The Underwater Statue of Padre Pio: A Mystic Experience

1. Data Controller

The data controller for personal data is:

• Company Name: Pagnotta Shipping Tourism
• Registered Office: Via Firenze 21 — 86039 Termoli (CB), Italy
• VAT Number: 01863770705
• Contact Email: info@costantinotour.it

For any requests regarding personal data protection, you can write to the email address mentioned above.

2. Reference Regulations

This notice is provided in accordance with the Regulation (EU) 2016/679 (GDPR — General Data Protection Regulation) and the Legislative Decree 196/2003 (Code regarding the protection of personal data), as amended by Legislative Decree 101/2018, as well as the Guidelines of the Guarantor for the Protection of Personal Data.

3. Types of Data Collected

3.1. Data Provided Voluntarily by the User

Through the contact form available on the homepage, the user can voluntarily provide:

The form is protected by an anti-spam verification system (text captcha "Tremiti") and requires explicit acceptance of this notice (checkbox) before submission.

3.2. Data Collected via the AI Chatbot ("Skipper AI")

The site integrates a virtual assistant powered by artificial intelligence (language model via OpenRouter API). When the user interacts with the chatbot:

• The text messages sent are processed in real-time to generate a contextual response and are not persistently stored on the Controller's server.
• The user's IP address is subjected to one-way hashing (MD5 with salt) exclusively for the rate limiting system (hourly message limit) and is never stored in plain text.
• A daily usage counter is stored in the chatbot_usage table for aggregated statistical purposes (total number of messages per day).
• Messages are sent to a third-party API service (OpenRouter — openrouter.ai) for linguistic processing.

3.3. Browsing Data (Technical Logs)

The site's internal logging system records the following information for statistical purposes:

Note: The anti-refresh system prevents duplicate recordings of the same page in the same session within 5 minutes.

4. Purpose and Legal Basis of Processing

5. Processing Methods

Personal data is processed using automated IT tools, adopting appropriate technical and organizational security measures to ensure an adequate level of protection, including:

• Encryption in transit: mandatory HTTPS connection with HSTS (max-age 1 year).
• Prepared Statements (PDO): all database queries use parameterized queries to prevent SQL Injection.
• Password hashing: bcrypt algorithm with cost factor 12.
• CSRF Token: protection against Cross-Site Request Forgery attacks on every form.
• Content Security Policy (CSP): HTTP header that limits the sources of executable scripts.
• Security Headers: X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy.
• Rate Limiting: limiting the number of requests to the chatbot and contact forms to prevent abuse.
• Anti prompt-injection: active filtering of chatbot messages to block attempts to manipulate the AI model.

6. Data Retention Periods

The automatic deletion system (GDPR Auto-Cleanup) runs once a day in a transparent and silent manner.

7. Communication and Dissemination of Data

Personal data is not sold, transferred, or disclosed to third parties for the Controller's direct marketing purposes.

Data may be communicated to:

• Technology Service Providers: hosting providers for the operation of the server infrastructure, bound by confidentiality agreements.
• OpenRouter (openrouter.ai): messages sent to the chatbot are transmitted to this API service for processing via artificial intelligence models. Messages are processed in real-time and are not retained by the Controller after the session.
• Google LLC: if the user has consented to statistical cookies, browsing data is transmitted to Google Analytics and/or Google Tag Manager.
• Meta Platforms Inc.: if the user has consented to marketing cookies, the Meta Pixel may transmit browsing data to Meta (Facebook).
• Open-Meteo (open-meteo.com): public and free API for weather data. No personal data of the user is transmitted to this service.

8. Integrated Third-Party Services

9. Data Transfer to Third Countries

Some third-party services (Google, Meta, OpenRouter) may involve the transfer of data to the United States of America or other non-EU countries.

Such transfers occur based on:

• Adequacy Decision by the European Commission (EU-U.S. Data Privacy Framework), where applicable.
• Standard Contractual Clauses (SCC) approved by the European Commission, incorporated into contracts with suppliers.
• Supplementary technical measures: encryption in transit (TLS/HTTPS), minimization of transmitted data, pseudonymization (IP hashing).

10. Rights of the Data Subject

How to exercise your rights: send a written request to: info@costantinotour.it. The Controller will respond within 30 days.

Right to lodge a complaint: The data subject also has the right to lodge a complaint with the Guarantor for the Protection of Personal Data (Website: www.garanteprivacy.it).

11. Data of Minors

The site is not intended for individuals under the age of 16. The Controller does not knowingly collect personal data from minors.

12. Changes to the Privacy Policy

The Controller reserves the right to modify this notice at any time. The updated version will always be available on the website.

1. What Are Cookies

Cookies are small text files that websites visited send to the user's device (computer, tablet, smartphone), where they are stored to be retransmitted to the same sites on the next visit. Thanks to cookies, the site remembers the user's actions and preferences (such as language, font sizes, and other display preferences) so that the user does not have to re-enter them every time they return to the site or navigate from one page to another.

2. Consent Management

The site uses a cookie consent banner compliant with GDPR that:

• Automatically appears on the user's first visit.
• Allows users to accept all cookies with a single click.
• Allows users to reject all non-essential cookies.
• Allows users to customize preferences for each category (essential, statistical, marketing).
• Is accessible at any time via:
  • The link "Cookie Preferences" in the footer of the site.
  • The floating button with the cookie icon (🍪) at the bottom left.

Consent is saved for 12 months (365 days). After this period, the banner will be presented again.

3. Categories of Cookies Used

3.1. Technical / Essential Cookies (always active)

These cookies are strictly necessary for the functioning of the site and do not require user consent.

Data stored in the consent cookie: the cookie cookie_consent_costantino contains a JSON object with three boolean fields:

{
  "essential": true,
  "analytics": true/false,
  "marketing": true/false
}

3.2. Language Preference Cookies

3.3. Statistical / Analytics Cookies (with prior consent)

Activated only if the user consents to the "Statistical Cookies" category in the banner.

Google Tag Manager: does not directly install its own cookies but manages the activation of third-party scripts (like Google Analytics) based on user consent.

3.4. Marketing / Profiling Cookies (with prior consent)

Activated only if the user consents to the "Marketing Cookies" category in the banner.

3.5. Cookies set by embedded content

4. Third Party Cookies — CDN Services

The site loads static resources (CSS, JS, fonts, icons) from the following Content Delivery Networks (CDN):

These services may log the user's IP address in their access logs for technical and security purposes.

5. How to Manage or Disable Cookies

5.1. Through the site banner

The user can modify their preferences at any time:

1. Click on "Cookie Preferences" in the footer of the site.
2. Or click on the floating button with the cookie icon (at the bottom left).
3. Select or deselect the desired categories.
4. Click on "Save".

The page will automatically reload to apply the new preferences.

5.2. Through browser settings

The user can also manage cookies through their browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy and security → Cookies and site data
• Safari: Preferences → Privacy → Manage website data
• Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data

5.3. Specific opt-outs for third-party services

6. Updates to the Cookie Policy

This Cookie Policy may be updated periodically to reflect any changes in the technologies used by the site or in applicable regulations. Users are encouraged to periodically consult this page to review the most recent information.