Cookie Policy

Cookie Policy

Table of contents

1. What cookies are

2. Types of tools used on www.smoves.it

3. Necessary tools

4. Measurement tools

5. Advertising and third-party tools

6. Banner and preference management

7. Storage and duration

8. Rights of the Data Subject and contacts

1. What cookies are

1.1 Cookies are small text files that visited websites send to the user's device, where they are stored to be sent back to the website on each subsequent visit.

1.2 Together with cookies, other tools may operate which store information on the user's device or access it, such as the browser's local storage (localStorage) and pixels ("tracking tools"). This policy applies to all such tools, including where for brevity only the word "cookie" is used.

2. Types of tools used on www.smoves.it

2.1 On www.smoves.it, tools of three categories are used, corresponding to the choices offered by the banner referred to in art. 6:

• necessary: they are needed for the operation of the website and of the services requested by the user, and do not require consent;

• measurement: they are used to understand how the website is used and where users encounter difficulties. They operate in full form only subject to consent; without consent, only the tools referred to in points 4.1 and 4.2 that do not identify the user operate;

• advertising: they are used to measure the results of Smoves' advertising campaigns and to show relevant advertisements on third-party platforms, and are activated only subject to consent.

3. Necessary tools

3.1 Necessary tools are used for the sole purpose of carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary to provide a service explicitly requested by the user. For these tools, prior consent is not required, pursuant to art. 122 of Italian Legislative Decree 196/2003.

3.2 This category includes:

• authentication and session cookies for the reserved area, provided through Supabase;

• the cookie that remembers the language chosen by the user;

• the cookie that maintains the conversation started in chat by a non-registered user;

• the cookie that allows a booking left incomplete to be resumed through the link received by email;

• the storage, in the browser's local memory, of the choices expressed through the banner and of the data of a booking being filled in;

• the security and anti-fraud cookies set by Stripe on the payment pages;

• the tools set by Google Maps when the user uses address autocomplete in the quote and booking forms;

• the cookie that excludes Smoves' internal traffic from the statistics.

4. Measurement tools

4.1 Aggregated statistics without consent. Smoves measures visits to the website with two tools that do not identify the user and do not allow their profiling: (i) Vercel Web Analytics and Vercel Speed Insights, which do not use cookies and produce only aggregated data on pages viewed and loading speed; (ii) a first-party counter, which stores in the browser a random identifier free of personal data, together with the referring page and campaign, for the purpose of counting visitors, reconstructing, in aggregated form, how many of them complete a request, and assigning the page versions referred to in point 4.4. Such data are not communicated to third parties or cross-referenced with other information, and are therefore assimilated to technical tools pursuant to the Decision of the Italian Data Protection Authority (Garante) of 10 June 2021.

4.2 Smoves also uses PostHog (PostHog Inc., European instance: data is processed on servers located in the European Union). The tool operates in two modes. Without consent to the "measurement" category it operates in ANONYMOUS MODE: it installs no cookies or other persistent identifiers on the device, does not collect the IP address, creates no profiles, and masks the content of all fields filled in by the user before transmission; the technical session identifier stays in the browser's volatile memory and does not allow successive visits to be linked to one another. With consent to the "measurement" category it operates in FULL MODE, which adds persistent identifiers and the recording of text typed into forms, except for the tax code and VAT number, which remain masked. With consent to the "measurement" category the data collected is also linked to the user's identity, where this is known to Smoves because the user has signed in, has left their contact details in a quote form, or has completed a booking: the profile is associated with email address, name, telephone number and, where provided, university, city and language. The purpose is to trace a navigation difficulty back to the request that generated it. Such data is not used for advertising profiling.

4.3 In both modes PostHog collects: the pages visited and interactions with page elements; aggregated maps of where users click and how far they scroll; recordings of the browsing session, reproducing movements and clicks. Restricted-access pages and pages reachable via a personal link are excluded. The purpose is to identify the points of the site where users encounter difficulties and to correct them. The user may object at any time through the "Cookie preferences" link in the footer.

4.4 To improve the website, we may show different visitors different versions of the same page and compare the results in aggregated form. The assignment uses the anonymous identifier described in point 4.1 and does not involve profiling.

5. Advertising and third-party tools

5.1 Google Ads. Smoves uses the Google tag (Google Ireland Ltd) to measure the conversions of its advertising campaigns, in Consent Mode v2. Before consent, or in the event of refusal, the tag neither writes nor reads any cookie or identifier on the user's device and does not personalise advertisements: it only transmits to Google signals free of identifiers, from which Google derives aggregated estimates. Loading the script still entails, like any network request, the communication to Google of the user's IP address. Only subject to consent to the "advertising" category does the tag use cookies and advertising identifiers to attribute conversions and to personalise advertisements. Subject to consent, and limited to users who have signed in, a pseudonymous account identifier is transmitted to the tag, allowing Google to attribute visits made from different devices to the same user. Subject to consent to the "advertising" category, for purchases made on the website the email address and telephone number given in the booking may be transmitted to Google in encrypted form using the SHA-256 hash function, together with the IP address recorded when the contractual documents were accepted, for the sole purpose of allowing Google to attribute conversions correctly. The email address and telephone number are never transmitted in clear text and the hash function is not reversible. The user's name is not transmitted to Google.

5.2 Meta Pixel. Smoves may use the Meta Pixel (Meta Platforms Ireland Ltd) to measure the results of campaigns on Facebook and Instagram and to show advertisements to those who have visited the website. The Pixel remains in a revoked consent state, and transmits no event, until the user gives consent to the "advertising" category. Subject to consent to the "advertising" category, the user's email address and telephone number may be transmitted to the Pixel in encrypted form using the SHA-256 hash function, for the sole purpose of allowing Meta to recognise one of its own users and to attribute conversions correctly. The data is never transmitted in clear text and the hash function is not reversible.

5.3 These tools may involve the transfer of personal data to the United States of America, on the basis of the instruments indicated in art. 8 of the Privacy Policy. For the processing carried out by Google and Meta as autonomous controllers, reference is made to their respective notices.

5.4 Smoves does not use its own profiling cookies.

6. Banner and preference management

6.1 On first access to the website, the user is shown a banner compliant with the Decision of the Italian Data Protection Authority (Garante) of 10 June 2021, which allows the user to:

• accept all tools;

• reject all non-necessary tools;

• customise their choices by category ("measurement" and "advertising").

6.2 The user may at any time modify or withdraw their choices through the "Cookie preferences" link in the website's footer. Withdrawal does not affect the lawfulness of processing carried out before it.

6.3 The user may also manage cookies through their browser settings. Disabling necessary tools may compromise the proper functioning of the website.

6.4 The choice expressed by the user is recorded by Smoves together with the date, the version of the banner and the version of the information documents in force at that time, in order to be able to demonstrate that it was obtained pursuant to Art. 7 GDPR. The record includes neither the IP address nor any personal identification data.

7. Storage and duration

7.1 The duration of the tools used varies depending on their type. Session cookies are deleted when the browser is closed; persistent cookies normally have a duration not exceeding 12 months, except in cases where technical reasons justify different durations. The durations of third-party cookies are indicated in their respective notices.

7.2 The choice expressed by the user through the banner is stored for 6 months, after which the banner is shown again. The banner is shown again before that term in the event of substantial changes to the tools used.

8. Rights of the Data Subject and contacts

8.1 The user may exercise the rights provided by artt. 15-22 GDPR by writing to info@smoves.it, as indicated in the Privacy Policy.

8.2 The user has the right to lodge a complaint with the Italian Data Protection Authority (Garante) (https://www.gpdp.it).