PIQOD Privacy Policy

Last updated: April 13, 2026 Version: 1.0.0

Language notice: This is an informal English translation. The legally binding version is the Italian Privacy Policy. In case of discrepancy, the Italian version prevails.

This notice describes how PIQOD collects, uses, stores and shares personal data of users of piqod.it and its connected services (the "Service"). It is drafted in compliance with EU Regulation 2016/679 (GDPR), the Italian Privacy Code and other applicable European regulations, using the clearest possible language.

If you have questions or want to exercise your rights after reading it, write to privacy@piqod.it.

1. Who we are — the Data Controller

The Data Controller of personal data collected through the Service is:

Name: PIQOD di Sorrentino Lucio (sole proprietorship)
Legal representative: Sorrentino Lucio
Registered address: Via Somma n. 10, 80034 Marigliano (NA), Italy
VAT / Tax ID: 09825941215
Privacy contact: privacy@piqod.it
General contact: info@piqod.it
Certified mail (PEC): {{LEGAL_ENTITY_PEC}} (to be activated)

PIQOD is not currently required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR, but we have designated an internal Privacy Officer who coordinates all data protection requests, reachable at privacy@piqod.it.

2. What PIQOD does — fundamental operational clarification

PIQOD is a travel experiences metasearch. We aggregate and display tours, attractions, tickets and activities provided by third-party commercial partners (currently Viator and Tiqets, with additional partners being integrated), operating as a comparison aggregator.

What we do:

Show partner commercial offers with descriptions, images, prices and availability
Provide search engine, filters, ranking and personalization
Redirect users to the partner site to complete bookings

What we do NOT do:

We do not sell any travel experience directly
We do not receive end user payments
We do not manage booking, confirmation, cancellation or refunds
We do not process user credit card or payment data

Transactions occur entirely on the partner site (Viator, Tiqets, etc.), who is the merchant of record and has its own independent privacy policy. PIQOD receives an affiliate commission when a click generates a partner-confirmed conversion.

This distinction is relevant to understanding who processes which data and with what legal basis.

3. What data we collect and how

We distinguish between data necessary for the Service and optional data that users can choose to share.

3.1 Data provided directly by the user

Category	Examples	When we collect
Registration data	Email, name, hashed password, preferred language, currency, country	At account registration
Profile data	Avatar (image), travel preferences, country code	When user completes or modifies profile
User-generated content (UGC)	PIQOD Live photos, caption text, location tags, user tags	When publishing a "Live"
Wishlist & reminders	Saved experiences, reminder date and time	When saving an experience or scheduling a reminder
Support requests	Contact messages, reports, DSAR requests	When communicating with us
Newsletter	Email, sending preferences	When voluntarily subscribing

3.2 Data automatically collected during navigation

Category	Examples	Technical source
Technical connection data	IP address, user-agent hash, browser language, timezone	HTTP headers
Navigation data	Pages visited, search queries, filters applied, clicks on experiences, dwell times	Server log + tracking JS
Device identifiers	Pseudonymous device fingerprint hash, session cookie ID	Generated server-side
Approximate geolocation	City, region, country estimated from IP	MaxMind GeoLite2 (local database, no third-party calls)
Device data	Device type (mobile/desktop), operating system, browser	User-agent parsing

3.3 Data collected with explicit browser permissions (opt-in)

For some advanced features, we request explicit permissions through browser APIs. Users can always deny or revoke these permissions from browser or device settings.

Permission	When we ask	What we collect
Precise geolocation	When user decides to publish a Live	GPS coordinates (lat/lng) with accuracy, exclusively at upload time
Camera	When user chooses to take a photo for a Live	Capture frame (video stream is not stored)
Gallery	When user uploads an existing photo	The selected photo + any EXIF metadata (including GPS if present)

We never collect: biometric data, health data, sensitive data under Art. 9 GDPR, data of minors under 14 (in Italy) or 16 (in other EU states, except with parental consent).

