Privacy and cookies

1. Data controller

2. Scope of this notice

Beaches in Sardinia is a photographic catalogue of beaches and coastal places. The intended public domain is beachesinsardinia.com; beachesinsardinia.it and beachofsardinia.com are intended to redirect to the main website. The catalogue has no visitor accounts, purchases or newsletter subscriptions.

3. Data processed and catalogue operation

Browsing transmits technical data: IP address, date and time, requested URL, browser and device information, referring page when transmitted and request outcome. The host may record these in access and security logs.

Search and filters run in your browser; selections are kept in the page URL so results can be shared. When you open or reload that URL, its parameters may appear in server logs. The catalogue does not request your device’s GPS location.

If you write to the listed addresses, the controller receives your email address, message and any data or attachments you provide. They are used to manage the correspondence and answer your enquiry.

4. Purposes and legal bases

This draft proposes legitimate interests in providing and protecting the catalogue for necessary technical processing (GDPR Article 6(1)(f)), to be documented through a balancing assessment of visitors’ rights. Replies to enquiries rely on pre-contractual steps requested by the individual where applicable (point (b)), or legitimate interests in handling enquiries (point (f)). Mandatory legal duties rely on point (c).

Necessary technical data allow pages to load. Sending email is optional; without the information needed to reply we may be unable to handle an enquiry. The catalogue does not carry out profiling or automated decisions with legal effects.

5. OpenStreetMap map

The map loads when you enable it or open a link with the map already enabled. Map image requests reach OpenStreetMap Foundation and its infrastructure, transmitting your IP address and technical request data. You can browse the photographic catalogue without opening the map.

OpenStreetMap Foundation privacy policy ↗

6. Cookies and other technologies

The first-party necessary cookie bis_consent remembers acceptance or refusal, the choice version and dates for six calendar months. It is needed to respect your preference and is not used for advertising or statistics. Language and filters remain in URLs, without localStorage. Only after consent may Google Analytics set _ga and _ga_ELK29WKM5C to distinguish browsers and sessions: the code sets a 180-day lifetime without automatic renewal. Your browser may shorten it.

You can accept, decline or customize in the banner. Closing it with X means declining. Cookie preferences in the footer lets you change your choice at any time. Declining leaves the whole catalogue available. Without a valid choice, the website code loads no Google scripts and sends no Analytics requests. Additional host cookies and services will also be checked before launch.

Optional statistics: Google Analytics 4

Google Analytics 4, measurement ID G-ELK29WKM5C, is prepared on HTTPS beachesinsardinia.com to measure visits, language, filter and map use, pagination and clicks to articles and the magazine. It activates only with consent (GDPR Article 6(1)(a) and applicable cookie rules). Data may include pseudonymous browser identifiers, technical information, visited pages and interactions. Requests reach Google; these data are not necessarily anonymous. Previews on other domains do not send these statistics.

Catalogue events do not include typed search text; URLs sent by the code exclude query parameters and fragments. The code disables Google Signals and advertising personalization signals. Enhanced measurement must be disabled in the GA4 stream before launch, because the website already records pages and interactions and should not add automatic search tracking. The actual Google property settings remain to be verified.

To withdraw consent, open Cookie preferences and switch off statistics or select Decline. The website deletes accessible Analytics cookies and reloads the page to stop subsequent collection. Withdrawal does not automatically erase data already collected; contact the controller to exercise your rights. GA4 property data retention, separate from cookie lifetimes, must be confirmed and stated in the final notice.

Google privacy policy ↗

7. Recipients and service providers

Data may be processed by the controller’s authorised staff and providers needed for the service, under appropriate roles and agreements. SiteGround is the planned launch host: the contracting entity, data processing agreement, server location and any CDN services will be checked in the account before activation. Email and certified-email providers must also be identified in the final notice.

For Google Analytics, the contracting entity, processing terms, sharing and retention settings and any safeguards for transfers outside the EEA must be confirmed in the account. Having the code available does not mean those checks have been completed.

SiteGround terms and agreements ↗

Google Analytics processing terms ↗

8. Possible transfers outside the EEA

Map imagery may be distributed by a global server network. Before launch, actual transfers by the selected services and applicable safeguards under GDPR Chapter V will be identified. This notice does not state that all data remain in the European Union. For the preview platform, see the transfer information in its privacy policy.

9. Data retention

Retention must match the purpose of each processing activity. SiteGround documentation says ordinary access logs from the previous 30 days are available: this does not confirm all security-log, CDN or backup retention periods in the selected plan. Actual host and provider retention periods remain to be checked before launch.

For email enquiries, the controller must set the period after an enquiry is closed, distinguishing simple information requests from contractual records and legal duties. This draft does not assign a period already approved. Any retention for disputes will concern necessary data for a period tied to the specific dispute.

SiteGround log documentation ↗

10. Your rights and contact details

Where applicable under the GDPR, you may request access, rectification, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw any consent without affecting the lawfulness of earlier processing. You may also complain to the Italian data protection authority or your competent supervisory authority.

Send requests to the controller’s contact addresses above. You do not need to include an identity document with an initial request; if there are doubts about identity, only necessary additional information may be requested.

Italian data protection authority ↗

11. Links to articles and the magazine

Place and magazine links open sardiniamagazine.com. Its pages and any embedded services have a separate configuration from this catalogue; see the notices on that website. Catalogue photographs are served by its host, rather than loaded from external articles.

Checks to complete before launch

Confirm the SiteGround agreement and any processors; identify email and certified-email providers; check cookies and network requests on the public site; set and apply retention periods; document legal bases and any transfers; align all four translations with the final notice. Until then, this notice remains a draft.