Personal Data Processing Notice
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree No. 196/2003 (the Italian “Data Protection Code”), as amended by Legislative Decree No. 101/2018, the Comune di Ferrara, acting as Data Controller, provides the following information on the processing of personal data of users who browse the website botteghestoricheferrara.it and of the businesses taking part in the Botteghe Storiche Ferrara project.
The Comune di Ferrara ensures that personal data processing takes place in compliance with fundamental rights and freedoms and with personal dignity, with particular reference to confidentiality, personal identity and the right to the protection of personal data.
1. Data Controller
The Data Controller is the
Comune di Ferrara
Piazza del Municipio, 2 – 44121 Ferrara
Requests relating to the rights referred to in paragraph 9 should be sent to: Comune di Ferrara, e-mail [email protected]
2. Data Protection Officer (DPO)
The Comune di Ferrara has appointed the company Lepida S.c.p.A. as Data Protection Officer
Via della Liberazione, 15 – 40128 Bologna
E-mail: [email protected]
3. Data Processors
The Data Controller makes use of third parties, appointed as Data Processors pursuant to Art. 28 GDPR, who guarantee adequate levels of expertise, capability and reliability with regard to data protection and security:
- 22HBG S.r.l., appointed by the Comune di Ferrara to develop and technically manage the project and the website;
- Aruba S.p.A., provider of the website’s hosting services, with servers located within the European Union.
Personal data is also processed by internal staff who have been duly authorised and instructed pursuant to Art. 29 GDPR.
4. Categories of data processed
a) Browsing data
The computer systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, URIs of the resources requested, time of the request, size of the file obtained, server response code, and the browser and operating system used. This data is stored in the hosting server’s log files, is used solely to derive aggregate statistical information on the use of the website and to check that it is working correctly and securely, and is deleted according to the hosting provider’s technical retention periods.
b) Data of the participating businesses
The website publishes information relating to the Botteghe Storiche registered in the municipal register: business name, address, contact details, opening hours, photographs, videos, descriptive content and links to external websites. This data is provided by the participating businesses as part of the project and may include personal data of the owners or staff of the shops (for example, images or video footage).
c) Data collected through cookies and third-party services
See the Cookie Policy in paragraph 11.
5. Purposes and legal bases of processing
Personal data is processed for the following purposes:
- implementation of digital marketing tools for the Botteghe Storiche registered in the municipal register, in order to promote the economic, productive and historical fabric of the Comune di Ferrara;
- carrying out and promoting communication and local marketing activities (digital campaigns, web portals, social media, promotional materials);
- publication of informational and promotional content relating to the participating businesses;
- statistical analysis in aggregate form, monitoring, studies and research;
- ensuring the technical operation and security of the website.
The legal bases are: the performance of a task carried out in the public interest vested in the Data Controller (Art. 6(1)(e) GDPR) for the purposes of promoting and enhancing the local area; the consent of the data subject (Art. 6(1)(a) GDPR) for the installation of statistical and third-party cookies, collected through the banner referred to in paragraph 11.
6. Processing methods
Processing is carried out using both electronic and paper-based tools, with logic strictly related to the purposes indicated and with the adoption of technical and organisational measures suitable to guarantee the security, integrity and confidentiality of the data, in compliance with the principles of data minimisation and fairness set out in Art. 5 GDPR. No automated decision-making processes or profiling activities are used pursuant to Art. 22 GDPR.
7. Recipients and transfer of data to third countries
Data relating to the participating businesses may be disclosed as part of the project’s communication and promotional activities. Browsing data and data collected through cookies may be shared with the providers of the services indicated in paragraph 12.
The use of services provided by Google LLC and Adobe Inc. may involve the transfer of personal data to the United States. Such transfers take place on the basis of the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, to which both providers adhere, and of the further safeguards set out in Articles 44 et seq. of the GDPR.
8. Retention period
Data is retained for the time strictly necessary to achieve the purposes indicated. Data relating to the participating businesses is published for the duration of their participation in the project. Browsing data is retained according to the hosting provider’s technical log retention periods. The duration of individual cookies is indicated in paragraph 11. The Data Controller periodically verifies the relevance, non-excessiveness and necessity of the data processed.
