Legal
Privacy & Cookie Policy
1. Data controller
The data controller for personal data collected through italian taste map. (https://www.italiantastemap.com) is:
TOYOU S.r.l. (legal entity name)
Via [address], [ZIP] [City], Italy
VAT: [number]
E-mail: privacy@italiantastemap.com
⚠ Update with final legal details before public launch.
2. Data collected and purposes
2.1 Account registration
To access gated features (producer contacts, favourites, listing claim) we collect:
- Email address — used to send a one-time magic-link sign-in email. Never published publicly.
- Country — selected by the user at registration.
- Persona (discover / trip / trade) — optional, to tailor content.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract (providing the requested service).
2.2 Session cookie
After sign-in we set an itm_session httpOnly cookie containing a signed JWT. It is strictly necessary for authentication and is removed on sign-out. No consent is required for this cookie.
2.3 Analytics cookies (optional)
With your consent we load Google Analytics 4 (Google LLC, USA) to measure aggregate, anonymised usage. GA4 sets _ga and _ga_* cookies for up to 2 years. You may withdraw consent at any time via the cookie banner.
Legal basis: Art. 6(1)(a) GDPR — explicit consent.
2.4 Producer contact reveals
When an authenticated user unlocks producer contact details we record an internal event (contact type, producer, timestamp) for aggregate statistics and abuse prevention. This is not linked to any publicly disclosed identifier.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest (security and service integrity).
2.5 Listing claim requests
If you submit a claim request to manage a producer listing we collect: work email, role, and an optional note. Data is visible only to site administrators and is retained for 12 months after the request is closed.
2.6 Favourites
Favourites are stored against your account. The aggregate favourite count for each entity is public; your personal list is private.
3. Retention periods
| Data | Retention |
|---|---|
| Account (email, country, persona) | Until account deletion + 30 days |
itm_session cookie | Until sign-out (token expires after 30 days) |
| Contact reveal history | 12 months from event date |
| Claim requests | 12 months after closure |
| Google Analytics cookies | Up to 2 years (controlled by Google) |
4. Recipients and transfers
Your data is never sold. Sub-processors are:
- Hetzner Online GmbH (hosting, EU) — production infrastructure.
- Resend Inc. (magic-link email, USA) — transfer covered by EU Standard Contractual Clauses.
- Google LLC (Google Analytics, USA) — only with your consent; transfer covered by the EU-US Data Privacy Framework.
5. Your rights (GDPR Arts. 15-22)
You may exercise the following rights at any time:
- Access — receive a copy of data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — delete your account and associated data.
- Restriction — temporarily limit processing.
- Portability — receive your data in a structured format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — withdraw analytics cookie consent at any time via the cookie banner.
To exercise your rights contact us at privacy@italiantastemap.com. You also have the right to lodge a complaint with the Italian data-protection authority (Garante Privacy) at garanteprivacy.it.
6. Cookies — summary
| Name | Type | Duration | Purpose |
|---|---|---|---|
itm_session | Strictly necessary | Session / 30 days | Authentication |
_ga | Analytics (consent) | 2 years | Google Analytics session ID |
_ga_* | Analytics (consent) | 2 years | Google Analytics session |
You can manage cookie preferences at any time via the banner shown on first visit, or by clearing cookies in your browser settings.
7. Updates
This policy may be updated as the service or applicable law changes. The date of the latest revision is shown below.
Last updated: July 2026