Cookie Policy
This Cookie Policy explains how the nuvami.it website (the «site») uses cookies and similar technologies: which cookies are set, for what purposes and durations, on what legal bases, and how you can manage or withdraw your choices. It is provided under Art. 5(3) of Directive 2002/58/EC (the «ePrivacy Directive») as implemented in your country — in Italy, where we are established, that is Art. 122 of the Personal Data Protection Code (Legislative Decree 196/2003, as amended) — together with Regulation (EU) 2016/679 (the «GDPR») and the cookie guidelines of the Italian Data Protection Authority (Garante) (decision of 10 June 2021, no. 231). We name the national implementations explicitly because cookie rules are transposed country by country and are not covered by the GDPR one-stop-shop: the authority of the country you browse from applies its own text. For completeness, §5 also describes two mechanisms that use no cookies: the campaign labels in App Store links and the counting of clicks on the download button — where we also describe the server's technical log, common to every visit to the site.
1. What this Cookie Policy is
A cookie is set only after your browser requests a page of the site. This Cookie Policy tells you which cookies we use and puts you fully in control of the non-essential ones: on the site the third-party analytics cookies are activated only if you consent, and you can change your mind at any time (see §7).
The data controller for the data collected through the site is Aleksei Konoplia (a natural person), the developer of Nuvami. For any request about your data or to exercise your rights, contact privacy@nuvami.it. No Data Protection Officer (DPO) has been appointed, as one is not required under Art. 37 GDPR; the address above is the single contact point for privacy matters. For the processing of app data (account, pet health data, in-app advertising, product analytics) the Privacy Policy applies.
2. What cookies are
Cookies are small text files that the sites you visit send to your device, where they are stored and sent back to those same sites on your next visit. Alongside cookies, similar technologies (e.g. identifiers stored by the browser) may be used in the same way. They are classified:
- by purpose: technical cookies — necessary for the site to work or for a feature you explicitly requested — and analytics/profiling cookies, which require your consent;
- by party: first-party, set by
nuvami.it, and third-party, set by a different domain (in our case Google); - by duration: session cookies, deleted when you close the browser, and persistent cookies, which remain until the stated expiry or until you remove them.
The site uses no advertising profiling cookies and shows no advertising.
3. Technical and functional cookies (no consent)
These cookies are first-party and technical or functional in nature. Under Art. 5(3) of the ePrivacy Directive as implemented in your country (Art. 122 of the Code in Italy) they do not require your consent, as they are strictly necessary to deliver a service you explicitly requested: remembering the language you chose, or the fact that you dismissed a prompt. They are set only after an action of yours (a click), never on page load alone.
| Name | Purpose | Duration | Category |
|---|---|---|---|
nuvami_cookie_consent | Stores your cookie choice (accepted / rejected) | 1 year | Technical (necessary) |
nuvami_lang | Remembers the language you chose for the site | 1 year | Functional / preferences |
nuvami_lang_prompt | Remembers that you dismissed the language-switch prompt | 1 year | Functional / preferences |
The nuvami_cookie_consent cookie exists precisely to remember your decision about analytics cookies: for this reason it is exempt from consent and is set even if you reject analytics.
4. Third-party analytics cookies — Google Analytics 4 (with consent)
To understand how the site is used, we collect aggregate statistics via Google Analytics 4 (GA4), a third-party tool provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with possible processing by Google LLC (USA). Measurement ID: G-GKXG82E41K. For this analytics, Google acts as a processor on our behalf, under Google's Data Processing Terms.
Technically, the _ga and _ga_GKXG82E41K cookies are first-party (set on the nuvami.it domain), but we treat them here as consent-based cookies because they serve the analytics purpose of a third party (Google), which receives and processes the data: they therefore still require your consent under Art. 122.
