Cookie Policy

1. What cookies are

Cookies are small text files that websites store on the user's device and read back on subsequent visits. The applicable rules — Art. 5(3) of Directive 2002/58/EC, as amended by Directive 2009/136/EC, and Art. 122 of the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended) — cover more generally any storing of information, or gaining of access to information already stored, in the user's device. They therefore also apply to technologies other than cookies, such as browser local storage.

Technical cookies require no consent: they are those used for the sole purpose of transmitting a communication, or to the extent strictly necessary to provide a service explicitly requested by the user. All others may be installed only with consent that is freely given, specific, informed and unambiguous, expressed through a positive action and revocable at any time.

Analytics cookies may be treated as technical, and therefore installed without consent, only where the conditions set by the Italian Data Protection Authority are cumulatively met: that they do not allow the user to be directly identified, with at least the fourth component of the IP address masked; that they are used solely to produce aggregate statistics; that they concern a single website or application, without tracking browsing across different sites; and that the provider neither combines the data with other processing nor passes it on to further third parties.

2. Data Controller

The Data Controller is OPERA S.r.l., registered office at Via Aretina 155/1, 50136 Florence (FI), Italy, VAT and tax number 07502760486. For any matter relating to the protection of personal data you may write to privacy@operalife.eu. Full contact details and information about the processing are set out in the Privacy Policy.

3. Legal basis

Storing information on your device, and gaining access to information already stored there, are governed by Art. 122 of the Italian Privacy Code, which transposes Art. 5(3) of Directive 2002/58/EC: the rule applies whether or not personal data are involved. The cookie listed in section 4 falls within the exemption set out there, being strictly necessary to provide a service you explicitly requested: by dismissing the notice — whose text states that dismissing it stores the cookie — you ask not to be shown it again, and the cookie serves solely to remember that request.

The Data Controller takes the view that what the anti-abuse check stores on and reads from your device (sections 4 and 6) falls within the same exemption. This happens only when a field of the contact form or the checkbox is changed — by you, starting to fill in the form, or by the browser filling it in on your behalf — and not when you merely select a field or move through the form with the keyboard (section 6); in the particular case described in section 6 it happens when the form is submitted. A line at the top of the form, before the fields, gives notice of the check and of the saving of a code in the browser. The storing and the reading are done by the service in the course of the check that protects that form from automated submissions: a security measure protecting the service the form provides. The code the service stores has no set expiry and, from our checks, in browsers that do not give each visited website a separate space for the data of the external services it embeds, it is also the same at a second address that the browser treats as another website: it can therefore allow Cloudflare to recognise the same browser on different websites (section 4). Cloudflare, which provides the check, states that the technical information the check relies on (so-called signals) is, in its words, “strictly necessary” to detect and block automated programs and is not collected to identify, profile or target individuals. That statement concerns the signals collected during the check: Cloudflare's notice on the service does not mention the code stored in the browser, and Cloudflare does not publicly document its content or its specific function. The Data Controller's assessment concerns the storing and the reading done on your device through the Website. Having regard to the matters set out above, as of the last update the Data Controller maintains that assessment, which remains under review. What Cloudflare subsequently does with the data it receives during the check, including using it to improve its own detection system, is a separate processing of personal data, described in the Privacy Policy.

The Data Controller takes the view that the light or dark theme preference (section 4) falls within the same exemption. It is stored only when you use the theme switch, and it is used only to show you the Website in the theme you chose — and, when you use the contact form, the box of the anti-abuse check too (section 6) — on later pages and when you come back. It holds no identifier. It has no set expiry: it stays on your device until it is deleted; once it is deleted, the Website goes back to following your device's setting (sections 8 and 9).

As of the last update the Website uses no cookie or other tool that the Data Controller regards as non-technical, and you are therefore not asked for any consent. Should any be introduced, your consent would be required under Art. 122 of the Italian Privacy Code before installation; the processing of personal data resulting from it would rest on consent under Art. 6(1)(a) GDPR, whose conditions of validity are set out in Articles 4(11) and 7.

4. Cookies and equivalent technologies used by this Website

As of the last update the Website uses a single cookie, first-party — set directly by our own domain — and technical. It is not always present: it is written only when you dismiss the opening notice; in the checks we carried out, a visitor who did not dismiss it received no cookie. The language the Website is shown to you in depends solely on the address of the page and is not stored on your device.

In addition to the cookie there are two pieces of information that are not cookies, both stored in the browser's local storage. The first is the light or dark theme preference, which the Website stores in the space reserved to its own domain only when you use the theme switch: until you use it, the Website follows the setting of your device and stores no theme preference.

