Cookie Policy

1. What are cookies?

Cookies are small text files that the sites visited by users send to their terminals, where they are stored so as to be retransmitted to the same sites on the next visit. So-called “third-party” cookies are, instead, set by a website other than the one the user is visiting. This is because on every site there may be elements (images, maps, sounds, specific links to web pages of other domains, etc.) that reside on servers other than that of the visited site.

2. What are cookies used for?

Cookies are used for different purposes: carrying out computer authentication, monitoring sessions, storing information on specific configurations regarding the users who access the server, storing preferences, etc.

3. What are “technical” cookies?

These are the cookies used to carry out navigation or to provide a service requested by the user. They are not used for further purposes and are normally installed directly by the owner of the website.

Without the use of such cookies, some operations could not be carried out, or would be more complex and/or less secure, such as, for example, home banking activities (viewing bank statements, transfers, paying bills, etc.), for which cookies, which allow the user’s identification to be carried out and maintained within the session, are essential.

4. Are analytics cookies “technical” cookies?

No. The Italian Data Protection Authority (see the provision of 8 May 2014) clarified that they can be assimilated to technical cookies only if used for the purpose of optimising the site directly by the owner of the site itself, who may collect information in aggregate form on the number of users and on how they visit the site. Under these conditions, the same rules on information and consent provided for technical cookies apply to analytics cookies.

5. What are “profiling” cookies?

These are the cookies used to track the user’s navigation on the web and to create profiles of their tastes, habits, choices, etc. With these cookies, advertising messages in line with the preferences already expressed by the user during online navigation can be transmitted to the user’s terminal.

6. Is the user’s consent required to install cookies on their terminal?

It depends on the purposes for which the cookies are used and, therefore, on whether they are “technical” or “profiling” cookies.

For the installation of technical cookies the users’ consent is not required, but the information notice must be given (art. 13 of the Privacy Code). Profiling cookies, instead, can be installed on the user’s terminal only if the user has expressed their consent after being informed in a simplified manner.

7. How must the site owner provide the simplified information notice and request consent to the use of profiling cookies?

As established by the Data Protection Authority in the provision indicated under question no. 4, the information notice must be set up on two levels.

When the user accesses a website (on the home page or on any other page), a banner must immediately appear containing a first “brief” notice, the request for consent to the use of cookies and a link to access a more “extended” notice. On this page, the user will be able to find more detailed information about cookies and choose which specific cookies to authorise.

8. How must the banner be created?

The banner must be large enough to partly cover the content of the web page the user is visiting. It must be possible to remove it only through an active action by the user, that is, through the selection of an element contained in the page below.

9. What must the banner contain?

The banner must specify that the site uses profiling cookies, possibly including “third-party” ones, that allow advertising messages in line with the user’s preferences to be sent.

It must contain the link to the extended notice and the indication that, through that link, it is possible to refuse consent to the installation of any cookie.

It must specify that if the user chooses to continue by “skipping” the banner, they consent to the use of cookies.

10. How can the acquisition of consent obtained through the use of the banner be documented?

To keep track of the consent obtained, the site owner may make use of a specific technical cookie, a system that is not particularly invasive and that does not itself require further consent.

In the presence of such “documentation”, it is not necessary for the brief notice to be presented again on the user’s second visit to the site, without prejudice to the possibility for the user to refuse consent and/or to modify, at any time and easily, their choices, for example by accessing the extended notice, which must therefore be linkable from every page of the site.

11. Can online consent to the use of cookies be requested only through the use of the banner?

No. Site owners always have the possibility of resorting to methods other than the one identified by the Data Protection Authority in the provision indicated above, provided that the chosen methods have all the validity requirements of consent required by law.

12. Does the obligation to use the banner also apply to owners of sites that use only technical cookies?

No. In this case, the site owner can give the information notice to users in the ways they consider most suitable, for example, also by inserting the relevant indications in the privacy policy stated on the site.

13. What must the “extended” notice indicate?

It must contain all the elements provided by law, describe in detail the characteristics and purposes of the cookies installed by the site, and allow the user to select/deselect the individual cookies.

It must include the updated link to the notices and consent forms of the third parties with which the owner has entered into agreements for the installation of cookies through its own site.

It must, finally, recall the possibility for the user to express their choices regarding cookies also through the settings of the browser used.

14. Who is required to provide the information notice and to request consent for the use of cookies?

The owner of the website that installs profiling cookies.

For third-party cookies installed through the site, the information and consent obligations fall on the third parties, but the site owner, as a technical intermediary between them and the users, is required to insert in the “extended” notice the updated links to the notices and consent forms of the third parties themselves.

15. Must the use of cookies be notified to the Data Protection Authority?

Profiling cookies, which usually persist over time, are subject to the notification obligation, whereas cookies that have different purposes and fall into the category of technical cookies do not have to be notified to the Data Protection Authority.

16. When do the measures prescribed by the Data Protection Authority with the provision of 8 May 2014 come into force?

The Data Protection Authority provided for a transitional period of one year from the publication of the provision in the Official Gazette to allow the parties concerned to comply. This period will end on 2 June 2015.