 28 GDPR), listed in section 7, who may not use your data for their own purposes. Data used for communications is never transmitted to Meta or to other advertising platforms.

5.8 Hotel concierge (Article 6(1)(b) GDPR)

What it is. The hotel concierge is an optional feature, introduced with version 2.4.0 of the App. The guest of a participating accommodation facility scans the facility’s QR code with the camera and activates the digital concierge for their stay: information about the facility (Wi-Fi, opening hours, services, local tips, frequently asked questions), booking of the facility’s services, booking confirmation and cancellation notifications. It is used only by those who activate it: nothing changes for other users.

Camera. It is used only to read the facility’s QR code. No image is saved or transmitted.

Data processed on activation. The facility; the departure date chosen by the guest, no later than 60 days after activation; the guest’s surname and mobile number; the period of stay (activation date and end date). Surname, mobile number and departure date cannot be changed until the end of the stay.

Data processed for bookings. Service booked, day and time slot, number of people, room number if provided, notes if written by the guest, as well as surname and mobile number.

Link with the facility’s kiosk. To recognise the bookings that the guest makes from the facility’s kiosk, the system calculates a cryptographic fingerprint from the facility, mobile number and surname: a keyed, non-reversible hash. The mobile number is used for this link.

Purpose and legal basis. The data is processed to provide the concierge service requested by the user (performance of the service, Article 6(1)(b) GDPR). It is not used for marketing purposes and is not communicated to other parties for marketing purposes.

Concierge notifications. Push notifications confirming and cancelling bookings are a category of their own, which can be disabled in the App settings (Settings → Notifications → Concierge notifications).

Accommodation facility. The participating facility receives the surname, mobile number and booking details through the my.guidexpress platform, operated by RDITALY, in order to manage the stay and the services booked (section 7).

Statistics for facilities. Facilities see only aggregated and pseudonymised statistics on the use of the concierge (for example sections opened, bookings), never below a threshold of 3 people or events and never individual data.

Retention and deletion. Retention periods are set out in section 9; the effects of account deletion in section 11.1.

6. Processing methods and security measures

• Encryption: TLS 1.2+, AES-256 at rest, bcrypt for passwords, iOS Keychain / Android Keystore for on-device credentials.
• Access control: Row-Level Security, SECURITY DEFINER for critical functions, max 5 login attempts.
• Password migration: attempts to migrate the password of an account from the previous GuideXpress website are limited (maximum number of attempts per account and per network address). For this purpose a hash of the IP address, calculated with a daily salt, is kept for 24 hours; the address itself is never kept in clear.
• Pseudonymisation: separate analytics schema, UUID not linked to the account, no correspondence tables.
• Continuity: encrypted backups (max 30 days), dev/production segregation.
• Organisation: staff training, data breach procedure (72h), DPIA available on request.

7. Recipients

Category	Entities	Role
Cloud infrastructure	Supabase, Inc.	Processor (Article 28)
Push notifications	Google LLC (FCM)	Processor
Maps	Mapbox, Inc.	Processor
Social login	Apple, Google, Meta	Independent controllers
Campaign measurement	Meta Platforms Ireland Ltd.	Joint controller (Article 26) for collection and transmission; independent controller for subsequent processing. Only with consent (section 5.7), limited to the two events
CRM and marketing email sending	HighLevel, Inc. (GoHighLevel platform)	Processor (Article 28). Only for those who have given the consent in section 5.7(b)
Questionnaires and surveys	The guidexpress.com website, operated directly by the Controller; the website’s hosting provider	Internal processing. The hosting provider acts as processor (Article 28)
Affiliated partners	Businesses, accommodation facilities, museums, organisations	No communication of data for marketing: offers are sent by the Controller. When a voucher is redeemed, the partner receives only the voucher code
Competitions and prize promotions	Delegated entity, notary or Chamber of Commerce official, competent Ministry	Processor or independent controller, according to the role provided for by Presidential Decree (D.P.R.) 430/2001, limited to participants
Hotel concierge	Participating accommodation facility, through the my.guidexpress platform operated by the Controller	Receives the guest’s surname, mobile number and bookings, in order to manage the stay and the services booked. Role stated below the table. Only for those who activate the concierge (section 5.8)
Ticketing	RDITALY (Perfex CRM)	Internal
Professional advisers	Law firms, accountants	Processors/controllers
Public authorities	Judicial and tax authorities	Independent controllers

Data is not sold, transferred or rented to third parties. One exception, stated precisely: the two events communicated to Meta under section 5.7, only where express consent exists, which Meta uses as an independent controller including for its own advertising purposes. Outside that case we do not make data available to third parties for marketing, commercial profiling, targeted advertising or retargeting. Affiliated partners do not receive your data: their offers reach you from us. Under no circumstances are your email, name, location or viewed content communicated to Meta.