The second is the one that the anti-abuse check on the contact form, provided by Cloudflare, Inc. (United States), stores when a field of the contact form or the checkbox is changed or, in the particular case described in section 6, when the form is submitted. Through the Website, then, it is not stored until a field of the form or the checkbox is changed, or the form is submitted: selecting a field or moving through the form with the Tab key is not enough. It may, however, already be in your browser if the service stored it through another website, as explained below. This piece of information is, from our checks, a code that differs for each browser, with no set expiry; depending on the browser and its settings it may be the same on the other websites that use the service too, in which case it can allow Cloudflare to recognise the browser from one website to another: the details are in the table below. The same service also reads certain technical characteristics of the browser and detects the signs of its being used by a person (section 6).

As of the last update the only information that, from our checks, is stored in the browser's local storage (localStorage) is the two items listed in the table: the theme preference, in the space reserved to the Website's domain, and the code stored by the anti-abuse check, in the space reserved to Cloudflare's domain. In the same checks neither the Website nor the anti-abuse check used session storage (sessionStorage) or local databases. The checks referred to in this Cookie Policy were carried out on test versions and on a preview of the Website, before its publication on the domain www.operalife.eu. In those checks, with the anti-abuse service configured as the Website uses it, we reached neither the completion of the anti-abuse check nor the sending of the form: those two steps were observed only with a test configuration of the service, and no cookies were found in them.

5. Analytics and marketing cookies

As of the last update the Website uses no analytics or marketing cookies, and the Data Controller uses no analytics, profiling or marketing tool. For that reason, and because the Data Controller regards all the items listed in section 4 as technical, the opening notice simply informs you and asks for no consent.

Should such tools be introduced, this Cookie Policy will be updated and the Data Controller will ask for your consent before activating them, through a banner allowing you to accept, to refuse, and to choose category by category. No analytics or marketing tool will be activated before that point.

6. Third-party cookies and technologies

As of the last update, in the checks we carried out no third-party cookie was found; until a field of the contact form or the checkbox is changed, or the form is submitted, the pages of the Website do not cause your browser to contact any external domain. There are no embedded videos, maps or social media widgets, and typefaces are hosted on our own domain, with no request to external servers. The Website itself is delivered through the network of Cloudflare, Inc., which for this service acts on the Data Controller's behalf, as set out in the Privacy Policy: in the checks we carried out on a preview of the Website that network set no cookie and did not alter the content of the pages.

The only third-party content embedded in the pages is the anti-abuse check on the contact form, Cloudflare Turnstile, provided by Cloudflare, Inc. (United States). It is not loaded together with the page: when you first change one of the fields of the form — name, email, organization, message — or the checkbox (by typing the first character, pasting or dictating text, ticking the checkbox, or when the browser fills in a field on your behalf), your browser downloads it from the domain challenges.cloudflare.com and shows its box inside the form; in the course of the check the browser exchanges data with that domain and, from what we observed, with one of its subdomains. In requesting the box, besides the technical data any request carries, described in the Privacy Policy, the browser tells Cloudflare the key that identifies the Website to the service, the language of the page, the theme — light or dark — the page is shown in at that moment, the format of the box, which depends on the space available on the screen, and a label saying that the check concerns the contact form. Selecting a field with the mouse or by touch, or moving through the form with the Tab key, without changing anything, does not load the service. If the fields were filled in before the page had finished loading, or were restored by the browser when the page was reloaded, and are not changed again, the service is loaded when you submit the form. When the service is loaded, Cloudflare stores in the browser's local storage the information listed in section 4, if it is not already present. The same happens on every later page load in which a field of the form or the checkbox is changed, or the form is submitted in the case just described: the service is downloaded again and reads the information already stored; in our checks it then stored it again, unchanged. To carry out the check the service also reads certain technical characteristics of your browser and detects the signs of its being used by a person: these operations, too, fall under Art. 122 of the Italian Privacy Code, and the Data Controller regards them as covered by the exemption explained in section 3, for the same reasons. The data Cloudflare receives on that occasion, the purposes of the processing and Cloudflare's role are described in the Privacy Policy; Cloudflare's own notice on the service is the Turnstile Privacy Addendum, published at www.cloudflare.com/turnstile-privacy-policy.

Submitting the contact form also involves sending the data you entered to the providers described in the Privacy Policy. That transmission happens without cookies and does not, in itself, store anything on your device.

7. The opening notice

Until you dismiss it, a notice appears at the foot of every page telling you about the technical cookie and the other information that may be stored in the browser, and pointing to this Cookie Policy and to the Privacy Policy. Its single command, “Got it”, acknowledges and dismisses it: it expresses neither acceptance nor refusal, because the Website uses no item that the Data Controller regards as subject to consent (section 3). Pressing the Esc key has the same effect when the notice is selected — as it is as soon as it appears, unless you are already using another element of the page — or while keyboard focus is on its command or on one of its links.