How consent works (prior blocking). GA4 cookies are set and the Google Analytics script is loaded only after your explicit consent («Accept» in the banner). Before your choice, or if you choose «Decline», no analytics cookie is set and the GA script is not loaded. The banner complies with the Garante's guidelines: the «Accept» and «Decline» buttons carry equal weight, there are no pre-ticked boxes, scrolling the page does not amount to consent, and there are no cookie walls — you can browse the site even if you reject. Your choice is saved in the technical nuvami_cookie_consent cookie (see §3).
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
_ga | Distinguishes users (statistical client identifier) | 2 years | Analytics / statistics | |
_ga_GKXG82E41K | Maintains the session state for GA4 | 2 years | Analytics / statistics |
Characteristics of this analytics processing:
- Aggregate statistics only: we measure page views, traffic sources, scrolling and clicks on the App Store buttons. No advertising, no profiling, no «Google Signals» and no cross-device tracking are enabled.
- No IP storage: GA4 does not record or retain your IP address; it is used transiently only for approximate geolocation and then discarded.
- Data retention in GA4: 14 months.
- Transfer outside the EU (USA): data may also be processed in the United States on the basis of appropriate safeguards — the EU-US Data Privacy Framework, to which Google is certified, and, additionally, the Standard Contractual Clauses (SCC) (see §8).
- Legal basis: your consent (Art. 122 of the Code and Art. 6(1)(a) GDPR).
For how Google processes this data, see Google's Privacy Policy and how Google uses data.
5. App Store links, campaign attribution, click counting and form-download counting (no cookies)
How the button works. The buttons that lead to the App Store from the site's presentation pages (the home page and its language versions) do not point straight at the App Store: they point to an address on our own site (nuvami.it/go/store, carrying the language of the button), and our server answers with a redirect to the App Store storefront associated with the language of the button (for some languages that is the nearest available storefront — the Irish one for English, the Italian one for Russian; if the language is not recognised, the Italian one). That is the moment when the address gains two campaign labels — pt (the code Apple assigns to us as the developer, which appears in all our campaign links) and ct (the campaign name: it says which of our materials a click came from; from the buttons on these pages it is currently always web) — plus the technical parameter mt, which is part of the link format Apple generates. These are not cookies and not personal identifiers: they describe the link you clicked, not you. The labels themselves neither read nor store anything on your device: they only travel in the address your browser opens.
Why the click goes through our server: to count it. Passing through our own address leaves a line in a separate log, kept for this counting alone and distinct from the site's technical log. The line contains only: date and time, the address requested (hence also the language of the button), the outcome of the redirect and technical data of the response (size, duration), and the browser type — the string with which the program announces itself. Nothing else, apart from the technical parameters of the request itself. The browser type is there so that the number is not inflated: it is the only signal that tells a person apart from an automated crawler, and without it the count would count robots along with people. And if your browser tells us that it is loading the link in advance, before you tap it, we record nothing at all: no line is written for that preload, neither here nor in the technical log. The line does not contain your IP address, it does not contain the headers your browser sends (so not the preferred language either), and it contains neither the data of the encrypted connection nor the headers of our reply. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring, in purely numerical form, how many clicks reach the store; you may object at any time to this processing, on grounds relating to your particular situation, by writing to privacy@nuvami.it (Art. 21 GDPR). That your IP address is not in the line is a fact worth stating — it reduces the data processed, it does not change the legal basis on which we process it. This separate log is rotated and deleted on the same schedule as the technical log, stated below. The exception covers exactly the bridge address (nuvami.it/go/store): any other address under /go/, including one that does not exist, ends up in the general technical log with the IP address, because such a request is a probe and the line is a security clue.
The site's technical log. Every other request to the pages of this site leaves a line in the server's technical log instead. The line contains: date and time, the address requested, your IP address and the technical headers your browser sends with every request (among them the browser type and the preferred language), plus technical data of the connection and of the response (among them outcome, size, duration). Some headers that may carry credentials are removed or replaced with a placeholder before writing. The same technical log also records requests to our other subdomains (among them s.nuvami.it, used for shared reports), for the same security purpose and for the same time. ⚠️ The backup copies mentioned here are the server's system backups and are a different thing from the application backups described in the Privacy Policy (§7).
