Privacy Policy

"Visit Filottrano" Website and Mobile Application

Last updated: October 19, 2026

This Privacy Policy describes how the website https://tdh.comune.filottrano.an.it/ (hereinafter, "Website") and the mobile application Visit Filottrano (hereinafter, "App") are managed, with specific reference to the processing of personal data of users who consult and use them.

This policy is provided pursuant to Art. 13 of EU Regulation 2016/679 (GDPR) and the applicable rules and guidelines for the distribution of mobile applications through the Google Play Store.

1. Data Controller

The Data Controller for the processing of personal data is:

• Entity/Controller: Horsa Link S.r.l.

• Address: Via A. D’Accorso, 29 62032 Camerino MC Italy

• Privacy contact email: info.horsalink@horsa.it

2. Types of Data Processed and Purposes of Processing

A. Navigation and Usage Data (Website and App)

The IT systems responsible for operating the Website and the App acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, request times, device parameters). Such data is used solely to obtain anonymous statistical information on service usage and to verify its proper operation.

B. Data Provided via API from the Web Portal to the App

The App interacts via API with the portal https://tdh.comune.filottrano.an.it/ to download and display cultural and tourist content (points of interest, events, routes). The App does not transmit user-identifying data to the portal during these API calls.

C. Geolocation Data (Foreground Location - Mobile App)

• Google Play Details and Requirements: The App collects and uses data regarding the geographic location (geolocation) of the user's device.

• Methods and Location: If the user enables geolocation permissions, the App can access location data only while the App is running (not in the background).

• Specific Purpose: Location access serves exclusively to enable the internal proximity notifications feature. These notifications alert visitors when they are in the immediate vicinity of a point of interest, monument, or event listed in the App.

• Non-sharing and Local Storage: Device location data is NOT saved on external servers, is NOT shared with other users or third parties, and is NOT used for profiling, continuous tracking, or data selling purposes. Location processing occurs entirely locally on the user's device.

3. Prominent Disclosure and Consent

In compliance with Google Play policies regarding User Data and Sensitive Data, the App requires explicit user consent prior to accessing geolocation data (foreground).

Users are informed in advance within the App via a screen or prominent disclosure message specifying the purposes of location usage. Users may enable, disable, or revoke geolocation permissions at any time directly from their mobile device settings without compromising general browsing of the App's content.

4. Legal Basis for Processing

• For geolocation data and notifications: the legal basis is user consent (Art. 6, para. 1, point a of the GDPR), expressed when requesting permissions in-app.

• For technical and operational data: the legal basis is the Controller's legitimate interest in ensuring the proper operation and security of the Website and the App (Art. 6, para. 1, point f of the GDPR).

5. Communication and Disclosure of Data

Collected data will not be disclosed, sold, or assigned to third parties for commercial or advertising purposes in any way. Data may be processed exclusively by authorized personnel or technical and technological service providers (e.g., App developers) appointed as Data Processors pursuant to Art. 28 of the GDPR.

6. Data Retention

Geolocation data is processed in real-time on the device and is not retained in remote databases. Technical system logs are retained strictly for the time necessary for security and control purposes.

7. Rights of Data Subjects

Users (data subjects) have the right to exercise at any time the rights provided for in Articles 15 et seq. of the GDPR, including:

• Requesting access to their personal data.

• Requesting the rectification or erasure of the data, or restricting or objecting to processing.

• Withdrawing previously granted consent for geolocation through the App settings or device operating system settings.

Requests should be addressed to the Data Controller via email at: info.horsalink@horsa.it. Users also have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).