Access to the Website's content is not conditional on dismissing the notice: you may browse freely while ignoring it. If you dismiss it, the Website records the fact in the cookie described in section 4 and does not show the notice again for as long as that record remains valid on your device, that is for up to 365 days from the dismissal. The notice returns when the cookie expires, if you delete your browser cookies, or if the Data Controller updates the version of the notice: in that case the earlier record is no longer treated as valid and is ignored.

Since no consent is collected, there is no consent to withdraw. If non-technical cookies are introduced in future, this section will be replaced by a description of the consent banner and of the means to change or withdraw your choices at any time, as easily as they were given. In the meantime the technical cookie, like the two pieces of information stored in the browser's local storage (section 4), can be removed at any time through your browser settings, as described in section 8.

8. Managing cookies and other stored data in your browser

You can block or delete cookies already stored at any time through your browser settings, where you can view the cookies stored for each individual site, delete them, and prevent them being set again. In the main browsers the option is generally reached from the settings menu, in the section devoted to privacy or browsing data; on some mobile devices, however, browser settings live in the system settings rather than in the application.

Deleting them removes the cookie described in section 4, if present: the opening notice will be shown again the next time a page is loaded. If you block cookies instead, the Website cannot remember that you dismissed the notice, and it will be shown again the next time a page is loaded.

The same settings also let you delete the two pieces of information stored in the browser's local storage described in section 4 — the theme preference and the code stored by the anti-abuse check — with the option that removes, together with cookies, the other data stored by sites. In many browsers the setting that blocks a site's cookies also prevents these data from being stored; for the code stored by the anti-abuse check, the relevant setting is the one for the domain challenges.cloudflare.com or for third-party cookies. That code is in fact stored under that domain: depending on the browser, removing it may require deleting the data of that domain and not only those of the Website. The consequences are described in section 9.

9. Consequences of removal or blocking

As of the last update reading the pages of the Website does not depend on what you do with the notice, with cookies or with the other data stored in the browser; only sending the contact form may depend on it, as set out below. The only function that depends on the cookie described in section 4 is remembering that you dismissed the notice: if you do not dismiss it, the cookie is not written; if you remove or block it, the notice is shown again the next time a page is loaded.

As for the theme preference (section 4): if you delete it, the Website goes back to following the setting of your device. If your browser prevents the Website from storing data on the device, from our checks the switch still changes the theme of the page, but the choice is not remembered: it holds until the page is loaded again or the theme setting of the device changes. No content of the Website depends on this preference.

As for the information stored by the anti-abuse check (section 4): if you delete it, the service stores a new one the next time it is loaded, that is at the first change to a field of the contact form or to the checkbox after a page has loaded or, in the particular case described in section 6, when the form is submitted. For the service not to store or read it through this Website, it is enough not to change the fields or the checkbox, not to let the browser fill them in for you, and not to submit the form: selecting a field or moving through the form with the Tab key stores nothing. Leaving the form untouched does not, however, remove a code the same service may already have stored in your browser when you used other websites (section 4): that code stays in the browser until it is deleted (section 8), but it is not read through this Website until the form is changed or submitted. Instead of the form, you can write to us at the email addresses published on the Website. If your browser blocks requests to the domain challenges.cloudflare.com, the check does not complete and the form cannot be sent; if it prevents Cloudflare from storing data on the device, the check may fail. In those cases too, the email addresses published on the Website remain available; the form's error message gives the contact address.

10. Your rights and complaints

You may exercise the rights granted by Articles 15 to 22 GDPR at any time by writing to privacy@operalife.eu; should consent be collected in future, you will be able to withdraw it at any time under Article 7(3), without affecting the lawfulness of processing carried out before withdrawal. If you believe the processing infringes the applicable rules, you may lodge a complaint with the Italian Data Protection Authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — protocollo@gpdp.it, certified email protocollo@pec.gpdp.it, www.garanteprivacy.it — or bring proceedings before the ordinary courts (Article 79 GDPR and Article 152 of the Italian Privacy Code). Full information about your rights and how to exercise them is set out in the Privacy Policy.

11. Updates to this Cookie Policy

This Cookie Policy may be amended if new cookies or tracking tools are introduced, if the services used change, or following regulatory developments. The statements in sections 1 and 5 reflect the guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority, decision no. 231 of 10 June 2021. The date of the last update is shown at the top of this page.

The record that you dismissed the notice is kept solely in the cookie described in section 4, and therefore on your own device, and is not linked to any other data concerning you.