What the log is for, and which purpose sets its lifetime. The technical log exists for the security of the service, and it is that purpose — and only that one — which determines how long it is kept. From its lines we derive a number: how many times the printable forms of our guides are downloaded (the PDF files under /assets/vorlage/). Here there is no intermediate step: the request arises from the download itself and would be recorded anyway. We count per day, and for the same day we count how many distinct addresses downloaded, so as not to mistake ten downloads by one person for ten people; your IP address is not kept in any separate store — for this counting, only the figure is derived from the log. The click count, by contrast, is not derived from these lines: it comes from the separate bridge log described above, which does not contain your IP address. Neither of the two counts adds anything to the line and does not extend the retention; its result is a figure, and the log lines are not used to build commercial profiles. For security alone, an automated system may temporarily block IP addresses that generate anomalous traffic and report them to the anti-abuse network described in §8. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The counting uses no cookies and accesses no information on your device, so it works even if you refuse cookies. You may object at any time to this processing, on grounds relating to your particular situation, by writing to privacy@nuvami.it (Art. 21 GDPR).
How long we keep the log lines.
- On the server: lines are deleted automatically within 32 days.
- In the system backup copies (7 daily whole-disk snapshots, rotated automatically by the provider): 7 days longer, after which they are overwritten.
- In total, therefore: at most 39 days — a backup is a later copy, so its window closes seven days after the online log's.
As this is a security log, if you object we may have to keep the line on compelling legitimate grounds: in that case we will tell you so.
What they are for. These labels let Apple give us aggregate per-campaign statistics only — for example how many app installs come from the website. We receive no individual data and cannot trace it back to a person; moreover, as stated by Apple, these statistics cover only users who, in their device settings, have agreed to share data with developers.
This mechanism works regardless of your cookie choice, precisely because it uses no cookies: the label is added by the redirect at the moment you open the link. If you prefer not to send it and not to pass through our address, you can search for «Nuvami» directly in the App Store instead of using the buttons on the site: that avoids the line about the click, while the visit to the page — as on any website — is still recorded in the technical log. The click on the button may also be counted by Google Analytics 4, but only if you have consented: that is a separate, cookie-based processing, described in §4.
From the moment you open the link, your data is processed by Apple as an independent controller, under Apple's Privacy Policy.
6. Legal basis
- Technical and functional cookies (§3): no consent required. They are exempt under Art. 5(3) of the ePrivacy Directive as implemented locally (Art. 122 of the Code in Italy, §25(2) no. 2 TDDDG in Germany, Art. 22.2 LSSI in Spain, Art. 82 of the loi Informatique et Libertés in France), being strictly necessary to deliver a service you explicitly requested (Art. 6(1)(f) GDPR as a legitimate interest in the site's operation, where relevant).
- Third-party analytics cookies — GA4 (§4): consent (Art. 122 of the Code and Art. 6(1)(a) GDPR), which can be withdrawn at any time as easily as it was given.
- Campaign labels in App Store links (§5): they are fixed values written into the link address, identical for every visitor; they are not cookies and, on our side, they involve neither storing information on your device nor accessing information already stored there. We therefore consider that Art. 122 of the Code does not apply. From Apple we receive aggregate statistics only: for this purpose we do not process data that could identify you.
- Server technical logs (§5): they are generated by every request to the site — the pages and requests to our other subdomains — and they contain the IP address. The one exception is the bridge address
nuvami.it/go/store: its line goes to a separate log and carries no IP address (§5). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in the security of the site and in defending it against abuse; it is that purpose, and only that one, that sets the retention period stated in §5. You may object under Art. 21 GDPR. - Counting the clicks on the button (§5): it happens in a separate log on the server, with no cookies and no access to information stored on your device; we therefore consider that Art. 122 of the Code does not apply. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in measuring, in purely numerical form, how many clicks reach the store; you may object to the processing under Art. 21 GDPR (§5). The line in that log does not contain your IP address nor your browser's headers: a fact that reduces the data processed, not the legal basis that applies. The separate log follows the same retention as the technical log, set by the security purpose alone and not extended by this counting.
