This notice is provided pursuant to Article 122 of Legislative Decree 196/2003 (Italian Personal Data Protection Code) and to the Guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority (Garante per la protezione dei dati personali) on 10 June 2021. It describes the cookies and similar tools used on the website www.termestufedinerone.it (the "Site"), the third parties that receive data as a result of browsing, and how the User can give, change or withdraw consent.
It forms an integral part of the privacy notice, to which reference is made for anything not expressly stated here. Last revised: 1 November 2026.
Cookies and similar tools
Cookies are small text files that the websites visited store in the User's browser and that the browser sends back to the same websites on subsequent visits. They make it possible, for example, to stay logged in to the private area, to keep the contents of the cart during a purchase and to remember the choices made about cookies.
The same rules apply to tools that, using technologies other than cookies, store information on the User's device or access information already stored there, such as the browser's local storage. Those used by the Site are listed in this notice.
Types of cookies
By duration, there are session cookies, deleted when the browser is closed, and persistent cookies, which remain stored until the expiry stated in this notice or until the User deletes them.
By origin, there are first-party cookies, set by the Site, and third-party cookies, set by parties other than the Controller through components loaded by the Site. The third parties that set cookies are named in this notice.
By purpose, there are:
- technical cookies, needed for the Site to work or to provide services requested by the User, for which consent is not required;
- statistics cookies, which measure how the Site is used;
- marketing cookies, which measure the effectiveness of the Controller's advertising campaigns on Google, Meta and TikTok platforms.
Statistics and marketing cookies are used only with the User's consent.
Technical cookies
The cookies listed below are needed for the Site to work or to provide services expressly requested by the User. Under Article 122 of Legislative Decree 196/2003 their use does not require consent; they are nonetheless listed in the following table.
| Name | Duration | Purpose |
|---|---|---|
SSESS… |
About 23 days | Keeps the User's session. It is set when the User logs in to the private area or adds a product to the cart, starts a purchase or a booking. The full name includes an identifier that depends on the domain. |
cookie-agreed, cookie-agreed-categories, cookie-agreed-version |
6 months | Store the User's choices about cookies that require consent and the version of the notice they refer to. |
Drupal.visitor.name, Drupal.visitor.mail |
1 year | Set only when an unregistered User sends a message through the contact form: they remember the name and email address entered, so that they are already filled in for the next message. |
modal_ads_… |
7 days | Remembers that the User has already seen a promotional message in a pop-up window, so that it is not shown on every page. The full name includes the number of the message. |
SS_deltaBuffer (browser local storage) |
Until deleted | Makes scrolling with the mouse wheel smooth. It contains no data about the User. |
cf_clearance |
30 minutes | Third-party cookie set by Cloudflare, only when the User is subjected to an anti-bot check. It certifies that the check was passed, so that it is not repeated on every request. |
Statistics cookies
The Site uses Google Analytics 4, a service provided by Google, for statistical analysis of the use of the pages and of purchases. The cookies _ga and _ga_7X9PB89GWV have a declared maximum duration of two years, reduced to about thirteen months by the most recent browsers, and are stored only with the User's consent to the "Statistics" category.
The Site uses Google's consent mode (Consent Mode) in its so-called advanced version. Without consent, the Google component is still loaded and sends Google communications without identifiers, without storing or reading cookies on the User's device; these communications include the IP address, the characteristics of the browser and the address of the page visited. Google uses them to estimate, in aggregate form, the data of visits that are not measured. The legal basis for this processing is stated in the privacy notice.
With the User's consent to the "Marketing" category, Google's advertising features (Google Signals) are also active on the Site's Google Analytics property; they involve communications to stats.g.doubleclick.net and www.google.it/ads/ga-audiences.
The Site's Google Analytics property is linked to the Controller's Google Ads account. With the User's consent to the "Marketing" category, the data collected by Google Analytics is also used to measure the effectiveness of campaigns and to create audiences, that is, groups of visitors to the Site to whom the Controller can show its ads on Google platforms (remarketing).
Marketing cookies
With the User's consent to the "Marketing" category, the Site uses the following tools to measure conversions, that is, purchases completed after one of the Controller's ads.
