Version 2026-10-08, in force from 8 October 2026. It replaces any previous version.
Data controller
The data controller is RANKWIT S.R.L. SOCIETÀ BENEFIT (short form Rankwit S.r.l. SB), an Italian limited liability benefit company with registered office at Piazza delle Scuole 6, 95021 Aci Castello (CT), Italy, tax code and VAT number 06209300877, registered with the Catania Companies Register under REA no. CT-478459, certified email rankwit@pec.it, data protection contact: info@rankwit.ai.
No Data Protection Officer has been appointed, as the conditions under Article 37 GDPR do not apply. Any request concerning personal data can be sent to the address above.
Scope of this notice
This notice is provided under Articles 13 and 14 of the GDPR and covers the processing carried out through the osservatorio.rankwit.ai website, which publishes the Italian Tourism AI Observatory.
The Site is a static, read-only website: it has no registration, no sign-in, no restricted area, no contact forms, no comments, no basket and no payments, and it collects no personal data volunteered by the user through its pages.
The data the Observatory publishes concerns answers given by artificial intelligence engines to travel questions, and mentions of tourism boards, destinations and accommodation businesses. It relates to organisations and places, not to identified or identifiable natural persons.
Third-party websites reachable from links on these pages fall outside this notice; each has its own notice. The controller's other websites and services are covered by the group privacy notice.
Personal data processed
a) Navigation data. The IT systems and software procedures that run the Site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of internet communication protocols: IP address, date and time of the request, resource requested, response status code, browser and operating system characteristics. This data is processed by the infrastructure provider as technical logs and is not used by the controller to identify users.
b) Data collected by the analytics tools. Where consent has been given, Google Analytics 4 and Microsoft Clarity collect data about navigation and interaction with the pages (page views, source, visit duration, pointer movement, scrolling, selections), associated with pseudonymous identifiers held in the cookies described in the cookie policy. Without consent these tools are not loaded and no data is collected.
c) Contact data. The address info@rankwit.ai, published in the footer for reporting errors and asking about published figures, involves processing the sender's address and the data contained in the message.
The Site carries out no profiling and no automated decision-making producing legal effects or similarly significantly affecting the data subject within the meaning of Article 22 GDPR.
Purposes and legal basis
Providing and securing the Site (data under (a)): the controller's legitimate interest in delivering the service requested and protecting the infrastructure against abuse and unauthorised access, under Article 6(1)(f) GDPR. The interest has been balanced against the data subject's rights having regard to the technical nature of the data and its limited retention.
Statistical measurement of page usage (data under (b)): the data subject's consent, under Article 6(1)(a) GDPR and Article 122 of the Privacy Code. Consent is optional, can be withdrawn at any time, and withholding it in no way limits access to the Site's content.
Responding to messages received (data under (c)): performance of pre-contractual measures or the controller's legitimate interest in following up the request, under Article 6(1)(b) and (f) GDPR.
Whether providing data is required
Providing navigation data is necessary and implicit in the use of internet protocols: without it the page cannot be delivered to the user's device.
Providing the data collected by the analytics tools is optional and subject to consent. Refusal has no consequence for the use of the Site, which remains fully accessible.
Providing contact data is optional; without it the request cannot be answered.
Recipients and processors
Data may be processed by providers acting as processors under Article 28 GDPR or, for processing they determine themselves, as independent controllers:
Cloudflare, Inc. (101 Townsend St., San Francisco, CA, United States) and its European subsidiaries, for hosting the Site and delivering content. Notice: cloudflare.com/privacypolicy.
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for Google Tag Manager and Google Analytics 4. Notice: policies.google.com/privacy.
Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), for Microsoft Clarity. Notice: privacy.microsoft.com.
Data is not disseminated or disclosed to third parties for purposes other than those stated, unless disclosure is required by law or necessary to establish, exercise or defend a legal claim.
Transfers to third countries
The providers listed belong to groups headquartered in the United States and may process data outside the European Economic Area.
Such transfers take place on the basis of the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for providers certified under it, or on the basis of the standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR, supplemented by the additional measures set out in the respective agreements.
A copy of the safeguards in place can be requested by writing to info@rankwit.ai.
Retention periods
Infrastructure technical logs: kept by the provider for as long as needed for service security and diagnostics, under Cloudflare's policies, and in any event no longer than those purposes require.
Google Analytics 4 data: kept in the property for the user- and event-level retention period configured there, which the tool allows to be set to a maximum of 14 months; aggregated data in standard reports remains available beyond that period in a form not attributable to an individual device.
Microsoft Clarity data: according to the provider's documentation, recordings are kept for 30 days from the time of recording; recordings marked as favourites, a randomly selected sample and labels are kept for up to 9 months.
Cookies: for the durations stated in the cookie policy. The cookie recording the consent choice is kept for 180 days.
Email correspondence: for as long as needed to reply and, thereafter, for the limitation period applicable to the protection of any rights.
Rights of the data subject
Data subjects have the right to ask the controller for access to their personal data (Article 15), its rectification (Article 16), its erasure (Article 17), the restriction of processing (Article 18) and the portability of data processed on the basis of consent or a contract and by automated means (Article 20).
Data subjects also have the right to object at any time, on grounds relating to their particular situation, to processing based on the controller's legitimate interest (Article 21), and to withdraw consent at any time (Article 7(3)) without affecting the lawfulness of processing carried out before withdrawal. Consent to analytics cookies is withdrawn through the “Cookies” control in the footer of every page.
Requests should be sent to info@rankwit.ai or to the certified address rankwit@pec.it. The controller replies without undue delay and in any event within one month of receipt, extendable by two further months where necessary taking into account the complexity and number of the requests, under Article 12(3) GDPR.
Complaint to the supervisory authority
Data subjects who consider that the processing of their personal data infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the Member State of their habitual residence, place of work or of the alleged infringement, under Article 77 GDPR, without prejudice to any other administrative or judicial remedy.
Changes
This notice may be amended to reflect changes in the law or in the tools used. Each version is identified by the date shown at the top of the page; the version in force is always published here.
Version 2026-10-08, in force from 8 October 2026.