Cookie policy

Updated: 29 October 2026.

This notice describes cookies, browser storage and external services used by bagnoamedea.com. The controller is Il Maestrale S.n.c., VAT/Tax Code 02628450468, Via G. Barellai 5, 55049 Viareggio (LU), Italy; email: ilmaestralesnc@gmail.com. A cookie is a small item stored by your browser; local storage and session storage are other forms of storage on your device.

Your choices

You can accept all, reject optional services or select individual preferences in the banner. Use “Cookie preferences” in the footer at any time to change your choice or withdraw consent. Optional Maps and Google measurement are blocked on the main website until the corresponding permission is given. Necessary site operation does not require optional consent, and rejecting optional services does not prevent access to the site's ordinary content.

The first-party cookie ba_consent remembers your categories, choice time and policy version for six calendar months. It is a functional preference cookie, not an advertising identifier. A new choice may be requested after expiry, deletion or a relevant configuration change. Withdrawal stops subsequent optional loading and removes known accessible first-party measurement cookies; it cannot erase data already received by an external provider or cookies on that provider's domain. Browser settings can also delete or block cookies and site storage. Clearing site data removes the remembered choice.

Other necessary storage

The main site's language switcher temporarily uses amedea-language-position in session storage to restore your reading position when moving between Italian and English. Its navigation value is valid for 30 seconds and is removed after restoration; session storage also ends when the tab session closes. It is not used for tracking. Only in the staff area, reserved for authorised staff, Cloudflare Access sets the CF_Authorization cookie, which remembers the sign-in for up to one month, and the technical ba_flash cookie shows a confirmation message for a few seconds after saving; neither is used for ordinary public browsing. Cloudflare may set its own technical security cookies (for example __cf_bm or cf_clearance) only when needed to protect a request from automated traffic or abuse.

Google Analytics, Google Ads and Tag Manager

The website uses Google Tag Manager (GTM-WJ4745TF) to load the Google tag. The tag destinations verified on 29 October 2026 are Google Analytics 4 (G-EJ0293JP92), for website and restaurant-menu statistics, and Google Ads (AW-11179563748), for the advertising features described below.

Analytics measures page views, interactions, traffic sources and browser/device information using pseudonymous identifiers. The Ads destination supports advertising measurement and, depending on account settings and consent, personalisation features. The container loads only after you accept Statistics. If you do not also accept Marketing, advertising signals (Google Ads) stay denied: Google Analytics measures visits without advertising cookies. Marketing alone or Maps permission alone does not load it. The tag receives separate consent signals for analytics_storage, ad_storage, ad_user_data and ad_personalization.

Analytics can use the first-party cookies _ga and _ga_EJ0293JP92 to distinguish visitors and retain session state. Google's documented default expiry is two years, subject to browser limits and account settings. Google Ads may use attribution identifiers such as _gcl_au (default lifetime 90 days), depending on the features actually enabled. Cookies on Google domains can vary with the service, browser and Google account sign-in status. See the Analytics documentation and Google advertising and measurement cookie information. Cookie lifetimes are separate from retention of collected data, which is governed by account settings and the service policies.

Maps, bookings and external links

Google Maps is an optional embedded service. The map loads only after you separately allow Maps; this does not grant Statistics or Marketing consent. Loading it sends Google your IP address and browser/request information. Google may read or set its own cookies, depending on your browser, Google sign-in status and its service settings. Google's cookie information explains these uses and durations.

Sunshade and sunbed booking buttons open Spiagge.it on an external page; the current main website does not automatically embed its booking widget. The booking notice on our privacy page remains available, together with Spiagge.it's own privacy policy. The receiving service manages its own cookies and privacy choices. WhatsApp, social media and Google review links are ordinary outgoing links; opening them subjects your visit to the receiving service's policies. Fonts, background video, photographs and displayed review excerpts on the main website are served locally, without loading the former review or font widgets.

The restaurant menu

The restaurant menu uses no session cookie. If you choose another language, your choice is remembered in local storage (ba_lang) and in a first-party technical cookie, ba_lang, valid for six months, so that our server can send you the menu already translated; both are removed when you switch back to Italian. Translations are prepared on our server with DeepL (DeepL SE, Germany): only the menu texts are sent to DeepL, never any visitor data, and your browser does not contact any translation service. So that a daily notice you have closed is not shown again during the same visit, the menu uses session storage (amedea-notice-dismissed), which ends when the tab is closed. The menu shows no cookie banner: Google measurement is loaded there only if Statistics have already been allowed on the main website, and advertising signals stay denied unless you also allowed Marketing. You can change your choice from “Cookie preferences” on the main website.

Service providers and international transfers

The website and the menu are hosted and delivered by Cloudflare (Cloudflare, Inc.), which necessarily receives connection information such as IP address, requested resource, request time and browser information to deliver and protect the website. Technical-log retention depends on the Cloudflare service and its settings. To limit excessive requests, our application derives a fingerprint from the IP address using a SHA-256 hash: the rate-limit counters do not store the plain IP address. This does not prevent Cloudflare from receiving the connection data needed to provide its service. The menu, opening hours and notices are stored with Cloudflare together with the account name of the staff member who changed them. Menu translations are prepared with DeepL (DeepL SE, Germany), which receives only the menu texts.

Google services may process information outside the European Economic Area, including in the United States. Google's privacy policy and international transfer information describe its processing and the adequacy decisions, Data Privacy Framework and standard contractual clauses it relies on, as applicable. Cloudflare also operates an international network and may process data outside the European Economic Area, including in the United States, relying on the Data Privacy Framework and the standard contractual clauses described in its notice. You may contact the controller for information about the safeguards applicable to your data and how to obtain a copy. Consent to a website feature does not replace the safeguards required for international transfers.

Your rights and contact

You may request access, correction, erasure, restriction and portability where applicable, object to processing based on legitimate interests, and withdraw consent at any time. Write to ilmaestralesnc@gmail.com. You may complain to the Italian Data Protection Authority or another competent supervisory authority; UK visitors may contact the ICO where applicable. The cookie preference panel changes future website permissions; requests concerning data already held should be sent to the controller or the relevant provider.