Google Ads, a service provided by Google. The first-party cookie _gcl_au (90 days) and, if the User reaches the Site from an ad, the cookie _gcl_aw (90 days) link the purchase to the ad that generated it. Google may also set its own cookies on the google.com and doubleclick.net domains, according to its own policies. Without consent, the Consent Mode rules described in the previous section apply: the component sends communications without identifiers, which also include the ad click identifier that may be present in the page address, without storing or reading cookies.
Meta Pixel, a service provided by Meta (Facebook and Instagram). The first-party cookies _fbp (90 days) and, if the User reaches the Site from an ad, _fbc (90 days) link the purchase to the ad that generated it. Meta may also set its own cookies on the facebook.com domain for Users who have an account. Without consent, the Meta component is not loaded and no data is sent to Meta.
TikTok Pixel, a service provided by TikTok. The first-party cookies _ttp, ttcsid and ttcsid_… and, if the User reaches the Site from an ad, ttclid link the purchase to the ad that generated it; they last 13 months from their last use. TikTok may also set its own cookies on its domains, such as tiktok.com, according to its own policies. Without consent, the TikTok component is not loaded and no data is sent to TikTok.
When a paid purchase is completed, the order number and its amount are sent to Google, Meta and TikTok. The name, email address, telephone number and any other data that directly identify the User are not sent.
Third parties
In addition to Google, Meta and TikTok, for the services described in the previous sections, the following parties may receive data as a result of browsing the Site.
- Google Maps (
maps.googleapis.com,maps.gstatic.com,www.google.com): shows the maps embedded in the "Contacts", "How to get here" and "Points of sale" pages, and is loaded only on those pages. It receives the IP address and the characteristics of the browser; in embedded maps Google may set its own cookies, according to its own policies. - Google reCAPTCHA (
www.google.com,www.gstatic.com): used in the contact, login, registration and password recovery forms, in the first step of the booking and in the waiting list sign-up, to tell people apart from automated programs. It receives the IP address and the characteristics of the browser. - PayPal (
www.paypal.com): used only on the payment page, for the PayPal buttons and for entering card details. Card details are entered directly into PayPal's systems and do not pass through the Site. - Cloudflare: protects the Site and speeds up its delivery. All requests to the Site pass through its systems.
The Site's fonts are served by the Site itself, without requests to external services.
The links to the Controller's pages on Facebook, Instagram, LinkedIn, X and Tripadvisor are plain links: no data is sent to those platforms until the User follows them.
No third parties other than those listed in this notice receive data as a result of browsing the Site.
Transfer of data outside the European Union
Google, Meta and Cloudflare may process data in the United States. Transfers take place on the basis of the European Commission's adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), to which these companies adhere.
TikTok may also process data outside the European Union; in that case, the transfer is subject to the safeguards provided for by Regulation (EU) 2016/679, such as the standard contractual clauses approved by the European Commission.
Managing consent
On the first visit the Site shows a banner that allows the User to accept all cookies, reject them all or choose individual categories ("Statistics" and "Marketing"). Until a choice is made, and if they are rejected, these cookies are not used; for Google, the communications without identifiers described in the "Statistics cookies" section remain.
Closing the banner with the dedicated button is equivalent to rejecting them, if the User has not previously made a choice.
The choice can be changed at any time, in either direction, through the "Cookie preferences" link at the bottom of every page of the Site.
The User can also manage and delete cookies through their browser settings. Deleting the cookie-agreed cookies means losing the choice made, which will be asked for again; blocking all cookies may prevent access to the private area, purchases and bookings.
Duration of choices and updates
The User's choices are kept for six months, whether they accept or reject; after that period, the banner is shown again. If the categories of cookies requiring consent change, the choices already made are no longer considered valid and consent is asked for again.
This notice may be updated following changes to the services used or to the applicable legislation. The date of the last revision is shown at the beginning.
Data controller and contacts
The data controller is Stufe di Nerone s.r.l., with registered office at via Stufe di Nerone, 37, Bacoli (NA), Italy, VAT number 06782650631. For any question about this notice and about cookies, write to privacy@stufedinerone.com or use the contact form. The Data Protection Officer (DPO) can be reached at dpo@stufedinerone.com.
For the purposes and legal bases of the processing and for the User's rights, please refer to the privacy notice.