Accommodation facilities participating in the concierge. If you activate the hotel concierge (section 5.8), the facility where you are staying receives, through the my.guidexpress platform operated by RDITALY, your surname, your mobile number and the booking details, in order to manage the stay and the services booked. The facility processes such data as an independent controller for managing the stay and the services booked. The facility does not receive this data for marketing purposes. As regards the use of the concierge, facilities see only aggregated and pseudonymised statistics, never below 3 people or events and never individual data.

8. Transfers outside the EEA

Provider	Data	Safeguard
Google LLC	FCM token, ID, email, name	EU-U.S. DPF + SCCs
Apple Inc.	Apple ID, relay email, name	EU-U.S. DPF + SCCs
Meta Platforms (login)	Facebook ID, email, name	EU-U.S. DPF + SCCs
Meta Platforms (measurement SDK)	Per-installation SDK identifier, two app events, basic technical information. No advertising identifier, no account data, no location	Our counterparty is Meta Platforms Ireland Ltd. (joint controller, section 5.7); any onward transfer to the United States is arranged by Meta as an independent controller, under safeguards verifiable on the DPF register. Without consent the SDK neither logs nor transmits any app event
Supabase, Inc.	Account, preferences, stamps, avatar, concierge data (stay, surname, telephone), notice acceptance register, read status of communications	SCCs + supplementary measures (encryption in transit and at rest, pseudonymisation, minimisation)
Mapbox, Inc.	GPS coordinates, IP	SCCs + supplementary measures
HighLevel, Inc.	Name, email, language, status of consents and preferences, interaction with communications, answers to questionnaires, any personalisation profile (section 5.7(c))	SCCs + supplementary measures (encryption in transit and at rest, minimisation); EU-U.S. DPF if the provider is certified

A copy of the safeguards is available on request at info@rditaly.com.

9. Retention periods

Category	Period
Account data	For the duration of registration (immediate deletion on request)
Gamification	Until the account is deleted
Push tokens	Until notifications are disabled or the account is deleted
Read status of “News” communications	Max 400 days; deleted with the account
Consent register (purpose, outcome, text version, occasion, App version, date and time)	For the duration of registration; removed with the account. The versioned text is stored separately and cannot be traced to any user
Acceptance of the notice and terms (date of acceptance of the terms; version of the notice accepted, date and time, App version)	For the duration of registration; deleted with the account
Data transmitted to Meta (section 5.7)	Determined by Meta as an independent controller. We keep no copy in our systems
Data for marketing communications (section 5.7(b)): email, preferences, channels	Until consent is withdrawn or the account is deleted
Data on interaction with communications (delivery, opens, clicks)	Max 24 months from collection
Personalisation profile (section 5.7(c))	Max 12 months from the collection of each data item feeding it; deleted immediately upon withdrawal
Answers to questionnaires	24 months, then kept only in aggregated and anonymous form
Data on participation in competitions and prize promotions	For the period required by the legislation on prize promotions (Presidential Decree (D.P.R.) 430/2001), then deletion
Coordinates recorded periodically during guided sessions	30 days, then automatic deletion
Hotel concierge: stay data (surname, mobile number, cryptographic fingerprint, dates)	Automatic deletion 90 days after the end of the stay; immediate deletion if the account is deleted (section 11.1)
Hotel concierge: technical log of booking notifications received from the facility’s platform	90 days
Hotel concierge: bookings kept by the facility on the my.guidexpress platform	Anonymised 90 days after the date of the service
Technical logs / crashes	Max 12 months
IP address hash for limiting password migration attempts	24 hours
Pseudonymised analytics	Max 24 months
Support tickets	24 months from closure
Tax records	10 years (Article 2220 of the Italian Civil Code)
Legal claims	Until the proceedings are concluded, plus the applicable limitation period

