PERSONAL DATA TREATMENT AND PROTECTION
Last updated: August 6, 2026
This privacy notice explains what personal data we collect through the portal www.dolomiti.it and related websites, why we process it, how long we retain it and what rights you can exercise. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
1. Who processes your data
Data Controller
DESTINATION S.r.l.
Registered office: Viale Amedeo Duca d'Aosta 76, 39100 Bolzano (BZ)
Operating office: Via Psaro 13, 32100 Belluno (BL)
VAT ID: 03027860216
Email: privacy@dolomiti.it
For any questions about this notice, to exercise your rights or for any matter relating to the processing of your personal data, you can write to privacy@dolomiti.it.
2. What data we process
We process only the data we need to provide the portal's services. Depending on how you use it, they may be:
- Data you provide to us: name, surname, email, telephone, language, data entered in forms for requesting information, making bookings, subscribing to the newsletter, requesting catalogues or registering for the restricted area.
- Data relating to your stay: location, dates, number and age of guests, travel preferences you indicate in search engines.
- Payment data: managed directly by the payment service provider. We do not retain full card numbers.
- Messages written in the virtual assistant: the text of questions you ask in chat and the answers received. See section 5.
- Data collected automatically during browsing: IP address, browser type and device, pages visited, date and time, referrer. See section 9 on cookies.
- Data of accommodation facility operators: for those accessing the restricted area for accommodation facilities, account data and content (texts and photographs) uploaded to their profile.
We do not ask for nor do we wish to receive special categories of data (Art. 9 GDPR): health, religious beliefs, political opinions and similar. We ask you not to enter them in forms or in the chat. If a particular need during your stay requires communicating health information, address it directly to the facility.
3. Why we process them, on what legal basis and for how long
| Purpose | Legal basis | Retention |
|---|---|---|
| Forward your request for information or quotation to the accommodation facility or entity you have chosen | Performance of pre-contractual measures requested by the data subject (Art. 6.1.b) | Until withdrawal of consent or request for deletion |
| Manage bookings, voucher and catalogue purchases, and related payments | Performance of contract (Art. 6.1.b) and legal tax and accounting obligations (Art. 6.1.c) | 10 years from accounting entry, for legal obligations |
| Manage your account and restricted area | Performance of contract (Art. 6.1.b) | Until account deletion or consent withdrawal |
| Answer questions posed to the portal's virtual assistant | Legitimate interest in providing assistance on portal content (Art. 6.1.f) | 90 days from conversation, then automatic deletion |
| Send newsletter and promotional communications about destinations, facilities, events and offers | Consent (Art. 6.1.a), revocable at any time | Until consent withdrawal or unsubscription |
| Verify and moderate content (texts and photographs) published by accommodation facilities | Performance of contract with the facility (Art. 6.1.b) and legitimate interest in maintaining the portal accurate and reliable (Art. 6.1.f) | 60 days from review |
| Ensure portal security, prevent abuse and fraudulent uses | Legitimate interest in system security (Art. 6.1.f) | 6 months, minimum period required for system administrator access logs by the Data Protection Authority provision of November 27, 2008 |
| Measure portal usage with statistical tools and, if you consent, personalise advertising | Consent for non-technical cookies (Art. 6.1.a and Art. 122 Legislative Decree 196/2003); legitimate interest for aggregate and anonymous statistics (Art. 6.1.f) | According to the duration of each cookie, indicated in the preferences panel |
| Establish, exercise or defend a right in court | Legitimate interest (Art. 6.1.f) | For the duration of the dispute and subsequent appeal periods |
Providing data marked as mandatory in forms is necessary to provide the requested service: without them, we cannot forward your request to the facility or complete the booking. Providing data for marketing purposes is always optional and refusal does not affect your use of the portal.
4. Who we share your data with
Your data is not sold to third parties. We share it only with those we need to provide the service:
- Accommodation facilities, businesses and tourism entities to which you direct a request for information or a booking. They receive the data as independent controllers, with the commitment to use it to respond to you; from that point the processing is governed by their privacy notice.
- Technology service providers who act as data processors on our instructions (Art. 28 GDPR): hosting and data storage, email and newsletter sending, payment management, statistical analysis tools, suppliers of artificial intelligence models described in section 5.
- Professionals and consultants (accountants, lawyers, auditors) within the scope of their respective assignments.
