Privacy Policy

1. Data controller

The controller for the personal data collected through the Site is the AFplanner operator, who can be reached at AFplanner1@gmail.com. You can write to this address for any request concerning the processing of your personal data.

2. Categories of data processed

• Browsing data: during normal use of the Site, the computer systems and software procedures used to operate it (in particular our hosting provider, Vercel Inc.) acquire certain personal data whose transmission is implicit in the use of Internet communication protocols, such as IP address, browser and device type, operating system, requested pages, date and time of the request, and other parameters relating to the user's operating system.
• Data collected through cookies and similar technologies: online identifiers, consent preferences and, where consented to, data used for advertising personalisation and for tracking affiliate links. The full list and the related purposes are described in our Cookie Policy, which forms an integral part of this notice.
• Data voluntarily provided by the user: when you use the trip planning form (e.g. destination, dates, number of travellers, budget, interests) or contact us by email, we process the data you voluntarily provide us with, to the extent necessary to respond to your request or to generate the requested results.

3. Purposes of processing and legal basis

We process your data for the following purposes:

• Providing the requested Service (e.g. generating the personalised travel dashboard) — legal basis: performance of pre-contractual measures taken at the data subject's request (Art. 6(1)(b) GDPR).
• Ensuring the security and correct technical functioning of the Site — legal basis: legitimate interest of the controller (Art. 6(1)(f) GDPR).
• Displaying advertising, including personalised advertising, via Google AdSense — legal basis: user consent (Art. 6(1)(a) GDPR), expressed through the cookie banner. Without consent, no personalised ads are shown.
• Measuring the outcome of affiliate links to our travel partners, from which we receive a commission in case of a booking — legal basis: user consent for the third-party cookies involved (Art. 6(1)(a) GDPR).
• Responding to contact requests — legal basis: performance of pre-contractual measures / legitimate interest in managing communication with users (Art. 6(1)(b) and 6(1)(f) GDPR).
• Complying with legal obligations, where applicable — legal basis: Art. 6(1)(c) GDPR.

4. Nature of providing the data

Providing browsing data is technically necessary to use the Site. Providing data through the form (where available) and accepting non-essential cookies are optional: refusal only results in the inability to use specific features (e.g. the personalised dashboard) or to see personalised advertising, without affecting normal browsing of the Site.

5. Data recipients and transfers outside the EU

We do not sell or share your personal data with third parties for their own marketing purposes. For the purposes described above, the data may be processed by the following parties, acting as independent controllers or as processors depending on the case:

• Vercel Inc. — hosting provider for the Site
• Google Ireland Limited / Google LLC (Google AdSense) — advertising
• Travelpayouts and the partners accessible through its network (including Skyscanner, Hotellook, travel insurance and car rental providers)
• Booking.com B.V. — accommodation affiliate programme
• GetYourGuide AG / Viator (TripAdvisor) — experiences affiliate programmes
• DiscoverCars — car rental affiliate programme

Some of these parties are based outside the European Economic Area (in particular in the United States). In such cases, the data transfer takes place on the basis of adequate safeguards provided for by the GDPR, such as the Standard Contractual Clauses approved by the European Commission and/or the recipient's adherence to recognised adequacy frameworks (e.g. the EU-U.S. Data Privacy Framework). For more information on the safeguards adopted by each provider, please refer to their respective privacy notices.

When you click on an affiliate link you leave the Site and access the partner's website, which processes your data as an independent controller under its own privacy notice, separate from ours.

6. Retention period

• Technical browsing data (access logs) is kept for the time strictly necessary to ensure the security of the Site, and in any case no longer than 6 months, except for proven needs related to the investigation of crimes or upon request by the Judicial Authority, in line with the guidance of the Italian Data Protection Authority (Garante).
• Data collected through cookies is kept for the period indicated in our Cookie Policy, and in any case no longer than 12 months from when it was set, unless consent is renewed.
• Data voluntarily provided through the form or by email is kept for the time necessary to handle the request and, afterwards, for the time provided by law to manage any disputes.

7. Rights of the data subject

As a data subject, under Articles 15-22 of the GDPR, you have the right to:

• obtain confirmation that processing is taking place and access your data (right of access, Art. 15);
• obtain rectification of inaccurate data or the completion of incomplete data (Art. 16);
• obtain erasure of your data, in the cases provided for by law (right to be forgotten, Art. 17);
• obtain restriction of processing (Art. 18);
• receive, in a structured and readable format, the data you have provided us with, or request its transmission to another controller (right to data portability, Art. 20);
• object at any time to processing based on legitimate interest (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing based on consent given before the withdrawal (Art. 7(3));
• lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it), or with the supervisory authority of your EU member state of residence.

You can exercise these rights at any time by writing to AFplanner1@gmail.com. We will respond to your request without undue delay and in any case within one month, as required by the GDPR.

8. Automated decision-making and profiling

The Site does not carry out processing based solely on automated decision-making that produces legal effects significantly affecting the data subject, within the meaning of Art. 22 GDPR. The personalised advertising shown (if you have given consent) is based on profiling for advertising purposes managed by Google according to its own policies, which can be disabled at any time through the cookie banner or Google's ad settings.

9. Minors

The Site is not directed at children under 16 and we do not knowingly collect personal data from minors. If a parent or guardian becomes aware that a minor has provided us with personal data without their consent, they can contact us to request its deletion.

10. Changes to this notice

We reserve the right to modify or simply update this notice, in whole or in part, including as a result of regulatory changes. We invite you to periodically check this page, verifying the last-updated date shown at the top.