- Counting downloads of the printable forms (§5): it happens in the server's technical log, without cookies and without accessing information stored on your device; we therefore take the view that Art. 122 of the Code does not apply. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in knowing whether the material we publish is actually used. Unlike the click counting, no extra line is created here: the line arises from the download and would be written anyway for security. The log's retention period is set by the security purpose alone and is not extended by this counting; you may object under Art. 21 GDPR.
7. How to manage or withdraw consent
You can change or withdraw your consent to analytics cookies at any time:
- «Cookie» button in the site footer: you will find it at the bottom of the site's pages; clicking it reopens the banner so you can change your choice. On withdrawal, analytics cookies stop being set.
- Browser settings: you can block or delete existing cookies from your browser's settings (in the Chrome, Safari, Firefox and Edge guides under «cookies» or «privacy»). Deleting
nuvami_cookie_consentwill cause the banner to be shown again on your next visit. - Disabling Google Analytics: you can install the Google Analytics opt-out browser add-on provided by Google.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
8. Transfers outside the EU
The technical and functional cookies (§3) are first-party and involve no transfers. Data collected via Google Analytics 4 (§4) may also be processed by Google outside the European Union, in particular in the United States. Where this happens, the transfer is based on appropriate GDPR safeguards: the EU-US Data Privacy Framework — to which Google is certified — and, additionally, the Standard Contractual Clauses (SCC) approved by the European Commission. For details see Google's Privacy Policy. The server's technical logs (§5) are kept on a server located in the European Union (Germany); the backup copies mentioned in §5 also reside with the same provider, inside the European Union. The anti-abuse system mentioned in §5 is part of a shared reporting network run by its provider, CrowdSec SAS (RCS Nanterre 880 140 496, registered office at 20 rue Maurice Arnoux, 92120 Montrouge, France). When an IP address triggers a security rule, the provider is sent — according to its own privacy notice — the IP address, the date and time and the type of incident, which the provider may in turn pass on to the members and partners of its network: this concerns only addresses that trigger a rule, not visitors with ordinary traffic. The provider describes the transmission to members and partners as part of processing carried out jointly with them (“joint processing”, in the words of its own notice). That same notice states that, where the recipient of a data flow is located outside the European Union or in a country without an adequate level of protection, the transfer takes place on the basis of the European Commission’s Standard Contractual Clauses (Art. 46 GDPR); this covers both the provider’s sub-processors and the members and partners of its network, and you may request a copy of the safeguards by writing to privacy@nuvami.it. The provider keeps reported addresses for its own periods — up to 3 months undegraded and, in limited cases (post mortem analysis and training), up to one year before anonymisation — which do not coincide with those of our log (§5); for data already sent to the network you may also contact the provider directly (dpo@crowdsec.net). Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
9. Your rights
Under Arts. 15–22 GDPR you have the right to access your data, to have it rectified or erased, to restrict processing, to object to processing and to data portability, as well as to withdraw at any time the consent you gave (Art. 7 GDPR), without this affecting the lawfulness of processing prior to the withdrawal.
To exercise these rights, write to privacy@nuvami.it. For data collected via Google Analytics you may also contact Google, following its Privacy Policy.
10. Complaints
If you believe the processing of your data through cookies or the other processing described in this policy infringes the GDPR or applicable law, you may contact us (privacy@nuvami.it) and you have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the supervisory authority of your country of residence.
11. Changes to this Cookie Policy
We may update this Cookie Policy, for example if the cookies used or their purposes change. The current version is always published at this address, with the «last updated» date at the top. For changes that affect consent-based cookies, we will ask for your consent again through the banner. Your choice is valid for 12 months: within that period we will not show the banner again, unless you delete the cookie or the cookies used change.