Cookie Policy
Last updated: 28 August 2026.
1. What cookies and tracking technologies are
Cookies are small pieces of information that a website or third-party service may store on the user's device. Similar functions may also be performed by localStorage, pixels, identifiers and other technologies. This policy describes the use of these tools on the website www.ducadeste.com.
2. Rule applied by this website
On the first visit, the website keeps all services and tools that are not strictly necessary disabled. Non-essential third-party cookies, pixels, iframes, widgets and scripts are loaded only after the user has made a positive choice for the relevant category.
Closing the banner using the “X” or selecting “Reject unnecessary” keeps the default settings and allows browsing without activating non-essential services.
3. Categories
3.1 Necessary — always active
These include tools required for security, browsing
and storing privacy preferences. They do not require consent.
The website may use, for example, a localStorage entry called
ghde-consent-v3 to remember the user's choice and its
expiry date. It may also use a local preference to avoid repeatedly
displaying the newsletter popup.
3.2 External functional services — optional
These include external features that improve the user experience but are not essential for browsing the website. They remain disabled until consent is given. They may include:
- Simple Booking / QNT: booking engine widget. Without consent, the website may retain a simple form or link that directs the user to the external booking engine only following a user action.
- Rezmate: online assistant/chat, loaded only if the user enables functional services.
- OpenStreetMap: embedded map, loaded only after consent and a subsequent click on “Show map”.
- Google reCAPTCHA, where present in forms: external anti-spam tool, loaded only after consent to the functional category and when the form requires verification.
3.3 Measurement and marketing — optional
These include tools used to measure visits, assess campaign performance, create audiences or measure conversions. They remain disabled until specific consent is given.
- Google Tag Manager (GTM-P4Q4KMD5): container for tag management. As a precaution, the container is treated as a non-essential service and is not loaded before consent. The individual tags within the container must be configured consistently with the consent categories and reviewed periodically.
- Meta Pixel, where active: may be used for measurement, attribution and marketing. It is loaded exclusively after consent to the “Measurement and marketing” category.
4. List of services and activation methods
| Service | Provider | Purpose | Category | When it is activated |
|---|---|---|---|---|
| Consent preferences | Grand Hotel Duca d'Este / first party | Remember privacy/cookie preferences | Necessary | When the user makes a choice |
| Simple Booking | QNT / Simple Booking | Search and booking widget | Functional | After consent to functional services |
| Rezmate | Rezmate | Online assistant/chat | Functional | After consent to functional services |
| OpenStreetMap | OpenStreetMap Foundation / related infrastructure | Embedded map | Functional | After functional consent and click |
| Google reCAPTCHA | Anti-spam protection for forms | Functional | After functional consent, where required by the form | |
| Google Tag Manager | Management of measurement/marketing tags | Measurement and marketing | After consent to the category | |
| Meta Pixel | Meta Platforms | Measurement, attribution and marketing | Measurement and marketing | After consent to the category |
Technical note: the names, durations and domains of cookies actually installed by third-party services may vary depending on the configuration of the respective providers. Before final publication and after any change to GTM or external services, it is advisable to carry out an actual scan of the website and update this table with the identifiers and durations actually detected.
5. Links to external websites
Simple links to WhatsApp, social networks, Google Maps, TripAdvisor, tibispa.it or the booking engine do not, by themselves, cause content from those third parties to be loaded on the page. The link is opened only when the user clicks on it; from that moment onwards, processing is also governed by the privacy policies of the external website visited.
6. How to give, refuse or change consent
On the first visit, users can:
- Accept all optional services;
- Reject unnecessary services and continue using only technical tools;
- Customize preferences by category.
The choice can be changed or withdrawn at any time through the permanent link available on the website. Withdrawal is effective for the future and does not affect the lawfulness of processing carried out before withdrawal.
7. Duration of the choice
The preference is stored for a maximum period of approximately six months, unless substantial changes are made to the services or purposes, it is no longer possible to verify the previous choice, or other circumstances arise that make it necessary to request consent again.
8. Transfers to third countries
Activating certain external services may involve the processing of data in countries outside the European Economic Area. In such cases, processing must take place in accordance with Articles 44 et seq. GDPR, on the basis of an adequacy decision, Standard Contractual Clauses or another mechanism permitted by applicable law.
9. Data Controller and rights
The Data Controller is Fincres S.p.A., Viale Palmiro Togliatti 1587, 00155 Rome, VAT No. 01435741002, Tax Code 05709490584. Property: Grand Hotel Duca d'Este, Via Nazionale Tiburtina 330, 00019 Tivoli Terme (RM). E-mail: info@ducadeste.com.
For more information on the rights provided by the GDPR, recipients, retention periods and processing methods, please refer to the Privacy Policy.
