Privacy Policy

Last updated: 28 July 2026

1. About this Privacy Policy

This Privacy Policy explains how personal data are collected and processed through the website lead-tourism.eu (the “Website”).

The Website is the institutional information platform of LEAD Tourism, an Erasmus+ Capacity Building in VET project supporting accessible and digitally enabled tourism through training, cooperation and the development of project resources.

The Website is primarily intended to:

  • provide information about the LEAD Tourism project;

  • explain the project’s objectives and activities;

  • present the project partnership;

  • provide information about the learning programme and the LEAD Tourism League;

  • make project resources and outputs available;

  • allow users to contact the project team.

The Website does not directly host the project’s online training activities. Training is provided through a separate external Moodle platform.

2. Data Controller

The Data Controller is:

Cosvitec S.r.l.
Via Galileo Ferraris 171
Naples, Italy
VAT number: 07838020639
Email: info@cosvitec.eu

The Data Controller determines the purposes and means of the personal data processing described in this Privacy Policy.

Cosvitec has not appointed a Data Protection Officer.

Questions or requests concerning the processing of personal data may be sent to info@cosvitec.eu.

3. Personal data processed through the Website

The categories of personal data processed depend on how users interact with the Website.

3.1 Browsing and technical data

When users visit the Website, the information systems and software used to operate it may automatically process technical information such as:

  • IP address;

  • date and time of access;

  • requested pages and resources;

  • referring website or page;

  • browser type and version;

  • operating system;

  • device type;

  • language and display settings;

  • technical logs;

  • information relating to errors, security events or abnormal activity.

These data are generated automatically during normal use of the Internet and are necessary to display, operate, maintain and protect the Website.

3.2 Contact form data

Users may contact the LEAD Tourism project through the contact form available on the Website.

The form collects the following mandatory information:

  • name;

  • email address;

  • enquiry type;

  • message.

Users must also confirm that they have read this Privacy Policy before submitting the form.

The privacy checkbox confirms that the user has read the relevant privacy information. It does not constitute consent to receive marketing, advertising or newsletter communications.

The contact form is used exclusively to receive and respond to enquiries relating to the LEAD Tourism project.

The Website does not currently use the form to send newsletters or promotional communications.

Users should not include special categories of personal data, confidential information or unnecessary information concerning third parties in their messages.

3.3 Analytics data

Subject to the user’s consent, the Website uses Google Analytics 4 to collect statistical information about Website traffic and use.

Analytics information may include:

  • pages visited;

  • events and interactions with Website content;

  • session duration;

  • traffic source;

  • approximate geographic location;

  • browser and device information;

  • language;

  • screen resolution;

  • technical identifiers generated through cookies or similar technologies.

Analytics data are used to understand how visitors use the Website and to improve its content, navigation, accessibility and performance.

Google Analytics is not used by Cosvitec for advertising, commercial profiling or automated decision-making.

3.4 Google Tag Manager

The Website uses Google Tag Manager to manage the implementation of analytics tags.

Google Tag Manager is a tag-management tool. Its presence does not, by itself, determine the purposes for which personal data are processed.

The Google Analytics tags managed through Google Tag Manager are activated only after the user has provided consent through the Website’s cookie banner.

If analytics consent is refused or withdrawn, the analytics tags must remain inactive.

3.5 Cookies and consent preferences

The Website uses cookies and similar technologies necessary for its operation and, subject to consent, analytics technologies.

Cookie preferences are managed through Complianz.

The Website may use:

  • strictly necessary cookies;

  • WordPress technical or session cookies;

  • Elementor-related technical resources;

  • WPForms-related technical resources;

  • cookies used to store consent preferences;

  • security cookies;

  • session cookies;

  • Google Analytics cookies, subject to consent.

Strictly necessary cookies are used without consent where they are required to provide the Website, maintain security or remember the user’s privacy choices.

Analytics cookies are activated only after the user has provided consent.

