Privacy Policy

In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Version 2.2 — Effective August 4, 2026

Culturae Heritage Services srls (hereinafter, also referred to as the "Data Controller"), with its registered office at Via dei Banchi 6, 50123 Florence, Italy, VAT number IT07519170489, Tax ID 07519170489, REA FI-709102.

Privacy contact: [email protected]

The data controller has not appointed a Data Protection Officer (DPO) because it does not fall under any of the mandatory cases outlined in Article 37 of the GDPR (the data controller does not process large-scale processing of special categories of data, nor does it carry out systematic and extensive monitoring of individuals). For any requests related to the protection of personal data, you can write to the address indicated above.

This information describes how the Data Controller processes the personal data of users (hereinafter referred to as "User" or "Data Subject") who visit the gaudi.museum website (hereinafter referred to as the "Website") and other websites owned by the Data Controller, and who interact with them.

This information applies to all services provided through the website, including statistical analysis services, newsletter subscriptions, security and anti-abuse systems, and—when a contact form is available—the management of requests submitted through it. Non-essential technologies are activated only with the prior consent of the user, obtained through the consent management tool integrated into the website.

The website has an editorial and informational nature. The website operator is not a travel operator, a travel agency, or a travel intermediary in the sense of applicable regulations. For more details about the nature of the service, please refer to the Terms and Conditions of Use.

During normal operation, the computer systems and software procedures that run the website automatically collect certain data, the transmission of which is inherent to the use of internet communication protocols. This data includes: IP address, browser type and version, operating system, language, requested URLs, date and time of requests, HTTP method, server response code, and security events.

The personal data that the User voluntarily provides may include:

• Email address (for newsletter subscription);
• When the website makes a contact form available, the following information will be collected: name, email address, and the content of the message.
• any other information that the User chooses to provide voluntarily.

The website does not offer user registration and does not have a private area. No access credentials are collected.

The website uses a limited number of cookies and similar technologies (including local browser storage) to retain the user's consent preferences and—with prior consent—to measure website usage. For complete details, please refer to the Cookie Policy.

When the User expresses a choice through the consent management tool, the Controller retains proof of such choice (proof of consent) in accordance with Article 7.1 of the GDPR. The record contains: a randomly generated identifier stored on the User's device, the categories accepted or rejected, the version of this information that is current at that time, the page and language of the interaction, the browser's user agent, and a non-reversible cryptographic hash (SHA-256 with a secret salt) of the IP address. The IP address itself is not retained.

The website does not sell tours or experiences, and it does not handle bookings. When a user decides to book, they are redirected to the website of an independent partner, where the transaction is completed entirely outside of the website's systems.

The Data Controller does not collect, process, or store any payment data (card numbers, bank details, security codes). The Data Controller only receives aggregated and non-personal data from its partners regarding clicks and commissions.

When a User clicks on a link to a business partner, the Controller records the event on its own servers, before the User leaves the Website. The record contains: the page and language from which the click originated, the tour in question, the browser's user agent, a non-reversible cryptographic hash (SHA-256 with a secret salt) of the IP address, the randomly generated consent identifier if one exists, the consent categories that are active at that time, and the channel through which the User first accessed the Website. The IP address itself is not retained, and the record does not contain data that identifies the individual.

This record is maintained regardless of the user's choice regarding statistics. It is not used to track user behavior, but rather to compare the data held by the responsible party with the reports provided by partners who pay commissions, and to detect any anomalous or fraudulent activity. When a user has opted out of statistics tracking, the source channel is recorded with a generic value indicating that opt-out, and no cookies are read or written for this purpose.

If the User subscribes to the newsletter, the Data Controller collects their email address, the website they are visiting, the language they selected for the subscription, and the date of the subscription. Subscribing to the newsletter is optional and occurs only with the User's prior and explicit consent.

Address Confirmation (double opt-in). When this procedure is active, the subscription is not effective immediately: the Data Controller sends a single service message to the provided address, requesting confirmation that said address belongs to the person requesting the subscription. Only after this confirmation is the address added to the list and any sending begins. The Data Controller records the date, IP address, and browser of the confirmation, solely for the purpose of demonstrating that the consent came from the owner of the address (Article 7.1 of the GDPR). A subscription that never gets confirmed is deleted, along with all the data collected at the time of the request, after 90 days, and as long as no communication is sent to it.