10. Your rights

• Access (Article 15) — confirmation and a copy of your data
• Rectification (Article 16) — correction of inaccurate data
• Erasure (Article 17) — the right to be forgotten
• Restriction (Article 18) — restriction of processing
• Portability (Article 20) — data in JSON format
• Objection (Article 21) — to legitimate interest; to direct marketing and related profiling, at any time and without having to give reasons (Article 21(2) and 21(3)), including for a single channel
• Automated decision-making (Article 22) — the Controller carries out none
• Withdrawal of consent (Article 7(3)) — at any time, including the consents in section 5.7, from Settings → Privacy and consents or, for emails, via the unsubscribe link
• Complaint (Article 77) — to the Italian Data Protection Authority or to the supervisory authority of the EU Member State where you reside, where you work, or where the alleged infringement took place

11. How to exercise your rights

• In the App: Account → Settings (immediate deletion); Settings → Privacy and consents (withdrawal of consents)
• From emails: the unsubscribe link in every marketing communication
• Email: info@rditaly.com, or directly to the DPO: dpo@rditaly.com
• Post: RDITALY S.r.l., Via Lavoratori Vittime del Col du Mont, 21 and 24 — 11100 Aosta (AO), Italy

We respond within 30 days (extendable by 2 months). Exercising your rights is free of charge.

11.1 Account deletion

From the App (Account → Delete account): immediate removal of profile, favourites, stamps, wallet, visits, notifications, tokens, avatar, consent register, communication preferences, personalisation profile and local data. Data held by the email-sending provider is deleted at the same time. Residual data: backups (max 30 days), pseudonymised analytics (not linkable), data subject to legal retention obligations. Events already transmitted to Meta are subject to Meta’s policies as an independent controller.

The register of acceptance of the notice and terms and the read status of “News” communications are also deleted with the account.

Hotel concierge. The active stay is deleted immediately: the my.guidexpress platform is informed and the link between the bookings and the account is removed. Bookings already made remain with the facility, together with surname and mobile number, until they are anonymised 90 days after the date of the service, because the facility needs them to provide the service booked.

12. Cookies and tracking technologies

The App does not use cookies. It generates a random local UUID for aggregated analytics, linked neither to your account nor to the hardware. Kept for a maximum of 24 months. The re-identification risk has been assessed in the DPIA. Marketing emails may contain pixels and tracked links, described in section 5.7(b), used only in messages sent to those who have given the relevant consent.

12.1 The Meta SDK: what it does, what it does not do, how it is configured

The App includes the Meta SDK (the Core component, for app events only). We describe its configuration in verifiable terms, because the difference between aggregated measurement and advertising tracking is not visible to the user.

The SDK reaches the device already inert. The parameters governing its activity are set to false in the App configuration (FacebookAutoLogAppEventsEnabled and FacebookAdvertiserIDCollectionEnabled on iOS, the corresponding manifest attributes on Android). Without this configuration the SDK would start transmitting at the very first launch, before the user has seen the consent screen. It is activated only after consent is given and deactivated immediately upon withdrawal.

Practice	Status	How it is prevented
Collection of the advertising identifier	Excluded	Disabled at configuration level and reset to false on every alignment, even where consent has been given. On Android the AD_ID permission is removed from the final package
App Tracking Transparency (iOS)	Not requested	The relevant component is not compiled into the App: the system tracking prompt does not appear because there is no tracking to authorise
Tracking across different apps	Excluded	A consequence of the two points above: without a shared identifier there is no key to correlate the user across apps
Profiling or advertising inside the App	Absent	The App displays no ads and receives no content from Meta

Install attribution. On iOS through SKAdNetwork, an operating-system mechanism that sends the postback directly to the ad network in aggregated form (the App declares Meta’s two SKAdNetwork identifiers). On Android through the Meta Install Referrer, which uses no advertising identifiers.

Additional permissions on Android. Including the SDK entails declaring certain permissions relating to Google’s Privacy Sandbox APIs (ACCESS_ADSERVICES_ATTRIBUTION, ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_CUSTOM_AUDIENCE, ACCESS_ADSERVICES_TOPICS). They are declared by the library and visible to anyone inspecting the package. We do not use the interest-inference (Topics) or custom-audience (Protected Audience) features: the only relevant function is aggregated attribution.

