Privacy policy

Last updated: 2026-10-10

Information provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 to users of the Scovago search engine.

1. Data controller

The controller is OKSitiweb Torino, C.so Francia 122 10098 Rivoli Torino — VAT/tax no. IT10247300014. Privacy contact: privacy@su24.it · certified email (PEC) pec@su24.it. Data Protection Officer (DPO): [to be completed].

2. In short

• You can search without an account: your searches are not stored, not linked to you and not used to profile you.
• We do not sell personal data and we do not use profiling or analytics cookies.
• Third-party content (maps) is loaded only if you consent.
• For features that need an account (submitting sites, Webmaster Tools, ads, map listings) we process only the data we need.

3. Data, purposes and legal bases

Search and browsing. Search text is used only to return results and is neither logged nor linked to a profile. Like any website, our servers record technical data (IP address, date and time, requested page, browser) for operation and security; legal basis: legitimate interest (Art. 6(1)(f) GDPR); kept for a limited time, normally up to 30 days depending on the hosting settings.

Security and abuse prevention. To limit excessive requests we keep counters tied to the IP address for a short time (at most one hour); for reports and ad clicks we keep a non-reversible hash of the IP. Legal basis: legitimate interest.

Accounts. Email address, password (stored only as a hash), role, language, confirmation that you are at least 14, last sign-in date and, if you enable it, the two-step verification secret (encrypted) and recovery codes (hashed). Legal basis: performance of a contract (Art. 6(1)(b)). Retention: until the account is deleted.

Webmaster Tools and map listings. Domains you manage, verification codes, sitemaps; for listings: company name, address, coordinates, phone, VAT number and certified email (PEC) supplied by the requester. The PEC is used only to send the verification code and to check that the company exists. Legal basis: contract and legitimate interest in publishing reliable information.

Ads and payments. Company and tax data, balance and transactions, top-ups. Online payments are processed by Stripe, PayPal and Satispay, acting as independent controllers: Scovago neither sees nor stores card data. Legal basis: contract and legal obligation (Art. 6(1)(c)) for accounting; kept for 10 years.

Reports of illegal content. Page address, category, notes, optional email and IP hash, to review the report and comply with legal duties (Regulation (EU) 2022/2065 and Legislative Decree 70/2003).

Location, maps and routes. Your device location is used only if you provide it with a click and is not stored. To show nearby businesses and routes we send coordinates to our servers, which process them and, to compute routes and find addresses, query third-party services (OSRM and Nominatim) without sending other personal data.

System emails. We use an SMTP service to send activation emails, codes and service messages.

4. Recipients and transfers outside the EU

Data may be processed by providers acting as processors (hosting, email) and by the payment providers above. With your consent, the map loads tiles and scripts from the OpenStreetMap Foundation and unpkg (Leaflet): these services receive your IP address. Stripe and PayPal may transfer data outside the European Economic Area with appropriate safeguards (adequacy decisions or standard contractual clauses).

5. Images, videos and result links

Previews, images and thumbnails in results are loaded from the original sites: those sites can see your IP address. Result links open in a new window without sending your search (no referrer).

6. Minors

The search service can be used by anyone, including minors, without registration. Registration is reserved for people aged 14 or over (Art. 2-quinquies of the Italian Privacy Code); under 14, the consent of a parent or guardian is required. We do not knowingly collect data from children under 14: if you know of any, write to us and we will delete it.

7. Your rights

You can ask for access, rectification, erasure, restriction, portability, and object to processing (Arts. 15-22 GDPR) by writing to privacy@su24.it (or the PEC pec@su24.it). Where processing is based on consent you may withdraw it at any time without affecting past processing. You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. Security

We apply appropriate technical and organisational measures: encrypted connections, hashed passwords, encrypted secrets, request limits, access controls and an administrator action log.

9. Changes

We may update this notice; the date of the last update is shown at the top.