Version 2026-10-08, in force from 8 October 2026. It replaces any previous version.
Data controller and scope
The data controller is RANKWIT S.R.L. SOCIETÀ BENEFIT (short form Rankwit S.r.l. SB), an Italian limited liability benefit company with registered office at Piazza delle Scuole 6, 95021 Aci Castello (CT), Italy, tax code and VAT number 06209300877, registered with the Catania Companies Register under REA no. CT-478459, certified email rankwit@pec.it, data protection contact: info@rankwit.ai.
No Data Protection Officer has been appointed, as the conditions under Article 37 of Regulation (EU) 2016/679 (the “GDPR”) do not apply.
This document covers the osservatorio.rankwit.ai website (the “Site”) only, which hosts the Italian Tourism AI Observatory. The controller's other websites and services, including rankwit.ai and the Platform, are covered by the group cookie policy.
It is provided under Article 122 of Italian Legislative Decree 196/2003 (the “Privacy Code”), Articles 6 and 13 of the GDPR, and the Italian Data Protection Authority's guidelines of 10 June 2021 on cookies and other tracking tools.
Cookies and similar technologies
Cookies are small text files that websites store on the user's device through the browser and can read again on later visits. They are first party when they belong to the domain being visited and third party when set by an external provider; session cookies are deleted when the browser closes, persistent ones remain until the stated expiry or until the user deletes them.
The Site also uses the browser's local storage, a technology with an effect comparable to cookies. Data stored this way stays on the user's device and is never transmitted to the controller.
How to choose and how to change your mind
A banner is shown on the first visit. Until the user makes a choice, only strictly necessary cookies are installed: no analytics tool is activated and the Google Tag Manager container is not even loaded, so no request is sent to the providers' servers.
From the banner the user can accept or reject non-necessary cookies. The two controls have equal visual prominence and require the same number of actions, in line with the Italian Data Protection Authority's guidelines of 10 June 2021.
Closing the banner without choosing, continuing to browse and scrolling the page do not amount to consent.
The choice can be changed at any time through the “Cookies” control in the footer of every page of the Site.
The choice is recorded in the strictly necessary cookie `rw_consent`, set on the `.rankwit.ai` domain and therefore also valid for the controller's other websites that use the same mechanism, and vice versa. It is kept for 180 days, after which the banner is shown again. The banner is also shown again when the categories or providers described in this document change: to that end the cookie records the version of this document in force at the time of the choice.
Strictly necessary cookies (always active)
Strictly necessary cookies allow the Site to be used and the user's preferences to be remembered. Under Article 122 of the Privacy Code they do not require consent and cannot be switched off from the banner.
| Name | Type | Duration | Purpose |
|---|---|---|---|
| `rw_consent` | First party, `.rankwit.ai` domain | 180 days | Records the choice made on analytics cookies, the date of the choice and the version of this document then in force. This is the cookie that prevents the banner from reappearing on every page. |
| `__cf_bm`, `cf_clearance` and similar | Third party (Cloudflare, Inc.) | 30 minutes to 30 days | Technical cookies of the hosting and content delivery provider, needed to deliver pages and protect the infrastructure. Notice: cloudflare.com/privacypolicy. |
| `theme` (local storage, not a cookie) | First party | until deleted | Stores the choice between the light and dark theme. The value stays on the device and is not transmitted to the controller. |
Analytics cookies (consent only)
Analytics cookies make it possible to understand, in aggregate, which pages of the Observatory are read and where reading runs into difficulty. They are installed only with the user's consent, under Article 122 of the Privacy Code and Article 6(1)(a) of the GDPR.
The tools are managed through the Google Tag Manager container no. GTM-K4KQ65X9, which is loaded only after consent. Google Tag Manager does not itself measure anything and sets no profiling cookies: it is the system that activates the tools listed below.
Google Analytics 4 provides statistics on how the pages are used. The controller has not enabled the collection and sharing of data for advertising purposes (Google Signals) and carries out no marketing profiling through this tool.
Microsoft Clarity produces heatmaps and recordings of how users interact with the pages (pointer movement, scrolling, selections). The recordings concern interaction with the Site's interface, which contains no restricted areas and no forms collecting personal data.
| Name | Type | Duration | Purpose |
|---|---|---|---|
| `_ga` | Third party (Google) | 2 years | Assigns an identifier to the device in order to distinguish visitors. |
| `_ga_<ID>` | Third party (Google) | 2 years | Maintains session state for the specific Google Analytics 4 property. |
| `_clck` | First party (Microsoft Clarity) | 1 year | Persists the user's pseudonymous Clarity identifier for the Site. |
| `_clsk` | First party (Microsoft Clarity) | 1 day | Connects several page views into a single session recording. |
| `CLID` | Third party (`clarity.ms`) | 1 year | Records the first time Clarity saw this user on any site using the service. |
| `MUID`, `MR`, `SM`, `ANONCHK` | Third party (Microsoft domains) | 10 minutes to 13 months | Identify the browser across Microsoft domains and synchronise its identifier. Microsoft states that `MUID` is also used for its own advertising purposes: for this reason these cookies are treated as non-necessary and subject to consent. |
Google Consent Mode v2
The user's choice is passed to Google tags through Consent Mode v2. The signals are set as follows:
`security_storage`: always granted, covering security purposes only.
`analytics_storage`, `functionality_storage`, `personalization_storage`, `ad_storage`, `ad_user_data`, `ad_personalization`: set to “denied” when every page opens, before any tag loads, and updated only where explicit consent has been given. The Site uses no advertising tags; the advertising signals stay denied even after consent to analytics, unless a further notice states otherwise.
Without consent, no Google tag writes cookies or identifiers to the user's device.
Effect of rejection and withdrawal
Rejecting from the banner prevents the Google Tag Manager container from loading and, with it, Google Analytics 4 and Microsoft Clarity.
Where a consent previously given is withdrawn, the controller does not merely update the consent signals but also: (i) deletes the cookies listed under 05 that are present on the device, so that identifiers already assigned do not stay active until their natural expiry; and (ii) reloads the page, so that the Google Tag Manager container is physically removed from the document and all further collection stops.
Deletion may fail for cookies set on third-party domains other than the Site's own, which for technical reasons cannot be reached by scripts running on osservatorio.rankwit.ai. Those cookies can be removed from the browser settings, as described under 07.
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal, under Article 7(3) of the GDPR.
Managing cookies from the browser
Besides the banner, cookies can be blocked or deleted directly in the browser settings. Blocking strictly necessary cookies may stop parts of the Site from working.
Instructions for the main browsers: Google Chrome · Mozilla Firefox · Apple Safari · Microsoft Edge.
Legal basis, recipients, rights
Strictly necessary cookies are set on the basis of the controller's legitimate interest in securely providing the service requested by the user (Article 6(1)(f) GDPR), together with the consent exemption in Article 122 of the Privacy Code. All other cookies are set solely on the basis of the user's consent (Article 6(1)(a) GDPR).
The providers of the analytics tools act as independent controllers or as processors, as set out in the respective agreements: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (notice · how Google uses data from partner sites); Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (notice).
For the exercise of the rights under Articles 15 to 22 GDPR, retention periods, transfers to third countries and complaints to the Italian Data Protection Authority, see the Observatory's privacy notice and, for everything else, the group privacy notice.
Updates
This document may be updated when the tools used change. Each version is identified by the date shown at the top of the page. Where the changes concern the categories or the providers, consent is requested again through the banner.
Version 2026-10-08, in force from 8 October 2026.