Verifiability. The above follows from configuration choices present in the published package, not from mere undertakings: the absence of the advertising-identifier permission and the absence of the App Tracking Transparency component can be inspected in the binaries distributed by the stores.

13. Personalisation, automated processing and marketing

Processing	Data	Legal basis	Profile?
Proximity-based home screen	Current GPS	Consent	No
Age-adapted listening	Date of birth	Contract	No
Content ordering by selected city	Chosen city	Contract	No
Digital stamps	POIs visited	Contract	No
Hotel concierge	Facility, dates of stay, surname, telephone, bookings	Contract (Article 6(1)(b))	No
Analytics	Screens, events	Legitimate interest	No
Campaign measurement	Per-installation SDK identifier, two events	Consent	No — aggregated measurement, no profile built by the Controller
Marketing communications (section 5.7(b))	Email, push token, language, preferences, interaction with communications	Consent	No — the same communications for everyone, or selected by language and country
Personalisation of communications (section 5.7(c))	Cities and itineraries, POIs and stamps, favourites, preferences, questionnaires, interaction, age group and gender if provided	Specific consent	Yes — profiling for marketing purposes, with no legal effects and no automated decisions

No profiling, no segmentation, no personalised suggestions, except for the personalisation of marketing communications for those who expressly consent to it (section 5.7(c)).

13.1 Marketing and advertising: the exact perimeter

What we do not do. We display no ads in the App. We use no targeted advertising or retargeting based on your behaviour in the App. We do not transfer data to third parties for their own promotional purposes, save for the one exception stated. We build no individual profiles and we do not segment users without the specific consent in section 5.7(c).

What we do, and on what consent. The App includes the Meta SDK for the aggregated measurement of the effectiveness of the campaigns through which GuideXpress is promoted on Meta’s platforms (sections 5.7 and 12.1), solely on the basis of an express, granular and withdrawable consent, limited to two events. Meta receives them as an independent controller and may also use them for its own advertising purposes: this is why consent is requested in a specific and separate manner.

With a separate consent (section 5.7(b)) we send marketing communications by email, push notification and in-app messages: news, our own promotions and offers from affiliated partners (without communicating your data to them), questionnaires and market research, invitations to events, competitions and prizes. With a further consent (section 5.7(c)) we may tailor them to your interests.

A commitment kept. The previous version stated that, in order to introduce marketing processing, the Controller would request a specific, freely given, informed and granular consent before activation. That is exactly what has been done. The same commitment remains in force: any further processing for marketing purposes, and in particular any move to measurement based on advertising identifiers, will be preceded by an update to this notice and a fresh request for consent. This commitment also covers any uploading of user data to advertising platforms (for example email lists for creating custom audiences), the communication of data to partners for their own promotional purposes and the use of new channels (telephone, SMS, messaging).

14. Provision of data

Mandatory data is necessary for the account. Optional data (date of birth, gender, avatar, GPS, notifications, the consents in section 5.7, answers to questionnaires) is freely given; refusal only limits the corresponding features — and for the consents in section 5.7 it limits nothing at all. For the hotel concierge (section 5.8), surname and mobile number are necessary to activate it; those who do not provide them cannot use the concierge, but all other App features remain available.

15. Changes to this notice

Non-substantial changes: published directly. Substantial changes: 30 days’ notice plus a fresh consent where required. Continued use does not amount to tacit consent.

Each new version of the notice is presented in the App, which asks the user to read and accept it before continuing. The accepted version is recorded with date, time and App version (sections 4.1 and 9).

The introduction of campaign measurement (section 5.7) is a substantial change: for that reason it is conditional on an express, prior consent, collected in the App before any data is transmitted. No new processing takes place for those who do not consent.

The expansion of marketing communications and the introduction of their personalisation (section 5.7(b) and (c), version 2.3) also constitute a substantial change: they apply only to those who give, or renew, the relevant consent after having viewed this version. Acceptance of the notice alone does not amount to consent to marketing.

16. Governing law and jurisdiction

Italian law and the GDPR. The consumer’s forum or the Court of Aosta.