In addition to this data, and solely for the purpose of demonstrating that consent was validly obtained (Article 7.1 of the GDPR), the data controller records the page from which the subscription was made, the IP address of the request, and the text of the information clause displayed at that time. IP addresses are deleted after 24 months, while the remaining data is retained for the same period as the subscription.

Withdrawal: The User can withdraw their consent to the newsletter at any time, with the same ease with which they gave it, by using the unsubscribe link included in each message received—a link that remains valid indefinitely, even in messages received a long time ago—or by writing to the Data Controller at the address indicated in section 1. Withdrawing consent results in the removal of the email address from the list and does not affect the legality of any processing that was carried out previously. The "Manage cookie preferences" control governs cookies and similar technologies, and does not affect the subscription to the newsletter: these are two distinct consents.

The transmission of navigation data is necessary for the technical operation of the website. Providing an email address for the newsletter or for a contact request is optional; without it, the website operator cannot send the newsletter or respond to the request.

Consent to the use of analytics technologies is entirely optional, and declining to provide consent will not affect your ability to browse the website or access its content in any way.

The data controller processes personal data for the purposes described below. Where indicated, the processing is carried out exclusively with the prior and explicit consent of the user.

The retention periods indicated are maximum reasonable durations and may be reduced in accordance with the principle of limitation of the retention period (Article 5.1.e of the GDPR).

When the processing of data is based on the legitimate interest of the data controller (Article 6.1.f of the GDPR), the controller has conducted a balancing test (Legitimate Interest Assessment – LIA) to ensure that its legitimate interest does not override the fundamental rights and freedoms of the data subjects. The user can request a copy of this assessment by contacting the individuals listed in section 1.

The website does not use advertising technologies, remarketing, or profiling. If such tools are introduced in the future, this information and the Cookie Policy will be updated in advance, and separate consent will be requested.

The website uses its own (first-party) consent management tool, which is compatible with Google Consent Mode v2, and allows the user to:

• accept, reject, or select specific categories of non-essential technologies;
• You can modify your preferences at any time using the "Manage cookie preferences" control, which is available in the footer of all pages.
• to understand that analytics technologies are only activated after valid consent has been obtained.

Pre-blocking: No essential technologies are activated on the User's device before the User has expressed their consent. In the absence of consent, only strictly necessary technologies remain active.

Withdrawal of Consent: The User can withdraw their consent at any time with the same ease with which they gave it, through the "Manage cookie preferences" control, without affecting the legality of the processing based on the consent given before the withdrawal (Article 7.3 of the GDPR).

Consent Duration: The choice expressed by the User remains valid for 6 months, after which they will be asked again. This period follows the most cautious recommendations from European regulatory authorities.

The personal data may be disclosed to the following parties, who act as data processors (Article 28 of the GDPR), either as independent controllers or as authorized individuals.

Infrastructure and hosting providers

• Hetzner Online GmbH — dedicated servers and application hosting, data center in Germany (EEA). Responsible for processing in accordance with Article 28 of the GDPR.
• Cloudflare, Inc. / Cloudflare Germany GmbH — content delivery network, DNS, protection against attacks and abuse, static website hosting, and object storage. Responsible for processing in accordance with Article 28 of the GDPR.

Communication providers

• Amazon Web Services EMEA SARL — Amazon SES and SNS for the newsletter and service emails, region eu-west-1 (Ireland, EEA). Responsible for processing in accordance with Article 28 of the GDPR.

Analytics providers (activated only with your consent)

• Google Ireland Ltd / Google LLC — Google Tag Manager and Google Analytics 4.

Business partners (independent representatives)

According to the content published on each website, the Website may link to the following partners for booking tours and experiences: Viator Inc. (Tripadvisor group), GetYourGuide Deutschland GmbH, Tiqets International B.V., Civitatis, Headout Inc.

When the User clicks on one of those links and leaves the Website, the processing of their personal data is governed exclusively by the privacy policy of the respective partner. The Data Controller does not have access to the data that the User provides on the partner's website.

Other recipients

• Legal, tax, and business advisors, acting either as designated representatives or as authorized individuals.
• Competent authorities, when required by law.

The company does not sell users' personal data.

