Privacy

Who is responsible

The data controller for personal data collected through this website (atlanteitalia.it) is Andrea Casale. For privacy questions or to exercise your rights, write to [email protected]. No data protection officer (DPO) has been appointed, as one is not required for a site like this.

At a glance

What	Which data	Why, and legal basis	How long
Visiting the site (Cloudflare and server logs)	IP address, date and time, address requested, browser (user agent) and other technical request data	delivering pages, security and operation; legitimate interests (Art. 6(1)(f) GDPR)	14 days in our logs
Statistics with Google Analytics 4	random identifier in cookies, pages viewed and interactions, device, approximate location	visitor statistics; consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code)	cookies up to 2 years; data in Google Analytics 14 months
Preferences and saved places	language, saved places, cookie choice	making the features you ask for work; strictly necessary storage, no consent needed (Art. 122(1) Italian Privacy Code)	on your device until you delete them (cookie choice: 6 months)
Emails you send us	email address, name if you give it, message	replying to you; legitimate interests (Art. 6(1)(f) GDPR)	as long as needed to deal with your request
Location for “Near me”	your device's coordinates	working out distances in your browser, only when you ask	we neither receive nor keep it (two exceptions below)

You do not need an account or to give us any personal data to use the site, and rejecting statistics does not limit any feature. We do not sell or share data with anyone, we do no profiling and we make no automated decisions.

Server and logs

The site is made of static pages served from a virtual private server (VPS) run by Contabo GmbH in a data centre in the European Union (Germany), using the nginx web server. Contabo provides the infrastructure and acts as our processor (Art. 28 GDPR).

Like any web server, nginx logs each request with the IP address, date and time, the address requested (including any parameters after the “?”), the response status, the referring page and the browser's user agent. We use these logs only for security, for example to spot abuse and attacks, and to fix problems: never to profile visitors. We keep them for 14 days, after which they are deleted automatically, unless they are needed to investigate an ongoing attack. Legal basis: our legitimate interest in protecting the site and keeping it running (Art. 6(1)(f) GDPR).

The HTTPS certificate is issued by Let's Encrypt, which receives no data about your visits.

Cloudflare: DNS, network and security

Between your browser and our server sits Cloudflare, Inc., which runs the domain's DNS and acts as a content delivery network (CDN) and security proxy. Every request to the site goes through its servers first, which receive your IP address and the technical data of the request (address requested, date and time, HTTP headers such as browser and language) in order to deliver pages faster and block attacks and abusive traffic. Cloudflare acts as our processor. If its bot protection requires it, it may set strictly necessary security cookies (see the cookie table).

Cloudflare is based in the United States, so data may also be processed outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023, and also relies on standard contractual clauses. Legal basis: our legitimate interest in protecting the site and making it fast (Art. 6(1)(f) GDPR).

Domain and email

The atlanteitalia.it domain is registered through Register S.p.A. (register.it), based in Italy, which receives no data about your visits. The [email protected] address is not a mailbox of its own: Cloudflare (Email Routing service) forwards messages to the controller's Gmail mailbox, provided by Google, where they are stored. Google may also process data in the United States and is certified under the EU-U.S. Data Privacy Framework.

If you write to us

If you write to [email protected], we process your email address, your name if you give it and the content of your message only to reply and, if you report a mistake, to fix the site. Legal basis: our legitimate interest in replying to people who contact us (Art. 6(1)(f) GDPR). We keep messages for as long as needed to deal with your request and any follow-up, then delete them. We never use your address for newsletters or other mailings.

Cookies and browser storage

The site only uses strictly necessary storage for features you ask for, which needs no consent (Art. 122(1) of the Italian Privacy Code), plus Google Analytics cookies, which are set only if you accept statistics. Before you choose, or if you reject, the Google script is not loaded and your browser does not contact Google.

Open cookie preferences

Name	Type	Purpose	Duration
ls_lang, ls_lang_it, ls_lang_en	strictly necessary cookies	remember the language you picked with the IT | EN switch, so the home page takes you to the right version	1 year
ls:lang	local storage (localStorage)	the same language preference	until you delete it
ls:saved	local storage (localStorage)	the places you save, which are also used for the itinerary	until you delete them
ls:consent	local storage (localStorage)	your choice about statistics and its date	6 months, then we ask again
ofm-tiles-v1, ofm-meta-v1	browser cache (service worker)	copies of map tiles you have already seen	until you clear the site's data (up to about 4,000 tiles)
__cf_bm, cf_clearance	Cloudflare security cookies, only if its bot protection is triggered	tell people from bots and protect the site	usually 30 minutes
_ga, _ga_<ID>	Google Analytics cookies, only with consent	tell visitors apart with a random identifier and keep track of the session	up to 2 years

Data in local storage and in the cache never leaves your device. Cookies, as always, travel with requests to the site (and therefore through Cloudflare), but we do not record them in our logs. You can delete everything at any time in your browser settings (site data), and saved places also from the Saved page. If you use “Share”, the link you send contains only the identifiers of the places you picked.

