Privacy policy

VACANTO S.r.l.
Viale G. Marconi 472, 47521 Cesena (FC), Italy
VAT/tax code 04817450408
Email: info@vacanto.it · PEC: vacanto@pec.it

Please use these contact details for any questions about data protection.

The website is provided via the Lovable platform and delivered through the Cloudflare network. When a page is requested, the technically necessary connection data is processed:

• IP address, date and time of the request
• requested address and previous page (referrer)
• browser, operating system and language settings

Purpose: delivering the pages, stability, protection against misuse and automated attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Recipients: the providers named above as technical service providers. The data is kept for as long as necessary for these purposes; retention periods depend on the providers’ settings.

When delivering each page, the hosting platform (Lovable) automatically adds two scripts of its own (/~flock.js and /__l5e/…). They are not part of this website’s code, and the website’s code cannot switch them off. According to the platform’s documentation, visitor statistics can be disabled in the project settings.

Based on our technical review of 30 October 2026, the following happens as soon as a page first loads, without any interaction:

• /~flock.js sets the cookie “session-id” (random identifier, 30 minutes) and, for every page viewed, sends the full page address (including any parameters, such as campaign parameters), the referring page (referrer), the browser’s user agent, the browser language and a country derived from the time zone
• /__l5e/… sends the pages viewed, time on page, load-time measurements (web vitals) and technical errors, together with a visit identifier held only in the page’s memory; it does not store data in the browser

No content from contact form fields was transmitted during the review, and session recording (session replay) was not active. The data is sent to addresses on the vacanto.it domain that are operated by the platform, and is used for visitor statistics and technical monitoring of the website. In the data processing agreement published by Lovable (version of 6 November 2025), the platform is named as processor; the same agreement allows it to also process log data and aggregated or de-identified data as an independent controller for analytics, security and product development, and refers to the standard contractual clauses for transfers outside the European Economic Area. The platform has not given us specific retention periods for this data. Legal basis stated for the processing: Art. 6(1)(f) GDPR. For the cookie, see the page “Cookies and local storage”.

If you contact us by email, PEC, phone or via the contact form, we process the details you provide: name, email address, message and – if provided – organisation, phone number and the place and dates of your project.

At present, the contact form does not send any data to a server. It prepares an email draft in your own email program, or a text you can copy; your enquiry only reaches us once you send it. Your email provider is responsible for sending it. Until then, your entries remain only in the page open in your browser and are not saved in browser storage.

Purpose: handling your enquiry and, where applicable, preparing a proposal. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and, for general enquiries, Art. 6(1)(f) GDPR (legitimate interest in responding). Recipients: our email service provider as processor. Retention: for as long as necessary to handle the enquiry. If a contract follows, the statutory retention obligations under Italian commercial and tax law apply.

Providing your data is voluntary; however, without your name, email address and message we cannot respond to your enquiry.

Through the “Events” pages you can apply as a food business (food chalets or winter garden bar), artist or operator of an attraction or stall for the events listed there, currently Milano Marittima - Christmas BOULEVARD 2026/2027, or apply to work in the VACANTO event team. Unlike the contact form, these applications are sent to a server and stored.

Event team applications: we process your first and last name, email, phone number, preferred activity areas and form of engagement, whether you are 18 or over (yes/no), the availability you give and – if provided – your introduction, experience and qualifications. Purpose: assessing the application and, where relevant, checking and agreeing the admissible form of engagement; legal basis: Art. 6(1)(b) GDPR (pre-contractual steps). We do not ask for CVs or documents. The applications are visible only to authorised VACANTO staff, separately from partner applications.

Data processed: details of your business and contact person (name, registered company name, address, country, VAT number or tax identifier, email, phone, website), your answers about your proposal (for example menu, prices, declared ingredients and allergens, equipment and technical requirements, availability, fees or proposed commercial model), attached files, the language chosen and the date of submission. We do not ask for identity documents, bank details or lists of named staff.

Purpose: assessing applications, selection and, if you are selected, written arrangements for your participation. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

Attached files are kept in non-public storage. Only authorised VACANTO staff can access them, through a restricted area with personal login and download links that are valid for 60 seconds. Files uploaded but not sent with an application are deleted automatically in the first scheduled clean-up once 24 hours have passed since upload.

After submitting, you receive a confirmation email with a copy of the information you sent and the file names; VACANTO receives an internal notification without attachments. To protect the form against abuse, we count requests per IP address: the address is not stored in plain text but as a hash value calculated with a secret value. It is only used for this count and is deleted in the scheduled clean-up, usually within a few hours.

Recipients: the providers of the database and file storage infrastructure and of the service that sends the confirmation emails, as processors. Retention: for as long as necessary for the selection and the organisation of the 2026/2027 edition; if a participation agreement follows, the statutory retention obligations under Italian civil and tax law apply.

Providing the details marked as required is necessary to assess your application. No automated decisions are made: the selection is carried out by people.

The website stores a few settings in your browser, such as your chosen language or appearance. These entries are not sent to us. Details are on the page “Cookies and local storage”.

Fonts and images are loaded from the website’s own server; no content from Google Fonts or other external servers is embedded. Links to other websites, such as EnjoyRomagna, only send data to the respective operator after you click them. Bookings via EnjoyRomagna are governed by the privacy policy published there.

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object to processing based on legitimate interests (Art. 15–21 GDPR). To exercise these rights, please use the contact details above.

You can also lodge a complaint with a data protection supervisory authority, in particular the Italian Garante per la protezione dei dati personali (https://www.garanteprivacy.it) or the authority in the country where you live or work.

No automated decision-making, including profiling, takes place.

We update this policy whenever the website or the services used change – for example, if the contact form sends enquiries via a server of its own in future.