Users may accept, refuse or manage analytics cookies through the Complianz banner and may change or withdraw their preferences at any time through the cookie settings function available on the Website.

Additional details about individual cookies, providers, purposes and durations are provided in the Website’s separate Cookie Policy.

3.6 Google Fonts

The Website may load fonts provided through the Google Fonts service.

When fonts are retrieved directly from Google’s servers, the user’s browser connects to Google and may transmit technical information, including the user’s IP address, browser information and the requested resource.

Where remote Google Fonts are used, they must be activated in accordance with the user’s privacy preferences and applicable data-protection requirements.

To minimise the communication of personal data to third parties, the Data Controller may replace remote Google Fonts with locally hosted font files.

4. Purposes and legal bases of processing

4.1 Operating, maintaining and securing the Website

Browsing and technical data are processed to:

  • provide access to the Website;

  • display Website pages and content;

  • maintain Website functionality;

  • identify and resolve technical errors;

  • protect the Website against unauthorised access, misuse, cyberattacks and fraud;

  • monitor the security of the Website and its infrastructure;

  • maintain technical and security records;

  • establish, exercise or defend legal claims.

The legal basis is the legitimate interest of the Data Controller in operating and protecting its institutional Website, pursuant to Article 6(1)(f) of the General Data Protection Regulation.

Where processing is necessary to comply with a legal obligation, the legal basis is Article 6(1)(c) of the General Data Protection Regulation.

4.2 Responding to contact requests

Contact form data are processed to:

  • receive and respond to enquiries;

  • provide information about the LEAD Tourism project;

  • respond to questions concerning the learning programme, project resources, partnership or LEAD Tourism League;

  • identify the project staff member or EU-based partner best placed to answer the request;

  • maintain records of relevant project communications.

The legal basis is the legitimate interest of Cosvitec in responding to enquiries concerning the project, pursuant to Article 6(1)(f) of the General Data Protection Regulation.

Where a request concerns steps taken at the user’s request before entering into a formal relationship or agreement, processing may also be based on Article 6(1)(b) of the General Data Protection Regulation.

4.3 Measuring and improving Website use

Subject to the user’s consent, analytics data are processed to:

  • measure Website traffic;

  • understand how users navigate the Website;

  • identify frequently visited content;

  • evaluate the effectiveness of project communication and dissemination;

  • improve Website content, structure, accessibility and user experience;

  • produce aggregated project statistics and reports.

The legal basis is the user’s consent, pursuant to Article 6(1)(a) of the General Data Protection Regulation.

Consent may be withdrawn at any time through the Website’s cookie settings.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Nature of providing personal data

The processing of technical data necessary to provide the Website is unavoidable when a user accesses it.

Providing information through the contact form is voluntary. However, all form fields are mandatory because the requested information is necessary to understand and respond to the enquiry.

Failure to provide the mandatory information will prevent the user from submitting the form or receiving a response.

Consent to analytics cookies is optional.

Refusing or withdrawing analytics consent does not prevent users from accessing the Website or its institutional content.

6. How personal data are processed

Personal data are processed using electronic systems and organisational procedures appropriate to the purposes described in this Privacy Policy.

Cosvitec adopts reasonable technical and organisational measures intended to protect personal data against:

  • unauthorised or unlawful access;

  • accidental loss;

  • alteration;

  • unauthorised disclosure;

  • destruction;

  • misuse.

Access to personal data is limited to authorised persons who need the information to perform their project-related or technical duties.

Although appropriate safeguards are adopted, no method of online transmission or electronic storage can guarantee absolute security.

7. Recipients of personal data

Personal data may be accessed or processed by:

  • authorised personnel of Cosvitec;

  • members of the Cosvitec team responsible for the LEAD Tourism project;

  • EU-based LEAD Tourism project partners, only where their involvement is necessary to respond to a specific enquiry;

  • the Website hosting provider operating under the DominiOK brand;

  • authorised Website administration and technical support personnel;

  • email service providers;

  • Google Ireland Limited and other relevant Google entities, in connection with Google Analytics, Google Tag Manager and remote Google Fonts;

  • providers involved in Website security, maintenance or system administration;

  • professional advisers where necessary;

  • courts, public authorities or law-enforcement bodies where disclosure is required by law.

