Notice under Articles 13 and 14 GDPR
This site collects very little. It sets no cookies, does not profile you and does not follow you around the web. Below you will find what we collect, why, how long we keep it and how to have it deleted.
What we collect
To see which pages are actually useful
To reply to you
To know which properties bring enquiries
Security and keeping the site up
This summary is here to orient you. The sections that follow are the full text and prevail in case of doubt.
The data controller is ONGLOW SRL, Italian VAT and tax number 02843500220, registered office at Viale Prati 33, 38066 Riva del Garda (TN), Italy.
For any question about this notice, or to exercise your rights, write to admin@onglow.it.
We have not appointed a Data Protection Officer: we do not fall within the cases where Article 37 GDPR makes it mandatory.
This page covers the onglow.it website in its three versions (Italian, English, German) and the tracking.onglow.it address, which is what opens when you scan an OnGLOW QR code at a partner property.
It does not cover the OnGLOW app, which has its own privacy policy. It does not cover what hotels, properties and practitioners do with data on their own account: that is their responsibility.
To understand how the site is used we rely on Umami Cloud, an analytics service that sets no cookies and stores nothing on your device.
What is collected: the page you open and its title, the site you came from, your browser language, your screen resolution, the type of device, browser and operating system, and your country. Your IP address is used by the provider only to derive the country and is not stored.
We also record a few actions, without linking them to your identity: clicks on the WhatsApp buttons, clicks on the email address, language switches and the outcome of a contact form submission.
Legal basis: our legitimate interest in knowing whether the site works and what visitors care about (Article 6(1)(f) GDPR). Since we use no cookies and no other identifiers stored on your device, we do not ask for consent and you will not see a banner.
The provider is Umami Software, Inc., acting as our processor. We do not profile you, we do not track you across other sites, and we never combine these statistics with what you send us through the form.
If you write to us through the form we collect your name, email address and the text of your message. Along with the message we record the date, time and IP address: this is how we can demonstrate that consent was given, as Article 7 GDPR requires.
Purpose: to reply to you. Nothing else.
Legal basis: your consent (Article 6(1)(a)) and steps taken at your request prior to entering into a contract (Article 6(1)(b)).
Providing the data is optional, but without a name, an email address and a message we cannot answer you.
Retention: 24 months from our last exchange, then we delete it. If you become a client, data connected to the service follows the periods set by tax and civil law obligations.
We will not use your address for newsletters, offers or promotional messages.
The message goes through the website, hosted by Cloudflare, and the email service Resend delivers it to our mailbox (OVHcloud). They act as processors on our behalf. Where their servers are is explained further down, under transfers outside the European Union.
OnGLOW QR codes displayed at partner properties do not point straight to WhatsApp: they go through tracking.onglow.it, which records the scan and redirects you immediately afterwards.
For each scan we store: the property code, the device type (iOS, Android or other), the browser string, the date and time, and a truncated IP address. For IPv4 we zero out the last number, for IPv6 we keep only the prefix; reduced like this, the address cannot be traced back to you.
Purpose: to know which properties generate enquiries, so we know where it makes sense to be present. We count scans, not people.
Legal basis: our legitimate interest in measuring how well our printed materials work (Article 6(1)(f)).
Retention: 24 months. No cookies are involved.
The WhatsApp buttons open a conversation with our number, with a message already drafted that you can edit or delete before sending.
From that moment we can see your phone number, the name set on your WhatsApp profile and whatever you write to us. We use it to reply and to organise the service.
The conversation also goes through Meta Platforms Ireland Limited, which handles WhatsApp data as an independent controller under its own privacy policy. We have no control over that part: if you would rather avoid it, use the contact form or email us.
Retention: we keep the conversation for as long as it takes to handle your request and, if you become a client, for the periods required by law.
Like every website, the server automatically records the requests it receives: IP address, date and time, the page requested, the outcome and the browser type. This is what keeps the site running and makes attacks or abuse visible.
Legal basis: our legitimate interest in the security and continuity of the service (Article 6(1)(f)).
Retention: a short period, normally within 30 days, plus whatever time is needed to investigate abuse or defend a legal claim.
The website and tracking.onglow.it are hosted by Cloudflare, which answers each request from its data centre closest to you. The address onglow.it without “www” is handled by GitHub, which only sends you on to www.onglow.it.
Your data stays between us and the providers we need to run the site. They are appointed as processors and handle data only on our instructions.
Hosts the website, the form and tracking.onglow.it, with the QR scan database in Western Europe.
Delivers the form emails to our mailbox.
Sends visitors of onglow.it without “www” on to www.onglow.it.
The mailbox that receives enquiries. Servers in the European Union.
Visit statistics, without cookies and without storing your IP.
Beyond them, data may be disclosed to public authorities where the law requires it, and to our advisers where needed to defend a legal claim.
We do not sell your data and we do not pass it to third parties for marketing.
The mailbox is on servers in the European Union. The QR scan database sits in a data centre in Western Europe.
Cloudflare, Resend and GitHub are US companies: requests to the site may pass through servers outside the European Union, and some data, such as the IP address recorded in logs, may be processed in the United States. All three companies participate in the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (Article 45 GDPR). Where needed, the Standard Contractual Clauses (Article 46) apply as well.
The analytics service is provided by a US company and, depending on the service region, data may also be processed outside the European Union. Where that happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR).
The same applies to WhatsApp, if you choose to write to us there: that processing follows Meta's privacy policy.
At any time you can ask us for the following.
Find out what data we hold about you and get a copy of it.
Correct it if it is wrong or incomplete.
Have it deleted.
Freeze its use while a dispute is open.
Receive it in a machine-readable format or have it sent to another controller.
Object to processing based on legitimate interest, visit statistics included.
Where processing is based on consent, you can withdraw it at any time: withdrawal applies going forward and does not make earlier processing unlawful.
Write to admin@onglow.it. We reply within one month, as Article 12 GDPR provides. There is no charge, unless a request is manifestly unfounded or repetitive.
Write to us first: most of the time it takes two messages to sort out.
You also have the right to lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, garanteprivacy.it, or with the supervisory authority of the country where you live, or to go to court.
The OnGLOW site and services are intended for adults. We do not knowingly collect data from children under 14, the age set by Italian law (Article 2-quinquies of the Italian Privacy Code, implementing Article 8 GDPR).
If you believe a child has sent us personal data, write to us and we will delete it right away.
We take no automated decisions about you and we do not carry out profiling: no algorithm decides on our behalf whether or how to reply to you.
If we change the services we use or the purposes of processing, we update this page and the date shown at the top. When a change is substantial, we also flag it on the site.
The OnGLOW app has its own privacy policy: the one you are reading does not cover it.