3.4 Cookies and similar technologies

Cookie usage is described in detail in our Cookie Policy. In summary, we group cookies into six categories:

Essential (always active, no consent required)
Functional (language, currency, theme, dismissible without consent in EU)
Anonymous analytics (Google Analytics 4 with IP anonymization and Consent Mode v2)
Behavioral (navigation tracking for personalization and ML learning)
Advertising and profiling (currently unused, reserved for future advertising partners)
Aggregated data sharing with third-party commercial partners (see section 7)

Users can modify their preferences at any time from the Preference Center accessible from the Cookie Policy page or their profile in the Privacy Dashboard.

3.5 Data collected automatically in the iOS app (product telemetry)

The PIQOD iOS app collects usage events exclusively "first-party": data reaches PIQOD servers only. The app does not embed any third-party analytics or advertising SDK.

Category	Examples	Notes
Usage events	screens viewed, searches, opening an experience, wishlist saves, publishing and viewing Stories, clicks to partners	associated with a session identifier generated at each app launch
Durations	session start and end, dwell time, Stories watch time	product metrics
Pseudonymous identity	if you have an account, your user ID travels exclusively as a truncated, non-reversible hash	never your email, never your name

What we do NOT do in the app: no cross-app tracking (we do not use Apple's IDFA and we do not ask for the "tracking" permission, because we do not follow you across other apps); no sharing with advertising networks; no device fingerprinting.

Your control: usage-event collection follows the "Anonymous analytics" (events and durations) and "Behavioral" (use for personalization) categories of the privacy center — the choice you make on the app or on the website applies to your account on both and can be revoked at any time (app: Settings → Privacy; website: cookie center), with immediate effect. As on the website, only strictly necessary technical events remain outside consent: errors, security, and the counting of clicks to partners for commission purposes (basis: legitimate interest / contract performance).

4. Purposes of processing and legal bases

Each data processing operation has a specific purpose and legal basis under Art. 6 GDPR. We list them all, with no omissions.

4.1 Service delivery (basis: contract execution, Art. 6(1)(b) GDPR)

User account creation and management
Authentication and session management
Providing site features (search, filters, wishlist, experience detail, partner redirect)
Wishlist email reminder management (when activated by user)
User support and request management

4.2 Personalized experience (basis: legitimate interest, Art. 6(1)(f) GDPR)

Storing preferences (language, currency, theme)
Personalized ranking of search experiences (when user is logged in)
Destination suggestions based on navigation activity

Balancing of interests: we evaluated that our interest in providing a relevant experience is proportionate to privacy impact, because we use only navigation data on our platform, never data acquired from external sources, and users can object at any time.

4.3 Site security and abuse prevention (basis: legitimate interest, Art. 6(1)(f) GDPR)

Detection of suspicious activity, bot scraping, credential stuffing attempts
Blocking of IP addresses involved in abuse
Detection of fraudulent clicks on partner links: when you open a booking link, your IP address is turned into an irreversible fingerprint (the address cannot be recovered from it) and kept for 90 seconds in the server's temporary memory, for the sole purpose of recognising whether the same product is being clicked from many different addresses within seconds — the typical signature of automated networks generating artificial clicks. After 90 seconds the fingerprint is deleted; only the count remains in our records, never anything relating to you. No user is blocked on the basis of this detection.
Moderation of user-generated content via automated analysis (local ML based on NSFW.js, no data sent to third parties for this purpose)

4.4 PIQOD Live / Stories — community and content moderation (basis: contract execution + legal obligation DSA, Art. 6(1)(b)(c) GDPR)

PIQOD hosts a travellers' community: the Stories service lets registered users publish travel experience photos (places, hotels, attractions, landscapes, food).

Stories are visible only to registered users. Anyone visiting PIQOD without an account can search experiences and destinations freely, but receives neither the photographs nor the locations of Stories: the server does not send them at all. Search stays open to everyone; Stories require an account.

Public visibility (informed consent)

Publishing a Story happens within the contractual relationship already in place. The licence we are granted over the photographs is the one set out in art. 6.2 of the Terms of Service, which the user accepts on registration: those who sign in with Google or Apple — where the documents do not appear in the flow — are asked for it on first access, and the acceptance is recorded with the date and the version of the document.