9. Rights of the data subject
Pursuant to Articles 15 to 22 of the GDPR, the data subject has the right to:
- obtain access to their own personal data and to information relating to the processing (Art. 15);
- obtain rectification of inaccurate data or the completion of incomplete data (Art. 16);
- obtain erasure of data in the cases provided for (Art. 17);
- obtain restriction of processing (Art. 18);
- receive the data in a structured, commonly used format for portability purposes, in the cases provided for (Art. 20);
- object to processing based on the public interest for reasons connected with their particular situation (Art. 21);
- withdraw consent given at any time, without prejudice to the lawfulness of processing carried out before the withdrawal (Art. 7).
Requests should be sent to the Personal Data Protection Office of the Comune di Ferrara at the address indicated in paragraph 1. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or to bring the matter before the courts.
10. Source of the data
Data relating to the participating businesses is collected from the businesses themselves and from the municipal register of Botteghe Storiche. Browsing data and data from cookies are collected directly from the data subject while browsing the website.
11. Cookie Policy
What cookies are
Cookies are small text files that visited websites send to the user’s device (computer, tablet, smartphone), where they are stored by the browser to be sent back to the same websites on the next visit. This section is drafted in accordance with Art. 122 of the Italian Data Protection Code and with the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority on 10 June 2021.
Consent management
On first access to the website, a banner is shown allowing the user to accept or reject non-technical cookies, by category. Statistical and third-party cookies are installed only after the user has given express consent. Preferences can be changed or withdrawn at any time via the “Manage cookie consent” link available on the website.
Technical cookies (do not require consent)
Necessary for the website to function and to store the preferences expressed in the banner.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| cmplz_consent_status, cmplz_policy_id, cmplz_banner-status, cmplz_functional, cmplz_statistics, cmplz_marketing | Complianz (first party) | Store cookie consent preferences | 365 days |
| LiteSpeed Cache cookie | First party | Technical optimisation of page delivery | Session |
| WP Accessibility cookie | First party | Store accessibility preferences (contrast, text size) | Up to 365 days |
Statistical cookies (subject to consent)
The website uses Google Analytics 4, a traffic analysis service provided by Google LLC, integrated via the Site Kit by Google plugin. Data is collected in aggregate form to measure visits and use of the website. Google Analytics 4 does not store users’ IP addresses.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google LLC | Distinguishes users | 2 years |
| _ga_* | Google LLC | Maintains session state | 2 years |
Google’s privacy notice: https://policies.google.com/privacy. Opt-out component: https://tools.google.com/dlpage/gaoptout.
Third-party cookies (subject to consent)
Some pages embed third-party content and services which may install their own cookies. The processing of data collected by these parties is governed by their respective privacy notices:
| Service | Provider | Use on the website | Privacy notice |
|---|---|---|---|
| YouTube | Google LLC | Videos embedded in the pages | policies.google.com/privacy |
| Google Maps | Google LLC | Interactive maps showing the location of the shops | policies.google.com/privacy |
Managing cookies from the browser
Users can also manage or delete cookies through their browser settings:
- Chrome: support.google.com/chrome/answer/95647
- Firefox: support.mozilla.org
- Microsoft Edge: support.microsoft.com
- Safari: support.apple.com
- Opera: help.opera.com
12. Other third-party services
Google Fonts and Adobe Fonts
The website loads typefaces from the Google Fonts (Google LLC) and Adobe Fonts (Adobe Inc.) services. When requesting fonts, the user’s browser transmits the IP address and technical request data to the providers’ servers. The providers state that they do not use this data for profiling purposes. Privacy notices: Google, Adobe Fonts.
Weather widget
The weather forecasts for Ferrara shown on the website are obtained from the Open-Meteo service through calls made by the website’s server. No user data is transmitted to the provider.
Sharing buttons
The pages contain sharing links to Facebook and X (Twitter). These are simple links that do not install cookies while browsing: only by clicking the link is the user directed to the external platform, whose processing is governed by its own privacy notice.
Videos of the shops
The videos featured on the shop pages are hosted directly on the website’s servers and do not involve any transmission of data to third parties.
13. Updates
This notice may be updated to reflect regulatory changes or changes to the services used by the website. Users are invited to consult it periodically.
Last updated: 23 September 2026
