Onagio S.p.A., Via Olivetti 42, 43121 Parma, Italy, is the data controller for this website and for the Onagio API. We are subject to the GDPR, because we are in Italy and because it applies to us. This page explains what we collect and why. It is deliberately short, because we collect very little.
What we collect
- Analytics. We run Google Analytics 4 to count visits and see which pages people read. It sets cookies and processes IP addresses. Legal basis: legitimate interest in knowing whether anyone reads this.
- Email. If you write to us, we keep the email, your address, and whatever you put in it, for as long as the conversation is useful and then for two more years because nobody deletes anything.
- Tour bookings. Name, email, party size, date. Deleted twelve months after the tour.
- API requests. We log the endpoint, timestamp, and response status for thirty days. We do not require an account and we do not log request bodies, because the API is read-only and there is nothing in a request body to log.
What we do not collect
We do not sell data. We do not run advertising pixels, retargeting, session recording, heatmaps, or fingerprinting. We do not have a newsletter, so we cannot add you to one. There is no login, so there are no passwords for us to store badly.
Who else sees it
Google (analytics), Netlify (hosting and request logs), and our email provider. That is the complete list. Netlify and Google may process data outside the EU under standard contractual clauses.
Your rights
Under the GDPR you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to processing. Write to privacy@onagio.com. We will answer within thirty days. You can also complain to the Garante per la protezione dei dati personali, the Italian supervisory authority, if you think we have handled something badly.
Cookies
Google Analytics cookies only. No preference cookies, because the language toggle keeps its state in memory and forgets it when you close the tab. This is arguably a bug, but it is a privacy-preserving one, so it stays.
Changes
If we change this policy we will change the date at the top. We do not maintain a version history, because in eight years we have changed it twice and both times it was a typo.