No separate consent is therefore requested at publication time: publishing is a voluntary, deliberate act, and sharing with other registered users is the very function of the service. The following conditions apply:

The Story will be visible to other registered PIQOD users, and not to people browsing the site without an account
Visibility lasts 24 hours, after which the Story is automatically deleted from our servers and from the delivery network
The user can delete the Story at any time before expiration (right to erasure GDPR Art. 17)
Publishing is a voluntary act by the user, who keeps control over it: the Story can be deleted at any moment and disappears anyway once the 24 hours are over
A summary mention of the public community nature is also present in the cookie/privacy banner shown on first site access, to inform new visitors
Voluntary location tag: the user can choose to add a location tag to their Story (via device GPS or manual place search). The tagged location appears as a pin on the interactive map of the home page, visible to registered users only, for the duration of the Story. Visitors without an account see an illustration instead, and no real coordinates are transmitted to them. The location tag is entirely optional — you can publish without any geographic tag. When present, the location is approximate at place or neighbourhood level, never the person's exact coordinates.

This model is inspired by the pattern of major travel UGC platforms (Instagram, TikTok, Tripadvisor) and serves to create a community differential compared to traditional metasearch competitors: PIQOD is not just hotel/experience search but builds a living catalog of authentic user-shared experiences.

Automated moderation

Each uploaded photo is subjected to automated analysis via local AI classifier (NudeNet ONNX open source, executed on PIQOD servers, zero external transfer) to verify compliance with community guidelines and legal rules (EU Digital Services Act 2022/2065). Analysis happens after publication, not before: the Story is visible immediately, and content found to be in violation (sexually explicit, violent, illegal, copyright-infringing, spam, abusive) is removed or hidden once detected, whether by the automated analysis or by a report.

Mandatory EXIF stripping

Before storage, any EXIF metadata containing personal information not necessary (particularly GPS coordinates, exact datetime, device fingerprint) is stripped from the photo. This prevents accidental disclosure of precise user location.

Publishing limits

Rate limit: max 5 Stories/hour/user (anti-spam, anti-abuse)
Minimum age: publishing reserved for users ≥16 years (GDPR Art. 8). For users <16 verified parental consent is required
Geo trust score: browser must allow position reading to verify consistency with declared city. Stories with low trust score can be rejected or marked for review
Max duration: 24 hours, non-extendable

DSA compliance

The user always has the right to:

Request reinstatement of a removed Story by contacting privacy@piqod.it or support@piqod.it
Receive removal notification with reason (SoR — Statement of Reasons DSA Art. 17)
Report content published by other users via the internal complaint flow (Report button in the Stories viewer)
Receive response within 24 working hours for urgent reports (imminent danger, illegal content)

Who viewed your Story (basis: contract performance, Art. 6(1)(b) GDPR)

The author of a Story can see the list of who viewed it (account name and profile picture, with an indication of who liked it) — as on major social platforms. The list is visible to the author only, covers registered users only, and is deleted together with the Story when it expires after 24 hours.

Which Stories you have already seen (basis: contract performance, Art. 6(1)(b) GDPR)

When you open a Story, PIQOD records that you opened it: one row holding your identifier, the Story's identifier and the time. It serves two purposes:

showing you which Stories are new. That is the coloured ring around the author's picture: it stays coloured while at least one Story is still unseen, and turns grey once you have seen them all. This used to live only on the device, so it started over when you moved between phone and website; it is now tied to your account and follows you;
telling the author how many people watched. The author sees a number, not names: PIQOD does not show them who you are.

What we do not do:

we do not show the list of who watched. Should we ever introduce it, this notice will say so first, and you as a viewer will be told too;
we do not use these rows to profile you or to personalise advertising;
we do not share them with experience providers or any third party.

How long they last: the rows die with the Story. Stories last 24 hours, and when a Story is deleted — by expiry, by its author or by moderation — the records of who saw it are deleted along with it (cascading deletion in the database). If you delete your account, all of yours disappear too: no list of what you had watched is left anywhere.

People without an account generate none of these rows, because without an account Stories are not visible at all.