EU-based project partners receive only the information reasonably necessary to respond to the relevant request.

Contact form submissions are not routinely distributed to every project partner.

Contact form data are not routinely disclosed to LEAD Tourism partners located outside the European Economic Area.

Service providers processing personal data on behalf of Cosvitec are appointed and managed as data processors where required by Article 28 of the General Data Protection Regulation.

Personal data are not sold or rented to third parties.

8. Website hosting

The Website is hosted through DominiOK.

The hosting provider may process technical data necessary to:

  • make the Website available;

  • manage server infrastructure;

  • maintain security and continuity;

  • create and manage technical backups;

  • diagnose errors;

  • maintain access and security logs.

The exact physical location of the server infrastructure may depend on the hosting plan and technical arrangements adopted by the provider.

Where hosting or backup infrastructure involves processing outside the European Economic Area, the Data Controller will ensure that an appropriate legal transfer mechanism and suitable safeguards are in place.

9. Google Analytics

The Website uses Google Analytics 4, provided by Google Ireland Limited, subject to the user’s consent.

Google Analytics may use cookies or similar identifiers to produce statistics relating to Website use.

For visitors located in the European Union, Switzerland or the United Kingdom, Google states that IP addresses are used to derive approximate geographic information and are discarded before being logged or stored by Google Analytics.

Google Analytics may nevertheless process:

  • device and browser information;

  • Website interaction data;

  • approximate location data;

  • cookie identifiers;

  • session and event information.

Cosvitec does not intentionally send names, email addresses, contact form content or other directly identifying information to Google Analytics.

Google Analytics must not be configured to collect personal information entered into the contact form.

Google Analytics is used exclusively for Website measurement and aggregated statistical analysis.

Google advertising services, Google Ads and advertising remarketing features are not used through the Website.

10. International data transfers

Contact form data are processed by Cosvitec and, where necessary, EU-based project partners.

They are not routinely transferred to project partners located outside the European Economic Area.

Some third-party technology providers, particularly Google, may process information through infrastructure or group companies located outside the European Economic Area.

Where an international transfer takes place, it will be based on a transfer mechanism permitted under the General Data Protection Regulation, such as:

  • an adequacy decision adopted by the European Commission;

  • Standard Contractual Clauses approved by the European Commission;

  • another legally recognised transfer mechanism.

Where necessary, supplementary technical, contractual or organisational safeguards will be applied.

Users may contact Cosvitec for further information about the safeguards applicable to a particular transfer.

11. Data retention

Personal data are retained only for as long as necessary for the purposes for which they were collected.

Contact requests

Contact form submissions and related project correspondence may be retained for the duration of the LEAD Tourism project and for up to 12 months after the end of the project or the closure of the request.

Information may be retained for a longer period where this is necessary to:

  • comply with a legal obligation;

  • manage a dispute;

  • establish, exercise or defend a legal claim;

  • comply with Erasmus+ project reporting, auditing or record-keeping obligations.

Google Analytics

Google Analytics event-level and user-level data are retained for a period of two months.

Aggregated statistics that no longer allow individual users to be identified may be retained for longer for project reporting, communication and evaluation purposes.

Technical and security logs

Technical and security logs are retained for the period established by the hosting and security providers and, in any event, only for as long as necessary to ensure Website operation, investigate security incidents and comply with legal obligations.

Consent records

Records relating to cookie preferences and consent may be retained for as long as necessary to:

  • remember the user’s preferences;

  • demonstrate that consent was obtained or withdrawn;

  • comply with applicable data-protection requirements.

Backups

Personal data contained in technical backups are deleted according to the applicable backup rotation schedule.

