Cookie Policy.

1. Controller and contact details

This notice covers www.residenceletortore.it. For other information on personal data processing, please read the Privacy Policy.

2. What cookies are

Cookies are small files that a website may save in your browser and read on later visits. They may be necessary for website operation or used for preferences, analytics and profiling. Other storage or tracking technologies may require the same transparency and consent assessments.

localStorage is local browser storage, distinct from HTTP cookies: its contents are not automatically transmitted with requests to the server. This website uses it solely to remember the choice made in the panel, not to identify or profile visitors.

3. Current website configuration

This website’s code does not set HTTP cookies; it uses localStorage only for the technical consent preference. No visitor analytics, Google Analytics, advertising pixels, profiling cookies or third-party tracking services are installed. No profiling takes place. The panel’s analytics and marketing categories are prepared for possible future integrations: accepting them does not activate any tracker today.

• The menu, photo gallery and hero slideshows operate without storing persistent preferences on your device.
• You choose the language through links to separate Italian and English pages, without cookies or stored language preferences.
• Images, icons, stylesheets and scripts are served by the website; fonts are those available on your system.
• The contact service requires JavaScript and a configured backend: only on your action does it send name, email, arrival, departure, guests and message in a same-origin HTTPS JSON POST to /api/contact.php. PHPMailer forwards the email to the controller through the hosting provider’s local PHP mail() service or authenticated SMTP over SSL/TLS at mail.residenceletortore.it:465, selected privately without automatic fallback. Names, email addresses and messages are not archived in the website database, cookies, localStorage or sessionStorage. Autofill depends on your browser.

The only persistent application storage entry in the browser is residence-cookie-consent, a first-party localStorage record on the website’s origin, with the technical purpose of remembering and applying your choices. It contains version: 1, technical: true, analytics and marketing as boolean values, and savedAt and expiresAt as timestamps in milliseconds. It contains no user identifiers or form data. It stays only on your device and is not sent by the website code to the controller or third parties.

It is valid for six calendar months from saving, not a fixed number of days. The preference is shared across the 18 pages (9 Italian and 9 English) of the same origin in the same browser. On expiry the choice is no longer valid and a new choice will be requested on non-legal pages; the same applies after clearing site data, in another browser or when the consent version changes. If storage is blocked, the choice applies only to the current page: reloading or navigating to another page will require a new choice.

The CSRF token is separate from the consent preference: the form flow obtains it from the same API and keeps it only in page RAM, never in cookies, localStorage or sessionStorage. It is HMAC-signed, bound to the IP address, contains a random nonce, lasts 30 minutes and is usable once. Issuance is stateless, without PHP sessions or HTTP cookies; an HMAC digest of the consumed token prevents reuse. Origin checks, a honeypot and a minimum three-second wait provide further protection. These technical measures do not activate analytics or marketing and do not require consent to optional categories.

The private anti-abuse SQLite database is on the server, not in the browser: it stores event types and timestamps, HMAC IP digests and used-token digests with expiry, without plain IP addresses or form contents. Events are deleted after one hour and token digests at the end of their 30-minute validity. Deployment requires a private cron job every minute to clean up even without traffic: with regular execution, retention is one hour plus a delay of up to one minute for events, and until expiry plus a delay of up to one minute for tokens. Timing depends on the cron job actually running; interruptions may extend it. Any hosting logs are separate. The mailbox normally retains correspondence for the time needed for the enquiry, subject to legal obligations or legal claims, as described in the Privacy Policy.

The form answers your request (Article 6(1)(b) GDPR), not for marketing; security relies on Article 6(1)(f), and applicable legal obligations on Article 6(1)(c). The mandatory privacy acknowledgement is not consent to marketing or optional cookie categories. Dates and guests are not a booking or confirmation of availability. HTTPS, PHP 8.2 or later with openssl, json, mbstring and pdo_sqlite, PHPMailer and ready private configuration are required. If unavailable, use info@residenceletortore.it or WhatsApp at +39 348 712 7604, also without JavaScript. A positive result means only mail-service acceptance for forwarding, not guaranteed delivery. With PHP mail(), subsequent transport depends on the hosting provider, without directly verified SMTP TLS from the script.

Technical storage necessary to manage your choice does not require consent to optional categories. Any cookies introduced by hosting, a CDN or a security service must be checked against the actual deployment configuration and, if present, described in this notice before use.

4. Choice panel and withdrawal

With JavaScript, the website presents a consent panel in a native dialog. The technical category is always active; analytics and marketing are off by default and are not currently connected to installed tools. The three buttons have equal priority: “Reject optional”, “Save selection”, “Accept all”. Escape means “Reject optional”, not acceptance. Simply browsing does not constitute consent.

The panel links to the legal notices. It does not open automatically on the four Italian and English Privacy and Cookie Policy pages, allowing you to read them before choosing. With JavaScript, the footer’s “Cookie preferences” button remains available here and reopens the panel; you can also use the button below.

You can change or withdraw your choice at any time by reopening the panel and rejecting optional categories, or turning them off and saving. Withdrawal does not affect the lawfulness of any earlier processing. Without JavaScript, legal and navigation links remain usable, the panel is unavailable and no optional tools are activated.

Before introducing optional trackers, the notices will be updated with providers, purposes, cookie or other technology names and lifetimes, and any data transfers. The consent version will be increased to request a new choice. Services must remain blocked before consent and stop on withdrawal. The panel alone does not certify compliance: deployment configuration, hosting and providers must be checked.

5. External links

The WhatsApp button opens a chat with Alessandro at +39 348 712 7604 through a plain wa.me link. It does not embed WhatsApp widgets, SDKs, pixels or scripts and does not contact the service before you click. Once opened, WhatsApp applies its own technologies and Privacy Policy. The prefilled message is not sent automatically.

The website links to Google Maps, travel services and tourist portals but does not embed maps or other external content. No automatic requests to Google are made before consent. These services open only if you choose to follow a link; the external service’s technologies and rules then apply. A choice in our panel does not constitute consent on an external website. For Google, read its Privacy Policy and cookie information.

Email links open the email application or service you choose. External services are not automatically activated simply by visiting this website.

6. Browser settings

You can view, delete or block cookies and site data, including localStorage, in your browser’s privacy settings. Clearing this website’s data removes the saved preference and requires a new choice on your next visit to a non-legal page. To withdraw your choice during a visit, use the “Cookie preferences” panel. Data management depends on your browser and device; consult its official help pages. Browser settings do not replace a website’s obligation to obtain consent when required.

7. Updates and enquiries

This page will be updated when the technologies actually used change. For clarification, email info@residenceletortore.it. See the Privacy Policy for your personal data rights.