Some providers, particularly those based in the United States, may involve the transfer of personal data to countries located outside the European Economic Area (EEA). In such cases, the data controller implements appropriate safeguards in accordance with Articles 44 and following of the GDPR, including:

• Standard Contractual Clauses (SCCs) of the European Commission (Article 46.2.c of the GDPR), and, when necessary, Data Transfer Impact Assessments (DTIAs) and supplementary measures in accordance with the EDPB Recommendations 01/2020;
• decisions on compliance issued by the European Commission, when available, including the EU-US Data Privacy Framework for certified entities;
• Additional technical and organizational measures (data minimization, pseudonymization, encryption in transit and at rest, and access segregation).

The providers that may be subject to data transfers outside the European Economic Area (EEA) are: Google LLC, Cloudflare, Inc., and Amazon Web Services, Inc. The application and newsletter service are hosted within the EEA.

The user can request information about the specific guarantees in place and a copy of the applicable Terms and Conditions by contacting the individuals listed in section 1.

The User may exercise the rights outlined in Articles 15 to 22 of the GDPR at any time:

• Right of access to personal data (Article 15);
• right to rectification and updating (article 16);
• the right to erasure, also known as the "right to be forgotten," where applicable (Article 17);
• right to restriction of processing (Article 18);
• the right to data portability, where applicable (Article 20);
• Right to object, particularly to processing based on legitimate interests (Article 21); in the event of an objection, the data controller will cease processing the data, unless they can demonstrate compelling legitimate grounds for doing so.
• the right not to be subject to decisions based solely on automated processing, including profiling (Article 22);
• The right to withdraw consent at any time, with the same ease with which it was given, without affecting the legality of any processing that was carried out before the withdrawal (Article 7.3).

To exercise your rights, please write to: [email protected]

The responsible party will, as a general rule, respond within a period of 1 month from the request. This timeframe may be extended up to 3 months in cases of particular complexity or a high volume of requests (Article 12 of the GDPR). In the event of an extension, the user will be informed within 1 month. The exercise of these rights is free of charge, except in cases where the requests are manifestly unfounded or excessive (Article 12.5 of the GDPR).

The Data Protection Officer does not carry out any decision-making process that is exclusively automated, including profiling, which produces legal effects on the User or which significantly affects them in a similar way (Article 22 of the GDPR). The analytical tools used by the Website serve only for aggregated statistical purposes and do not lead to automated individual decisions.

The User has the right to file a complaint with the competent supervisory authority. For Italy:

Data Protection Authority Piazza Venezia, 11 — 00187 Rome (RM), Italy Website: www.gpdp.it PEC: [email protected] Phone: (+39) 06 696771

Users residing in another member state can file a complaint with their own national supervisory authority. In Spain, the competent authority is the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6 — 28001 Madrid, www.aepd.es.

The Responsible party uses machine translation services and generative artificial intelligence tools in the production of the website's editorial content (tour descriptions, guides, articles). These tools only process editorial texts: no personal data of the Users is transmitted to them, and they are not involved in any of the processes described in this information.

This website is not intended for individuals under the age of 16. This age limit is a precautionary measure chosen by the data controller and aligns with the default age specified in Article 8.1 of the GDPR, and is higher than the fourteen years established for Italy by Article 2-quinquies of Legislative Decree 196/2003. The data controller does not intentionally collect personal data from minors. If a parent or guardian believes that data from a minor has been collected without the necessary consent, they can contact the data controller using the contact information provided in section 1 to request its prompt deletion.

The Data Protection Officer implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or alteration (Article 32 of the GDPR), including: encrypted communications (HTTPS/TLS), authenticated access with the principle of least privilege, protection of administrative interfaces behind an additional layer of authentication, one-way hashing of IP addresses in consent logs, regular backups, security updates, monitoring of access, and security incident management procedures.

The Data Protection Officer reserves the right to update this Privacy Policy at any time. Each version will be identified by a version number and an effective date, which will be indicated at the top of this page. Any significant changes will be communicated through a notice on the Website, and when the modification affects the categories of technologies subject to consent, consent will be requested again.

Previous versions of this information are retained by the responsible party and can be requested by writing to the contacts indicated in section 1.

This privacy policy is governed by Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy), Italian data protection legislation (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018), as well as the applicable resolutions and guidelines of the Garante per la Protezione dei Dati Personali and the Data Protection Commissioner.

For any dispute relating to the interpretation or application of this policy, the court of Florence shall have jurisdiction, unless mandatory consumer protection regulations specify otherwise.