- Public authorities, when communication is required by law or requested by judicial authority.
The updated list of data processors is available upon request by writing to privacy@dolomiti.it.
5. Artificial intelligence tools
Some portal functions rely on artificial intelligence models. Below you will find what they do, what data passes through them and what the limitations are.
5.1 Virtual assistant (chat)
The portal provides a virtual assistant: when you open it, you are explicitly told that you are writing to an artificial intelligence system and not to a person.
- How it works: the text you write, previous conversation responses and the page you are visiting are transmitted to the model provider, which generates the response. The assistant can also search among portal content and verify facility availability for the dates you indicate.
- Model provider: Anthropic PBC (United States), which acts as a data processor based on an agreement pursuant to Art. 28 GDPR. See section 6 for transfers outside the European Union.
- Retention: conversations remain associated with your session, or with your account if you have logged in, for 90 days; afterwards they are automatically deleted.
- What not to do: do not enter your personal data or that of other people in the chat, and in no case data relating to health, identity documents or payment details. For these, use the dedicated forms or contact the facility directly.
- Response limitations: responses are generated automatically and may contain errors or outdated information. Prices, availability and stay conditions must always be confirmed with the facility before booking. The assistant does not conclude contracts and does not make decisions on your request.
5.2 Automatic translation of content
Editorial texts and facility profiles are translated into the portal's languages with the help of an artificial intelligence model, with review by the editorial team. Translation concerns published content, not personal data of visitors. In case of divergence between language versions, the Italian text prevails.
5.3 Automatic check of photographs uploaded by facilities
Images uploaded by accommodation facilities in the restricted area are automatically analysed to identify overlaid contact details, QR codes and content unsuitable for a photo gallery. The analysis produces only a notification: the decision to publish, edit or remove the image is always made by a member of the editorial team. Flagged images remain offline until verification and the facility is informed in the restricted area. This analysis also uses the provider indicated in section 5.1.
6. Transfers outside the European Union
Some of the providers indicated in section 4, including the artificial intelligence model provider, are based in the United States or may process data outside the European Economic Area. In these cases, the transfer always takes place on the basis of one of the guarantees provided by Chapter V of the GDPR:
- the adequacy decision of the European Commission of July 10, 2023 relating to the EU-U.S. Data Privacy Framework (EU Implementing Decision 2023/1795), for U.S. providers that have joined it (Art. 45 GDPR);
- the standard contractual clauses adopted by the European Commission with implementing decision (EU) 2021/914, for providers that do not join it, accompanied by the assessment of the impact of the transfer and any supplementary measures necessary (Art. 46.2.c GDPR).
For each provider, the applicable mechanism is identified and documented in our records of processing activities. You can ask which applies to a particular provider and obtain a copy of the guarantees adopted by writing to privacy@dolomiti.it.
7. Automated decision-making processes
We do not adopt decisions based solely on automated processing that produce legal effects on your account or affect your person in an analogously significant manner, pursuant to Art. 22 GDPR.
The order in which facilities and content appear in search results is determined by automatic criteria (relevance to the search, completeness and quality of the profile, availability in the requested period, facility subscription type). These are criteria of commercial visibility, not decisions about people.
If you consent to profiling cookies, the advertising content you see may be selected based on your browsing: you can withdraw consent at any time from the cookie preferences panel.
8. Your rights
At any time you can exercise the rights provided for in Articles 15-22 of the GDPR:
- Access: know if we process data concerning you and obtain a copy.
- Rectification: correct inaccurate data or complete incomplete data.
- Erasure: obtain removal of data, when no retention obligations exist.
- Restriction: ask that data be retained but not further processed.
- Portability: receive in structured and machine-readable format the data you provided to us, for processing based on consent or contract.
- Objection: object to processing based on legitimate interest and, in any case and without motivation, to direct marketing.
- Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise them, write to privacy@dolomiti.it. We will respond within one month of receipt of your request, extendable by two months in case of complex requests, informing you accordingly.
If you believe the processing of your data violates the regulations, you have the right to lodge a complaint with the Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or the supervisory authority of the country in which you reside, or to resort to the judicial authority.
9. Cookies and similar technologies
Cookies are small text files that the site saves on your device and reads on subsequent visits. The portal uses two types:
- Strictly necessary: make the site work — maintain the session, any access to the restricted area, the language and search preferences you entered, and memorise your choices about cookies. They do not require consent and cannot be disabled.