Stories-specific rights

Access (Art. 15): user can export all active Stories via /profilo/privacy JSON export
Rectification (Art. 16): caption can be modified while the Story is active
Erasure (Art. 17): immediate delete button on the Story (cascade deletion from DB, cache, CDN within 24h)
Portability (Art. 20): JSON export includes all Stories + associated metadata
Opposition (Art. 21): user can disable use of their Stories for internal model training via privacy preferences

4.5 Service analysis and improvement (basis: consent, Art. 6(1)(a) GDPR)

When user consents via the cookie center to the "Anonymous analytics" category:

We use Google Analytics 4 with IP anonymization and Consent Mode v2
Collected data is aggregated and pseudonymized, not directly identifying the user
Data transfer to Google LLC (United States) is based on EU Commission Standard Contractual Clauses (SCC)

In the iOS app we do not use Google Analytics: analytics events stay first-party on PIQOD servers (section 3.5).

4.6 Behavioral personalization and machine learning (basis: consent, Art. 6(1)(a) GDPR)

When user consents to the "Behavioral" category:

We collect detailed browsing session data, clicks, dwell times, search queries
This data is used to train internal recommendation and ranking models
Data is pseudonymized via session ID hash and not linked to direct personal identity in final models

User can deactivate this collection at any time from the cookie center, with immediate effect. Data collected before revocation remains in already-trained models, which are periodically retrained according to the training cycle. The preference applies to both the website and the iOS app and is unique to the account (synchronized).

4.7 Sharing of anonymous aggregated data with third parties (basis: consent, Art. 6(1)(a) GDPR)

When user consents to the "Aggregated data sharing with commercial partners" category:

Their behavior data may contribute to anonymized aggregated datasets that PIQOD may in the future share or license to commercial third parties (marketing agencies, tour operators, market researchers)
Shared data in no way allows tracing back to user identity: it is aggregated in groups of minimum 100 users and subject to k-anonymity and differential privacy noise injection techniques
No personally identifiable information (PII) is ever transferred to third parties: no email, no IP, no user ID
Example of saleable aggregated data: "In March, 43% of searches for Rome came from mobile devices, with a modal price range of €25-50"
Example of NON-saleable data (never shared): "Marco Rossi searched Rome on March 14 at 14:32 and clicked experience X"

Current state (April 2026): at the time this notice is published, PIQOD is accumulating data but has not yet activated sale or sharing with third parties. Users who deny consent guarantee that their behavior data does not flow into any future commercial dataset.

Register of sharing: we will maintain an internal register of every future sharing of aggregated datasets, available upon request for consultation via the DSAR procedure (section 8).

4.8 Legal obligations (basis: legal obligation, Art. 6(1)(c) GDPR)

Retention for tax, accounting, anti-money laundering purposes
Response to judicial authority requests
DSA compliance for removal of illegal content

4.9 Profile picture and local AI moderation (basis: contract execution + legitimate interest, Art. 6(1)(b)(f) GDPR)

When the user uploads a profile picture (avatar) or a photo for a PIQOD Story, the Service applies the following privacy pipeline before storing or making the image accessible:

Sensitive EXIF metadata removal — any metadata embedded in the image containing personal information not necessary for the purpose (in particular GPS coordinates, capture date/time, device make/model, sensor hardware identifiers) is stripped before storage. The final file contains only pixels and resolution.
Automatic moderation with local AI — the image is analyzed by an open source classification model (NudeNet ONNX, executed locally on PIQOD servers, based on a convolutional neural network pre-trained for explicit content detection). No frame of the image is transmitted to third-party cloud services. The analysis produces a probability score compared with a safety threshold:
- Score below safe threshold → image accepted
- Intermediate flagged score → image accepted but marked for human review (Public Stories only)
- Score above unsafe threshold → image automatically rejected, upload fails and the user receives a generic error message
Post-moderation storage — only approved images are uploaded to Cloudinary (sub-processor, transfer protected by SCC) for optimized CDN distribution. The URL is saved in the user profile. The original image that did not pass moderation is never persisted — the in-memory buffer is discarded after analysis.
Retention — the profile picture remains active until the user changes or deletes it. Upon deletion (manually by the user or following an Art. 17 request), the Cloudinary URL is revoked and the asset file deleted from the CDN within 24 hours.
Automated decision (Art. 22 GDPR) — the automatic rejection of the upload for unsafe score falls within automated decision-making. The effect on the user is limited to the inability to use that specific image. The user can always:
- Upload a different image
- Request human intervention by contacting privacy@piqod.it for decision review
- Exercise the right of opposition under Art. 21 (see section 8.6)

Providers involved in this pipeline: no third-party AI services. Only Cloudinary as post-moderation CDN storage (sub-processor listed in section 5.1).