Where immediate deletion from a backup is not technically possible, the data will not be restored or otherwise processed except where necessary for security, continuity or disaster recovery.

At the end of the applicable retention period, personal data are deleted, anonymised or securely archived where continued retention is required by law.

12. Data relating to minors

The Website is not specifically directed at children and does not intentionally request personal data from minors.

Because the LEAD Tourism project concerns vocational education and training, some Website visitors or project participants may be under the age of majority.

Minors should not submit personal data through the contact form without the involvement or authorisation of a parent, guardian, teacher or other responsible adult, where appropriate.

Cosvitec does not use the Website to create student accounts, deliver training directly or systematically collect information relating to minors.

If Cosvitec becomes aware that personal data relating to a minor have been submitted without an appropriate legal basis or authorisation, it will take reasonable steps to delete or appropriately manage those data.

Parents or legal guardians may contact info@cosvitec.eu concerning data submitted by a minor.

13. Automated decision-making and profiling

The Website does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.

The Website does not carry out commercial profiling.

Aggregated analytics may be used to understand general visitor behaviour and improve Website content.

14. Rights of data subjects

Under the General Data Protection Regulation, users may have the right to:

  • obtain confirmation as to whether their personal data are being processed;

  • access their personal data;

  • request the correction of inaccurate or incomplete data;

  • request the deletion of their personal data where the applicable conditions are met;

  • request the restriction of processing;

  • object to processing based on legitimate interests;

  • receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;

  • withdraw consent at any time;

  • obtain information about safeguards used for international data transfers;

  • lodge a complaint with a competent data-protection supervisory authority.

The exercise of these rights may be subject to the conditions and limitations established by applicable law.

Requests may be submitted to:

Cosvitec S.r.l.
Email: info@cosvitec.eu

Cosvitec may request information reasonably necessary to verify the identity of the person making the request.

15. Right to object

Users have the right to object, on grounds relating to their particular situation, to processing based on the legitimate interests of the Data Controller.

Where a valid objection is submitted, Cosvitec will stop processing the personal data unless it demonstrates compelling legitimate grounds that override the user’s interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint

Users who believe that their personal data have been processed unlawfully may lodge a complaint with the competent supervisory authority.

For processing carried out by Cosvitec in Italy, the relevant authority is:

Garante per la protezione dei dati personali

Users may also contact the supervisory authority of the European Union or European Economic Area country in which they habitually reside or work, or where the alleged infringement occurred.

17. External links and Moodle learning platform

The Website contains or may contain links to:

  • the external LEAD Tourism Moodle learning platform;

  • project partner websites;

  • institutional websites;

  • third-party resources.

The Website only provides a link to the Moodle platform and does not directly transmit contact form data or Website account data to Moodle.

When users access Moodle or another external website, their personal data may be processed by the operator of that service according to its own privacy policy.

The privacy practices, security and content of third-party websites are governed by the relevant external operators.

Users should read the privacy information provided by the Moodle platform and other external services before creating an account or submitting personal data.

18. Social media

The Website does not currently use social media tracking pixels, embedded social media feeds or social login tools.

If simple links to social media pages are added, personal data will be transmitted to the relevant platform only when the user chooses to follow the link.

If embedded social media content or tracking technologies are introduced in the future, this Privacy Policy and the Website’s cookie settings will be updated accordingly.

19. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect:

  • changes to the Website;

  • changes to project activities;

  • the introduction or removal of services and technologies;

  • changes to recipients or service providers;

  • changes to applicable legal or regulatory requirements.

The latest version will be published on this page together with the date of the most recent update.

Where appropriate, material changes will be communicated through a notice on the Website.

20. Contact details

Questions, requests or concerns concerning this Privacy Policy or the processing of personal data may be addressed to:

Cosvitec S.r.l.
Via Galileo Ferraris 171
Naples, Italy
VAT number: 07838020639
Email: info@cosvitec.eu

Scroll to Top