- Functionality: remember small display preferences, so as not to re-propose what you have already closed.
- Statistics: tell us how many people visit the portal and which pages they view, to understand what works and what doesn't.
- Marketing: measure the performance of advertising campaigns and allow us to show you ads in line with your interests, even on other sites.
For the categories of functionality, statistics and marketing we ask for your consent through the banner that appears on your first visit: you can accept all, refuse all or choose individually which ones to activate, and change your mind at any time.
On your first visit you are shown a banner that allows you to accept, refuse or choose which categories to activate. You can change your choice at any time from the cookie preferences panel, which opens with the link «Review cookies preferences» present at the bottom of every page of the site.
Below is the list of cookies used by the portal, with their purpose and duration.
Strictly necessary cookies (do not require consent)
| Cookie | Origin | Purpose | Duration |
|---|---|---|---|
| dolomiti_session | dolomiti.it (first party) | Maintains browsing session | 2 hours |
| XSRF-TOKEN | dolomiti.it (first party) | Protects forms from request forgery | 2 hours |
| remember_web_* | dolomiti.it (first party) | Maintains access to restricted area between visits | 1 year |
| cc_cookie | dolomiti.it (first party) | Stores your cookie choices | 6 months |
| sessionID | ads.dolomiti.it (our servers) | Technical session of the banner management system | Session |
Functionality cookies
| Cookie | Origin | Purpose | Duration |
|---|---|---|---|
| bs_widget_promotion | dolomiti.it (first party) | Remembers closing a promotional message, to not re-propose it on every page | 21 days |
Statistics cookies
| Cookie | Origin | Purpose | Duration |
|---|---|---|---|
| _pk_id.* | Matomo, hosted on our servers | Visitor identifier for usage statistics | 13 months |
| _pk_ses.* | Matomo, hosted on our servers | Identifies the individual visit | 30 minutes |
| _pk_ref.* | Matomo, hosted on our servers | Remembers which site you came from | 6 months |
| _ga | Google Analytics 4 — Google Ireland Ltd. | Distinguishes visitors | 13 months |
| _ga_6BN1H18KZ9 | Google Analytics 4 — Google Ireland Ltd. | Maintains the state of the analysis session | 13 months |
Profiling and advertising cookies
| Cookie | Origin | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads — Google Ireland Ltd. | Measures conversions generated by advertising campaigns | 90 days |
| _fbp | Meta Platforms Ireland Ltd. | Measures and personalises ads on Facebook and Instagram | 90 days |
| OAID | ads.dolomiti.it (our servers) | Identifier used for banner rotation and counting | 1 year |
| OACBLOCK, _OACBLOCK[*] | ads.dolomiti.it (our servers) | Prevents repeatedly showing you the same banner | 30 days |
| OASCCAP, _OASCCAP[*] | ads.dolomiti.it (our servers) | Limits the number of banner views in the same session | Session |
Usage statistics via Matomo and management of advertising banners occur on servers managed directly by us: for these purposes data is not transmitted to third-party providers.
Pages containing a video embedded from YouTube may install Google cookies when the video is played. The video is loaded only if you have accepted the relevant category.
To load and coordinate statistics and campaign measurement tools we use Google Tag Manager, a Google Ireland Ltd. service that does not itself install profiling cookies but manages the activation of the tools listed above.
You can also block or delete cookies from your browser settings. Disabling strictly necessary cookies may cause some portal functions to not work correctly.
10. Content published by users and facilities
The portal hosts content uploaded by third parties, particularly the profiles, texts and photographs of accommodation facilities. Information on prices, services and availability is provided by the facilities themselves, which are responsible for it. We are not responsible for user-generated content; if you believe that content is unlawful, inaccurate or harmful to your rights, report it to privacy@dolomiti.it and we will verify it.
11. Security
We adopt appropriate technical and organisational measures to protect data from unauthorised access, loss, alteration or disclosure, pursuant to Art. 32 GDPR. Access to data is permitted only to authorised and trained personnel, and to data processors within the scope of their assigned task.
12. Changes to this notice
We may update this notice to adapt it to changes in services or regulations. The current version is always published on this page with the date of last update. In case of substantial changes we will highlight them on the portal.