5. To whom we communicate your data

PIQOD never sells personally identifiable data. Your data is however inevitably processed by technical providers ("Data Processors" under Art. 28 GDPR), each bound to PIQOD by a Data Processing Agreement (DPA).

5.1 List of Data Processors

Provider	Role	Country	Extra-EU transfer
Cloudflare, Inc.	CDN, edge hosting (Workers, R2, KV), DDoS protection, Access	USA (HQ), global nodes	Yes, with SCC + Data Processing Addendum
OVH SAS	Transactional email (SMTP), backend hosting	France (EU)	No
Cloudinary Ltd.	Image transformations, thumbnails	Israel / USA	Yes, with SCC
MongoDB, Inc.	(if MongoDB Atlas in future)	USA / EU	Yes, with SCC
Google LLC	Google Analytics 4, Google OAuth, Google Search Console	USA	Yes, with SCC + partial adequacy
Sentry.io (Functional Software, Inc.)	Backend error tracking	Germany (EU)	No
Grafana Labs	Managed observability (Tempo, Loki, Mimir)	USA / EU	Yes, with SCC

The updated list is available on the dedicated Sub-processors page (being drafted) and is updated within 30 days of any substantial modification.

5.2 Commercial partners (travel experience providers)

Partners Viator, Tiqets (and future ones) receive data only at click-out, meaning when the user decides to proceed with booking on their site. At that moment, PIQOD communicates to the partner only affiliate tracking parameters (conversion pixel, generic session identifier, referring URL), not user personal data.

Once the user interacts with the partner site, only the partner's privacy policy regulates processing of their data (the partner becomes autonomous Controller).

5.3 Public authorities

We may be required to communicate data to judicial authorities, law enforcement or supervisory authorities in the presence of legitimate formal requests, under applicable criminal, tax, administrative or public safety laws.

6. International data transfers

Some of our providers are located outside the European Economic Area (EEA), particularly in the United States. For these transfers, we adopt all guarantees provided by Chapter V of GDPR:

Standard Contractual Clauses (SCC) approved by the European Commission (decision 2021/914)
Data Processing Addendum (DPA) signed with each extra-EU provider
Transfer Impact Assessments (TIA) for US providers in light of the Schrems II ruling
Supplementary measures when necessary (end-to-end encryption, pseudonymization, minimization)

Users can request copies of relevant SCCs by writing to privacy@piqod.it.

7. How long we retain your data

We follow the principle of storage limitation (Art. 5(1)(e) GDPR): data is retained only for the time strictly necessary for the purposes for which it was collected.

Data category	Retention period
Active user account	As long as the account is active + 30 days grace period after deletion request
Anonymized navigation and usage data (website and iOS app)	Up to 26 months (aligned with Google Analytics default)
Technical server logs	90 days, then anonymized or deleted
Transactional emails (SMTP log)	12 months
PIQOD Live content	24 hours from publication, then irreversibly deleted from database and storage
Database backups	30 days on off-site systems, cycled
Administrative audit log	24 months
Tax/accounting data	10 years (legal obligation)
DSA complaint management logs	6 months
Cookie consent records	Until revocation or account deletion

At term expiration, data is securely deleted or irreversibly anonymized (such that it can no longer be traced back to an individual).

8. Your rights as data subject

Under Art. 15-22 GDPR, you have the right to exercise the following powers on your personal data, at no cost and at any time:

8.1 Right of access (Art. 15)

You can obtain confirmation that we are processing data concerning you and receive a copy in structured, commonly used and machine-readable format (JSON).

From your profile → Privacy Dashboard you can autonomously download a ZIP archive complete with your data.

