Privacy Policy
Last updated: 2026-06-10
This privacy notice describes the processing of personal data within the SalentoOneClick service, in accordance with Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003, as amended.
1. Data Controller
The Data Controller is Nexstudio. For any privacy-related request you can write to info@salentooneclick.it.
2. Data collected — subscribing properties
At registration we collect: email, property name, city, address, phone number (optional), property type, password (stored encrypted with bcrypt). Payments are handled by Stripe as data processor: we do not store payment card data on our systems.
3. Data collected — guide users and guests
The guide can be consulted free of charge without registration, login or provision of identifying data. This applies both to guests of subscribing properties (access via QR code) and to any visitor of the public guide. We use a technical session cookie to store the property of origin (if access is via QR code) and the preferred language. We also collect aggregated and anonymous data (clicks on affiliate links, content viewed, anonymised IP address) for internal analytics purposes, without identifying individual visitors. No third-party profiling cookie is currently active.
4. Legal bases for processing (Art. 6 GDPR)
Performance of the contract: registration, subscription management, provision of services to subscribing properties. Legitimate interest: platform security, fraud and abuse prevention (rate-limiting), aggregated and anonymous analytics. Explicit consent: marketing communications (separate opt-in), any non-technical cookies if activated in the future (see clause 9). Legal obligation: retention of billing data for tax purposes.
5. Data processors (Art. 28 GDPR)
The Controller uses the following providers as data processors, bound by specific agreements (DPAs): • Stripe — payment processing • MongoDB Atlas — database (EU region) • Vercel — application hosting • Resend — transactional email • Cloudinary — image management and optimisation • Upstash — rate-limiting and abuse protection • Google (AdSense) — advertising, only if activated (see clause 9) An updated list of processors can be requested from the privacy contact indicated in clause 1.
6. Extra-EU transfers
Data is preferably processed within the European Economic Area. Where some providers process data outside the EU/EEA, the transfer takes place on the basis of the standard contractual clauses approved by the European Commission (SCC) or adequacy decisions (e.g. the EU-US Data Privacy Framework for certified US providers).
7. Retention period
Subscriber account data: for the entire duration of the subscription and for 12 months following cancellation, subject to tax obligations (10 years for billing data). Guide users' access logs: 7 days (automatic deletion via TTL). Anonymous aggregated data: retained indefinitely in a form not attributable to individuals.
8. Data subject rights (Art. 15-22 GDPR)
The data subject has the right to: access their data, rectify it, obtain its erasure, obtain its portability in a structured and readable format, restrict or object to its processing, withdraw consent at any time without affecting the lawfulness of prior processing. Requests can be sent to info@salentooneclick.it: the Controller responds within one month of receipt, extendable by two months in particularly complex cases, with a reasoned communication. It is also possible to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
9. Cookie policy
Cookies currently in use. The site uses exclusively technical cookies essential to the operation of the service: session, language, property of origin (for QR-code access), anti-CSRF protection. Technical cookies do not require consent under current legislation; disabling them prevents the correct functioning of the service. Preferences can be managed via the cookie banner on the site. Advertising cookies: not active. Currently no advertising or third-party profiling cookie is set on the service pages. Future activation of advertising. Should the Controller activate advertising spaces in the future (e.g. Google AdSense) on the free guide pages, this notice will be updated before activation and consent to advertising cookies will be collected beforehand through a certified consent management platform, modifiable and revocable at any time. No advertising cookie will be set without prior consent.
10. Personal data breaches
In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, the Controller notifies the breach to the Italian Data Protection Authority within 72 hours of becoming aware of it (Art. 33 GDPR). Where the breach poses a high risk, data subjects will be informed without undue delay (Art. 34 GDPR).
11. Changes to this notice
In case of material changes to this notice, subscribers will be notified by email at least 15 days in advance; for guide users, the version published on the site prevails, with an indication of the last-updated date.
For inquiries or requests: info@salentooneclick.it