Privacy & Cookie policy
Home »
Privacy and Cookie Policy
Version 1.1 — June 2026
1. Data controller
The Data Controller of personal data collected through the VisitBrembo.it portal is:
VisitBrembo Association
Via A. Locatelli, 111
C.F.: 95237460167
VAT: IT04659680161
Email: info@visitbrembo.it
For any inquiries regarding the processing of personal data, you can contact the Controller at the above addresses.
2. Data collected and purpose of processing
The VisitBrembo.co.uk portal collects personal data under the following circumstances:
2.1 Site navigation (technical data)
During browsing, technical data such as IP address, browser type, operating system, pages visited and access times are automatically recorded by the servers. This data is processed exclusively for security purposes, technical diagnostics and aggregate traffic analysis. They are not associated with identified individuals.
Legal basis: legitimate interest of the Owner (Art. 6, par. 1, lett. f GDPR).
2.2 Contact form
Through the contact form, name, email address and the text of the message are collected. The data are used only to respond to the request received and are not kept beyond the time necessary to handle the communication.
Legal basis: execution of pre-contractual measures or consent of the interested party (art. 6, par. 1, letter b/a GDPR).
2.3 Newsletter subscription
Those who choose to subscribe to the newsletter provide their email address. This data is processed for the purpose of sending informative and promotional communications related to the Valle Brembana (events, itineraries, initiatives). The service is managed through Brief (Sendinblue SAS, France), which operates as the controller. The data is stored on servers located in the European Union.
Legal basis: consent of the data subject (Art. 6, para. 1, letter a GDPR), revocable at any time via the unsubscribe link present in every email.
2.4 AI Chatbot
The portal provides an artificial intelligence-based virtual assistant to guide visitors in discovering the area. Typed questions are transmitted to a processing server and processed via third-party APIs (OpenAI). The messages are not associated with the user’s identity and are not stored in a nominative form. It is recommended not to enter sensitive personal data into the chatbot.
Legal basis: Legitimate interest of the Controller/expressed consent during use (Art. 6(1)(f/a GDPR).
3. Statistical analysis of the site
The site uses Google Analytics (Google LLC) to collect anonymous and aggregated data on the use of the portal (pages visited, duration of sessions, approximate geographic origin). Tracking takes place only with the explicit consent of the user via the cookie banner. Google Analytics is configured with IP address anonymization. For more information: policies.google.com/privacy.
4. Data Retention.
Personal data are kept for the time strictly necessary for the purposes for which they were collected:
- Navigation technical data: maximum 12 months.
- Contact form: until the closing of the application, but no later than 24 months.
- Newsletter: until the withdrawal of consent by the subscriber.
- Chatbot interactions: current session; no named retention beyond the session.
5. Sharing with third parties
Personal data is not sold or transferred to third parties for commercial purposes. It may be communicated only to the following entities, to the extent necessary for the provision of services:
- Brief (Sendinblue SAS, France) - newsletter management
- Google LLC - statistical analysis (Google Analytics)
- OpenAI LLC - processing requests to the chatbot
- Netsons Ltd. - portal technical infrastructure management
Where applicable, the transfer of data to non-EU countries is done on the basis of Standard Contractual Clauses approved by the European Commission, or other guarantee mechanisms provided by the GDPR.
6. Rights of the interested party
According to the Regulation (EU) 2016/679 (GDPR), every user has the right to:
- Access their personal data (art. 15);
- Obtain correction of inaccurate data (Art. 16);
- request the deletion of data (“right to be forgotten”) (art. 17);
- Request restriction of processing (Art. 18);
- Request data portability (Art. 20);
- object to the processing (art. 21);
- revoke consent at any time, without prejudice to the licentiousness of the processing based on the previously given consent.
Requests can be sent to the Data Controller at the address indicated in section 1. The Data Controller will respond within 30 days of receipt. In the event of an unsatisfactory response, you may file a complaint with the Data Protection Authority (garanteprivacy.co.uk).
7. Cookie Policy
7.1 What are cookies
Cookies are small text files that websites save in the user’s browser during navigation. They allow the site to remember the user’s preferences, analyze browsing behavior, and, in the case of third-party cookies, track activity across multiple sites.
7.2 Types of cookies used
Technical cookies (strictly necessary)
Essential for the operation of the site. Do not require consent. They include session management cookies, consent preferences, and site security.
Analytical cookies (with consent)
They allow us to measure the performance of the site and understand how users use it. They are activated only after explicit consent. The portal uses Google Analytics with IP anonymization.
Third-party cookies (with consent)
The site may include embedded content from external services (e.g. Google Maps, YouTube). These services may set their own cookies and are activated only after explicit consent.
List of cookies used on the site
Necessary cookies
| Cookie | Supplier | Purposes | Duration |
|---|---|---|---|
wordpress_logged_in_* | WordPress | User authentication after login. | Session / 14 days |
wordpress_sec_* | WordPress | Security verification of authentication. | Session / 14 days |
wordpress_test_cookie | WordPress | Check that the browser accepts cookies. | Session |
wp-settings-* | WordPress | Preferences of the administration interface. | 1 year |
wp-settings-time-* | WordPress | Timestamp of administration preferences. | 1 year |
PHPSESSID | PHP | Server session identifier. | Session |
occ_consent | VisitBrembo - Official Portal of the Brembana Valley | Stores the user's cookie consent choices. | 180 days |
Marketing cookies
| Cookie | Supplier | Purposes | Duration |
|---|---|---|---|
YSC | YouTube / Google | Registers a unique ID for the statistics of the videos viewed. | Session |
VISITOR_INFO1_LIVE | YouTube / Google | Estimate the user's bandwidth. | 6 months |
VISITOR_PRIVACY_METADATA | YouTube / Google | Stores the state of the consent for the current domain. | 6 months |
NID | Stores preferences and information for Maps and other Google services. | 6 months | |
CONSENT | State of the user's consent for Google services. | 2 years |
7.3 Consent management
Upon first accessing the site, a banner is displayed allowing the user to choose which categories of cookies to accept. Consent is optional for all non-technical categories. Users can change their preferences at any time via the button below or the link. Cookie management available in the footer of the site.
Gestisci preferenze cookie7.4 How to disable cookies
In addition to management via the banner, you can disable cookies directly from your browser settings. Disabling technical cookies may affect the proper functioning of the site.
8. Data security
The portal takes appropriate technical and organizational measures to protect personal data from unauthorized access, loss, destruction, or accidental disclosure. Among the measures taken: encrypted connection (HTTPS / SSL), application firewall (WAF), protection against brute-force attacks.
9. Updates to this policy
The Owner reserves the right to update this policy in the event of changes in regulations, technology, or in the services offered. The updated version will always be available at this URL. In case of substantial changes, registered users (newsletter subscribers) will be notified accordingly.
Last revision: June 29, 2026