8.2 Right to rectification (Art. 16)

You can correct inaccurate data or integrate incomplete data, directly from your user profile or by writing to us.

8.3 Right to erasure ("right to be forgotten", Art. 17)

You can request deletion of your data, unless legal obligations apply. The request is processed within 30 days of receipt.

Deleting a PIQOD Live: you can delete your story at any time, with immediate effect, without waiting for the 24-hour expiration. One click from your profile.

Removing a tag: if you have been tagged in someone else's story and don't want to appear, you can request tag removal from the story via a dedicated button or email. We process the request within 72 hours.

8.4 Right to restriction (Art. 18)

You can request temporary suspension of processing of your data pending verification.

8.5 Right to portability (Art. 20)

You can request your data in a structured, commonly used and readable format, to transfer it to another controller.

8.6 Right to object (Art. 21)

You can object to processing based on legitimate interest (sections 4.2 and 4.3) and profiling processing.

8.7 Right not to be subject to automated decisions (Art. 22)

The Service uses automated algorithms for ranking and moderation, but none of these produce significant legal effects on the user. In any case, the user can request human intervention by contacting us.

8.8 How to exercise rights

Via Privacy Dashboard (fastest, self-service for access, export, deletion, consent management)
Via email: privacy@piqod.it (specifying the request and providing proof of identity if necessary)
Via certified mail: {{LEGAL_ENTITY_PEC}}

Our team responds within 30 days of receiving the complete request (extendable by a further 60 days in case of particularly complex requests, subject to notification).

8.9 Right to complain

If you believe that the processing of your data violates GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Italian Data Protection Authority: https://www.garanteprivacy.it
Supervisory authority of your EU state of habitual residence, place of work or alleged controller

9. Data security

We adopt technical and organizational measures appropriate to risks, including:

Technical:

Encryption in transit (TLS 1.3) on all connections
Encryption at rest for databases and storage (AES-256)
Password hashing with modern algorithms (bcrypt/argon2)
Network segregation between application components (edge, backend, database)
Mandatory two-factor authentication (2FA) for administrative access
Periodic rotation of cryptographic keys and secrets
Content moderation via local ML (no third-party transfer for this purpose)
Rate limiting, web application firewall (WAF) and DDoS protection
Audit log of all administrative operations with retention

Organizational:

Periodic staff training
Access policies based on least privilege principle (RBAC)
Internal code of conduct for data management
Incident response and 72-hour Garante notification procedures in case of breach

In case of data breach involving risks to rights and freedoms of data subjects, PIQOD will notify the Garante within 72 hours and inform affected users as required by Art. 33-34 GDPR.

10. Minors

The PIQOD Service is aimed at persons aged 14 and over (in Italy, under Italian Legislative Decree 101/2018) and 16 and over in other EU Member States unless explicit consent from a parent or guardian.

We do not intentionally collect data from minors under such age. If we discover we have done so, we delete the data as quickly as possible. Parents or guardians of minors can report the presence of a minor's account by writing to privacy@piqod.it to request its deletion.

If a user uploads a Live in which recognizable minors appear, PIQOD reserves the right to remove the content even without notification, to protect the minors represented.

11. User-generated content (UGC) — specific rules for PIQOD Live

The PIQOD Live service allows registered users to publish photographic content (up to 2 photos per "Live") visible to other registered users for 24 hours.

11.1 Usage license

By publishing a Live, the user retains ownership of the content but grants PIQOD a non-exclusive, free, worldwide license to use it solely for Service delivery purposes. This license automatically terminates when the Live expires or is deleted by the user.

PIQOD will not use UGC content for external advertising purposes, third-party sale, or training of generative AI models without further explicit consent.

11.2 Prohibited content

Content that will be removed includes:

Nudity, sexual acts or sexually explicit content
Depictions of violence, injury, animal cruelty
Incitement to hatred, discrimination, violence against persons or groups
Violations of third-party intellectual property rights (stolen photos, etc.)
Recognizable minors in inappropriate contexts
Personal information of third parties without consent (addresses, license plates, documents)
Promotion of illegal activities, scams, deceptive content
Unauthorized advertising spam

For more details see our Community Guidelines.