Statistics: Google Analytics 4

If you click “Accept”, we use Google Analytics 4, a service provided by Google Ireland Limited (Ireland), to count visits and see which pages and features are useful. Google processes this data on our behalf, as our processor.

• Data collected: pages visited and some interactions (for example scrolling, clicks on external links and searches made on the site), the referring site, device type, operating system, browser, language, screen resolution, approximate location (country, region, city) derived from your IP address, and a random identifier stored in the _ga and _ga_<ID> cookies.
• IP address: according to Google, Google Analytics 4 does not log or store IP addresses; it only uses them to work out approximate location.
• No advertising: Google Signals and ad personalisation are turned off. We do not use this data for advertising and we do not combine it with other information about you.
• Retention: the cookies last up to 2 years (the expiry is renewed on each visit); in Google Analytics, user-level and event-level data is deleted after 14 months. Only aggregated reports remain.
• Transfers outside the EU: Google may also process data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission found adequate in its decision of 10 July 2023; Google also relies on standard contractual clauses for transfers.
• Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). If you reject, you can use the site exactly as before.
• Withdrawing consent: at any time from “Cookie preferences” at the bottom of every page. If you choose “Reject”, we delete the site's _ga cookies and the Google script is no longer loaded. Withdrawal does not affect the lawfulness of what was collected before.

Find out more: Google's privacy policy and how Google uses information from sites that use its services.

Maps

Maps use vector tiles from OpenFreeMap (data © OpenStreetMap). Your browser does not contact OpenFreeMap directly: it requests the tiles from our site at /tiles/ (through Cloudflare, like any other request), and our server fetches them from OpenFreeMap and passes them back. OpenFreeMap therefore sees our server, not your IP address. Like any other request, tile requests are recorded in the server logs (14 days) and show which area of the map you are looking at.

To make maps load faster, the first time you open a page with a map the site registers a service worker (sw-tiles.js) that keeps the tiles you have already seen in your browser's cache. They contain only map data, nothing about you, and stay on your device until you clear the site's data.

Photos from Wikimedia Commons

Place photos and thumbnails in results are loaded directly from Wikimedia Commons servers (upload.wikimedia.org), run by the Wikimedia Foundation, Inc., based in the United States. To show them, your browser connects to those servers, which receive your IP address, browser type and the image address, but not the exact page you are on (at most our site's name). To speed things up, pages open the connection to those servers in advance. The Wikimedia Foundation handles this data as an independent controller, including outside the EU, under its own privacy policy. Legal basis: our legitimate interest in showing photos of the places in line with their licences, without copying them to our servers (Art. 6(1)(f) GDPR).

Your location (“Near me”)

Near me, the location button on the map and starting an itinerary from where you are use your browser's geolocation only when you press the button and give permission. Your coordinates are used only in your browser to work out distances and routes: they are never sent to or stored on our server. You can withdraw permission in your browser settings.

Your location only leaves the browser in two cases, and only if you choose so:

• in “Near me”, the “See on the map” link puts the coordinates, rounded to about 10 metres, in the address of the map page: if you open it, that address is recorded in the server logs, kept for 14 days;
• in an itinerary that starts from your location, the “Google Maps” buttons pass the starting point to Google, which works out the route: when you open them, Google's privacy policy applies.

External links

Place pages link to official websites, Wikipedia, Wikidata, OpenStreetMap and navigation services. When you open them, those sites' privacy policies apply.

Who receives data

Apart from the controller, the following process data on our behalf as processors: Contabo GmbH (server), Cloudflare, Inc. (DNS, network, security and email forwarding) and, only with your consent, Google Ireland Limited (statistics). Messages you send us are stored in the controller's Gmail mailbox, provided by Google. The Wikimedia Foundation receives, as an independent controller, the technical data needed to show you photos. Nobody else receives your data, unless required by law.

Your rights

Under Articles 15 to 22 of the GDPR you can ask at any time for:

• access to your data and a copy of it (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17) and restriction of processing (Art. 18);
• portability of the data you have given us (Art. 20);
• to object to processing based on legitimate interests (Art. 21);
• to withdraw your consent to statistics, without affecting what happened before (Art. 7(3)).

We make no decisions based solely on automated processing and do no profiling (Art. 22). To exercise your rights, write to [email protected]: we reply within one month. Google Analytics data is linked only to a random identifier, so without further information we may be unable to match it to you (Art. 11 GDPR); data that stays in your browser never reaches us, and you can delete it yourself.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the supervisory authority of the EU country where you live or work (Art. 77).

Changes

If the way the site handles data changes, we will update this page and the date at the top; if a change needs your consent, we will ask you again. Last updated: 31 October 2026.