Privacy disclosure, consent mechanisms, and data subject rights

Effective date

This privacy policy took effect on October 27, 2026. It applies to all electronic inquiries, dispatch communications, route consultations, and web visits conducted across mernano.com.

Data controller identification

The data controller responsible for personal information processed through this website is Mernano, trading at mernano.com. The operational administration and central reservation dispatch are conducted from 1301 Barton Springs Road, Austin, Texas 78704, Austin, Texas, United States. Guided walking services, local coordination, and pedestrian trail routes are conducted on the ground in Merano and surrounding valleys of South Tyrol, Italy.

Direct inquiries regarding personal data management, reservation handling, or supervisory standards may be directed to our administrative team by email at [email protected] or by telephone at +1 (308) 555-7786.

Protection of children

mernano.com is designed for adults planning travel, guided walks, and private valley excursions. We do not knowingly solicit, record, or retain personal information from children under 16 years of age. If an inquiry form is submitted by an individual under 16, or if a parent or legal guardian discovers that their child has transmitted identifying records without parental verification, please notify [email protected] so we can immediately purge those records from our server logs and communication queues.

Categories of personal data collected

We collect and process personal data strictly in connection with route feasibility assessments, reservation intake, on-site excursion coordination, and site technical integrity:

• Inquiry Form Records: When you submit a booking request through our online interface, hihe064.php writes your full name, telephone number, email address, physical accommodation or pickup address in the Merano area, chosen tour category (city walking tour, private tour, or private group tour), party headcount, walking pacing preferences, and open message notes.
• Live Guide Support Transcripts: Our on-site guide desk chat powered by godof3d.php records conversation bodies, optional visitor names, telephone numbers, or email addresses provided during live messaging, along with a session token saved to localStorage so return visitors can resume their exchange.
• Automated Server and Header Metrics: Our web server automatically registers the IP address of the requesting client, browser user-agent string, HTTP referring URL, language header preferences, the timestamp of page rendering, and the submission timestamp.
• Browser Storage and Consent Preferences: The client stores your explicit privacy choice under the localStorage key site_consent_v2. No account passwords or payment card numbers are collected, requested, or stored anywhere on mernano.com.
• Digital Advertising Click Identifiers: Inbound promotional visits carry platform query string parameters including Google Ads gclid, Microsoft Advertising msclkid, and Meta Ads fbclid.

Purposes of data processing

Every category of collected data fulfills a specific functional or operational objective:

1. Route Assessment and Quotation: Form inputs and chat exchanges allow our guides to confirm availability, evaluate walking terrain constraints (such as Tappeinerweg gradients or Passirio river flood diversion protocols), assign audio-guide receiver units, and issue an itemized estimate.
2. Operational Dispatch: Your pickup address and mobile number allow our guides to establish contact at verified meeting hubs (such as Piazza Terme or the Kurhaus colonnade) or coordinate excursion minivan logistics.
3. Platform Security and Fraud Prevention: Automated server headers and honeypot input verification protect hihe064.php against automated form exploitation and denial-of-service attempts.
4. Campaign Attribution: URL click identifiers measure incoming advertising efficiency and conversion milestones on partner networks without cross-site profiling unless explicitly permitted.

Legal bases for processing

For visitors accessing our services under the General Data Protection Regulation (GDPR) and comparable frameworks, processing rests upon distinct lawful bases:

Advertising networks and click identifiers

mernano.com actively receives promotional traffic from paid advertising networks. Specifically, Google Ads, Microsoft Advertising, and Meta Ads deliver prospective travelers to our itinerary dossiers and booking forms.

When you navigate to this website via an advertisement, specific campaign click identifiers are appended to the landing URL. These include gclid for Google Ads, msclkid for Microsoft Advertising, and fbclid for Meta Ads. We disclose these systems in the present tense because commercial campaigns are live and directing visitors to our service pages today. Nothing on this website states or implies that an advertising platform has reviewed, endorsed, or approved our specific business operations or itineraries.

Consent Mode v2 implementation

To ensure your privacy choices govern tracking scripts without ambiguity, mernano.com implements Google Consent Mode v2 alongside synchronized controls for Microsoft Advertising and Meta conversion measurement.

Prior to any affirmative visitor consent, the browser initializes all advertising and measurement parameters in a strict denied state. Specifically, the four key consent signals—ad_storage, ad_user_data, ad_personalization, and analytics_storage—are held as denied by default. No marketing cookies are written, and no device profiling occurs.

If you click “Accept” in our consent interface, these four parameters update to granted, permitting conversion attribution and campaign analysis. If you click “Decline”, or if you subsequently withdraw your choice, the parameters immediately revert to denied, halting further tag storage.