11.3 Automated moderation

Every photo uploaded is analyzed by a local ML model (NSFW.js) running on our servers, with no third-party transfer. The model assigns a safety score and:

Photos with safe score are published immediately
Photos with doubtful score are placed in manual review queue
Photos with clearly violating score are rejected with notification to the user

Users who believe a removal was incorrect can appeal via privacy@piqod.it within 14 days of notification. The appeal is examined by a human operator and resolved within 72 business hours.

11.4 Content reporting (DSA)

Under EU Regulation 2022/2065 (Digital Services Act), we have implemented a notice-and-action mechanism allowing any user to report content alleged to be illegal or in violation of community rules. Reporting occurs via the "Report" button on each Live.

Reports are examined in good faith and without delay. Content reported as manifestly illegal is removed as quickly as possible. The reporter and content author are provided with reasoning for the decision taken.

12. Automated decisions and profiling

The Service uses ranking and recommendation algorithms to order search results, suggest destinations, personalize experience. These algorithms:

Use user navigation data (if consent provided for behavioral category)
Use aggregated patterns from other users
Do not produce decisions with significant legal effects on the user (do not deny access to services, do not evaluate creditworthiness, do not discriminate in relevant ways)

The user has the right to:

Know the logic behind algorithms
Request human intervention for alternative assessment
Express their point of view and contest automatic decision

These rights are exercised by contacting privacy@piqod.it.

12-ter. Users outside the European Union

PIQOD is available in ten languages and is used by people living on different continents. Our processing is built on the GDPR, one of the most protective regimes in existence: we apply the same standard to every user, wherever they live, including where local law would require less.

In addition, we recognise the specific rights granted by the following regimes to those covered by them.

California (CCPA/CPRA) — We do not sell and do not share personal information for cross-context behavioural advertising, as those terms are defined under California law. You have the right to know which categories of data we process, to obtain a copy, to request deletion or correction, and not to be discriminated against for exercising those rights. Because we do not sell data, no "Do Not Sell or Share My Personal Information" control is needed: there is nothing to switch off.

United Kingdom (UK GDPR) — The rights described in section 8 apply in full. The competent supervisory authority is the Information Commissioner's Office (ICO).

Brazil (LGPD) — The rights of confirmation, access, correction, anonymisation, portability and deletion under art. 18 LGPD apply, in the same manner and within the same timeframes set out in section 8.

Canada (PIPEDA) — We collect, use and disclose personal information only for the purposes stated in this notice, with consent where required, and retain it only as long as those purposes require.

Switzerland (revFADP) — The rights of access, rectification and deletion under the Federal Act on Data Protection apply.

Japan (APPI) and South Korea (PIPA) — We process data for the stated purposes and do not disclose it to third parties for other purposes without a legal basis.

Where the data lives. Our servers are in the European Union. Anyone using PIQOD from outside the EU should be aware that their data is processed on European infrastructure, with the safeguards described in section 6.

Minors. The minimum age to register is stated in the Terms of Service. Where local law sets a higher threshold than the European one — for instance the age of 13 under the US COPPA for collecting children's data — the more protective of the two applies.

To exercise any of these rights, simply write to privacy@piqod.it, stating your country of residence. We do not ask for identity documents unless strictly necessary to verify account ownership.

13. Updates to this notice

We update this notice periodically to reflect regulatory, technological or Service changes. The date of the last update is indicated at the top of the document.

In case of substantial modifications (e.g. new categories of processed data, new providers, new purposes), we will inform registered users via email and prominent site notice, with at least 30 days advance notice before modifications take effect.

Continued use of the Service after modifications constitutes acceptance of them. Users who do not agree with modifications can always exercise their deletion right (section 8.3).

14. Contacts

For any question regarding this notice or the processing described:

Privacy email: privacy@piqod.it
General support email: info@piqod.it
PEC: {{LEGAL_ENTITY_PEC}}
Postal mail: PIQOD di Sorrentino Lucio, Via Somma n. 10, 80034 Marigliano (NA), Italy

We commit to respond within 30 days of every written request.

End of document.

Privacy Policy