Global Privacy Control (GPC)

We fully honor Global Privacy Control (GPC) signals transmitted via browser headers (such as Sec-GPC: 1). When our scripts detect an active global privacy control signal, we treat it as an immediate directive to withhold commercial tracking, disabling ad_storage, ad_user_data, and ad_personalization without requiring secondary manual prompts.

Authorized third-party data processors

We share collected information exclusively with contracted infrastructure providers necessary to maintain site stability, route dispatch, and ad conversion verification:

• Google Ireland Ltd / Google LLC: Operates Google Ads conversion measurement, receiving Consent Mode v2 signals and gclid query values. Details: policies.google.com/privacy.
• Microsoft Ireland Operations Ltd / Microsoft Corporation: Operates Microsoft Advertising conversion logging, receiving msclkid identifiers. Review the Microsoft privacy statement at privacy.microsoft.com/privacystatement.
• Meta Platforms Ireland Ltd / Meta Platforms, Inc.: Operates Meta Ads conversion measurement associated with fbclid parameters where campaigns run.
• Infrastructure and Hosting Provider: Maintains the managed web servers hosting mernano.com, providing automated TLS encryption and secure relational storage for inquiry logs.
• Mail Relay Service: Securely transmits form submission notifications generated by hihe064.php to [email protected] using encrypted SMTP tunnels.

International data transfers

Our administrative coordination operates from Austin, Texas in the United States, while our guided walking routes take place in Merano, South Tyrol, Italy. Consequently, communications transmitted by European travelers cross international borders to our United States office.

Such cross-border transfers are conducted pursuant to standard contractual clauses (SCCs) recognized under GDPR Article 46, ensuring organizational safeguards, strict access governance, and technical encryption equivalent to European protection benchmarks.

Data retention schedules

We retain records only for defined periods grounded in operational and legal obligations:

• Tour Inquiries and Email Records: Retained for 36 months to manage reservation histories, rebooking requests, and tax documentation.
• Guide Desk Chat Transcripts: Retained for 12 months following the last exchange to resolve itinerary queries.
• Web Server and Access Logs: Maintained for 30 days for system health and DDoS defense before automated cyclic rotation.
• Consent Preference Records: Maintained in the browser for 12 months under site_consent_v2.
• Formal Data Requests (DSAR): Investigated and resolved within 5 business days of receipt.

Information security protocols

All network traffic between your browser and mernano.com is secured by 256-bit Transport Layer Security (TLS 1.3) with strict HTTP Strict Transport Security (HSTS) headers. Administrative access to booking databases is restricted to authorized guide coordinators using multi-factor authentication. No cleartext storage of unencrypted inquiry submissions is permitted on public partitions.

European data rights (GDPR)

If you reside in the European Economic Area, the United Kingdom, or Switzerland, you hold protected rights under the gdpr:

• Right of Access: Request verification and a copy of all personal records we hold concerning you.
• Right to Rectification: Demand prompt correction of inaccurate hotel coordinates, misspelled names, or invalid contact records.
• Right to Erasure (“Right to be Forgotten”): Demand deletion of your records where ongoing storage lacks statutory justification.
• Right to Restrict Processing: Request suspension of active processing while data veracity is examined.
• Right to Data Portability: Receive your provided records in a structured, machine-readable format.
• Right to Object: Oppose data processing grounded in legitimate interests or direct informational updates.
• Right to Withdraw Consent: Revoke previously granted consent at any time without retroactive penalty.

United States and California privacy rights (CCPA / CPRA)

Residents of California and states with comprehensive consumer privacy legislation hold specific statutory rights under the ccpa (as amended by the California Privacy Rights Act):

• Right to Know and Access: Request disclosure of the categories and specific pieces of personal data collected, sources, and commercial purposes.
• Right to Delete: Request deletion of personal records gathered directly from you, subject to booking record exceptions.
• Right to Correct: Request correction of inaccurate personal records.
• Right to Opt-Out of Sale or Sharing: We do not sell personal data for monetary payment. To opt out of cross-context behavioral advertising, maintain Consent Mode in the denied state or engage Global Privacy Control.
• Right to Non-Discrimination: We do not alter tour fees, reduce itinerary quality, or withhold services when you exercise your privacy rights.

Regulatory oversight and complaints

If you believe our data handling infringes your rights, you are entitled to file a complaint with an appropriate regulatory authority. California residents may lodge complaints with the California Privacy Protection Agency (CPPA) or the California Attorney General. Other United States residents may contact their respective State Attorney General’s Consumer Protection Division. European visitors may submit grievances to the data protection authority of the EU Member State of their habitual residence, workplace, or place of the alleged infringement.

Updates to this disclosure

Any modifications to our logistical processing, advertising parameters, or statutory compliance models will be reflected directly on this page with a revised effective date. Material alterations will be flagged in our navigation overlay and cookie consent header.

Contact data privacy officer

For immediate human review of data practices or tour dispatch privacy policies, contact: