SAMARCANDA

PRIVACY NOTICE
AND COOKIE POLICY

Website https://065551.it

Data Controller	Samarcanda Soc. Coop. a r.l.
Registered office	Via della Magliana Nuova 302, Rome
Privacy contact	privacy@samarcanda.it
Data Protection Officer	dpo@samarcanda.it

Version updated on 29 July 2026

PART I — PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

This notice is provided pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) to users who visit and use the website https://065551.it (the “Website”) and the services available through it. This notice concerns the processing activities carried out by Samarcanda in connection with the Website; for services provided by third parties acting as independent data controllers, please refer to their respective privacy notices.

1. Data Controller and DPO

The Data Controller is Samarcanda Soc. Coop. a r.l., with registered office at Via della Magliana Nuova 302, Rome, e-mail privacy@samarcanda.it.

The Data Protection Officer (DPO) can be contacted at dpo@samarcanda.it.

2. Scope of the Website and relationships with external services

The Website presents radiotaxi services and, depending on the features available, allows users to request information, create or manage a profile, purchase or book services, interact with customer support and access external platforms.

The “Samarcanda Plus powered by Wetaxi” application and the related booking and payment functions are governed by the privacy notices made available within the application. WeTechnology S.r.l./Wetaxi acts as an independent data controller for the processing activities falling within its remit, according to the configuration and services actually provided.

3. Categories of personal data processed

Browsing and technical data: IP address, date and time, requested resource, outcome of the request, browser, operating system, device and technical information necessary for the operation and security of the Website.
Identification and contact data: first name, surname, telephone number, e-mail address and any other data entered in forms or otherwise provided by the user.
Account data: credentials or technical identifiers, preferences, transaction history and information necessary for registration and management of the restricted area.
Data relating to requests, bookings, purchases and support: content of the request, service data, communications and information necessary for their management.
Chat conversation data: message content, date and time, any contact details and technical information necessary for the operation of the service.
Preference and consent data: choices made by the user regarding cookies, promotional communications and other optional purposes.

Users are invited not to enter unnecessary data in free-text fields, particularly special categories of personal data under Article 9 GDPR, unless this is essential for the specific request.

4. Purposes, legal bases and nature of the provision of data

Purpose	Main data	Legal basis	Provision of data
Website browsing, operation and security	Technical data and logs	Legitimate interest of the Data Controller; compliance with security obligations	Necessary to use the Website
Responding to requests and providing support	Contact data and content of the request	Pre-contractual measures or contract; legitimate interest in responding	Necessary to receive a response
Account registration and management	Identification data, contact details and account data	Performance of pre-contractual or contractual measures	Necessary to create and use the account
Bookings, purchases and requested services	Service data, contact details and transactions	Performance of a contract and compliance with legal obligations	Necessary to provide the service
Administrative, tax and accounting obligations	Identification and transaction data	Legal obligation	Mandatory
Prevention of abuse and automated submissions	Technical data processed through reCAPTCHA	Legitimate interest in Website security	Necessary for protected forms
Statistical analysis with cookieless Matomo	Minimised technical and usage data	Legitimate interest in measuring and improving the Website	Automatic during browsing
Promotional communications	Contact data	Consent	Optional and withdrawable
Personalised promotional communications	Contact data and preferences	Separate consent	Optional and withdrawable
Market research	Contact data and responses	Consent	Optional
Protection of rights and litigation	Data relevant to the dispute	Legitimate interest in the defence of legal rights	Necessary in the event of a dispute

5. Browsing data and logs

The IT systems and software procedures used to operate the Website acquire technical data whose transmission is inherent in the use of Internet communication protocols. Logs may be used to ensure operation, detect anomalies, prevent abuse, reconstruct security events and establish liability.

Website logs may contain data relating to activities carried out by users and, in some cases, IP addresses. As at the date of this notice, Website logs are deleted manually. Samarcanda has set a maximum retention period of 365 days, without prejudice to any further retention strictly necessary for the management of incidents, disputes, requests from public authorities or the defence of legal rights.

The logs available through the server control panel relate to the current month and the previous month; any additional logs held by the infrastructure provider are subject to the terms and retention periods applied by that provider.

6. Statistical analysis with Matomo

The Website uses Matomo, hosted on the 065551.matomo.cloud service, to obtain statistical information on page usage and to improve content and services.

According to the technical configuration communicated to the Cooperative, Matomo operates in cookieless mode and does not install analytics cookies on the user’s device. Technical browsing data may nevertheless be processed, such as pages visited, date and time of access, device and browser.

Matomo is not used to track users across different websites or for commercial profiling. Analytics data are retained for 730 days, according to the configuration communicated. Access is restricted to authorised persons.

7. Chat and support through Brevo Conversations

The Website uses Brevo Conversations to allow users to communicate with Samarcanda and request information or assistance. Any contact details provided, the content of the conversation, the date and time of messages and technical information necessary for operation may be processed.

According to the technical checks available, the integration concerns the Conversations service, operates without cookies and does not use the previous analytics component. Brevo processes personal data in the role arising from the contract and from the configuration actually adopted by Samarcanda.

Conversations are retained for the time necessary to handle the request and, thereafter, for any period required to protect legal rights or comply with applicable obligations.

8. Google reCAPTCHA

The Website uses Google reCAPTCHA in the registration form and in the profile-editing form within the user area, in order to distinguish human interactions from automated submissions and protect the Website against abuse and fraudulent activities.

The service may process technical data relating to the device, browser, IP address and interaction with the page. The processing is based on Samarcanda’s legitimate interest in ensuring the security of forms and systems. Google may act as an independent data controller for processing carried out under its own terms and privacy notices.

Use of the service may involve transfers of personal data to countries outside the European Economic Area, in compliance with the applicable safeguards under Articles 44 et seq. GDPR.

9. Forms, accounts and third-party data

Where a user enters another person’s data, the user declares that they are entitled to disclose such data and undertakes, where necessary, to inform the data subject. Samarcanda will use such information solely to manage the requested service and the communications strictly necessary for its performance.

10. Promotional communications

Samarcanda may send promotional communications only on the basis of valid, specific and withdrawable consent, except where otherwise permitted by law. Users may withdraw consent at any time by using the tools provided in the communications or by writing to privacy@samarcanda.it. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Processing methods and security

Personal data are processed using electronic means and, where necessary, paper records, by authorised and trained personnel. Samarcanda adopts technical and organisational measures appropriate to the risk, aimed at protecting the confidentiality, integrity, availability and resilience of systems and data.

12. Recipients of personal data

employees, collaborators and persons authorised by Samarcanda, within the limits of their respective duties;
providers of hosting, maintenance, IT security, Website management and technical support services;
providers of cloud, e-mail, chat and communication services;
payment service providers and parties involved in delivering the requested services;
consultants and professionals bound by confidentiality obligations;
providers of external platforms voluntarily used by the user;
public authorities, law-enforcement bodies and other parties to whom disclosure is required by law or necessary to protect a legal right.

Providers that process personal data on behalf of Samarcanda are appointed as data processors pursuant to Article 28 GDPR where the relevant conditions are met. Other parties may act as independent data controllers where they independently determine the purposes and means of the processing activities within their remit. An up-to-date list of data processors may be requested at privacy@samarcanda.it.

13. Transfers outside the European Economic Area

The use of certain technology providers may involve the processing or transfer of personal data to countries outside the European Economic Area. Such transfers take place in compliance with Articles 44 et seq. GDPR, on the basis of adequacy decisions, standard contractual clauses or other applicable safeguards.

14. Retention periods

Website logs: maximum 365 days, currently deleted manually, unless further documented retention is required.
Logs displayed in the server control panel: current month and previous month, subject to verification of the retention periods applied by the infrastructure provider.
Matomo data: 730 days.
Account data: for the lifetime of the account and thereafter for the time necessary to comply with applicable obligations and protect legal rights.
Requests and support conversations: for the time necessary to manage them and for any subsequent period required to protect legal rights.
Administrative, tax and accounting data: for the periods required by law.
Data processed on the basis of consent: until consent is withdrawn, without prejudice to retention necessary to document consent and the activities carried out.

15. Data subject rights

In the cases provided for by the GDPR, data subjects may exercise their rights of access, rectification, erasure, restriction, objection and data portability, as well as withdraw consent at any time and not be subject to decisions based solely on automated processing where the applicable conditions are met.

Requests may be sent to privacy@samarcanda.it. The DPO can be contacted at dpo@samarcanda.it. Samarcanda may request the information necessary to verify the identity of the person making the request.

16. Complaints and updates

Data subjects may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or seek a remedy before the competent courts.

This notice may be updated as a result of legislative, organisational or technical changes, new features or changes in service providers. The updated version is published on the Website together with the date of the update.

PART II — COOKIE POLICY

This Cookie Policy describes the cookies and similar technologies actually identified on the Website as at the date of the update and supplements the privacy notice set out above.

1. What cookies are

Cookies are small text files that a website sends to a user’s device and that may be read during subsequent visits. They may be used for technical purposes, to store preferences or, where applicable, for statistical analysis and profiling.

2. Technical cookies used

Cookie	Provider	Function	Duration
PHPSESSID	Samarcanda / website	Session management	Session
hu-consent	Hu-manity.co / Compliance	Storage of preferences expressed through the banner	30 days
wp-wpml_current_language	Samarcanda / WPML	Storage of the selected language	24 hours
wordpress_logged_in_[hash]	Samarcanda / WordPress	Authentication management on the public website	Session
wordpress_[hash]	Samarcanda / WordPress	Authentication management in restricted areas; the same name may be used with different paths	Session

3. Matomo

Matomo is configured in cookieless mode and does not install analytics cookies. The processing of technical data for statistical purposes is described in Part I. Google Analytics, Bing, Reddit and other advertising trackers referred to in previous checks do not appear to be active.

4. Brevo Conversations

According to the checks available, the Brevo Conversations widget operates without cookies and without active analytics features. Any processing of data entered in the chat is described in Part I.

5. Google reCAPTCHA

Google reCAPTCHA is present in the registration form and in the profile-editing form within the user area. Its activation may involve the processing of technical data and the use of the provider’s own technologies necessary to assess the risk of automated interactions. Information on the processing is provided in Part I and in Google’s privacy notice.

6. Banner and preference management

The Website uses the Compliance by Hu-manity.co system to manage the banner and user preferences. The banner allows users to reject, accept or customise the available choices and stores the decision through the technical cookie hu-consent.

Users may change or withdraw their preferences at any time through the relevant control available on the Website. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Profiling cookies and third-party content

As at the date of the technical checks referred to in this policy, no profiling cookies or advertising trackers appear to be active. Should non-essential tools be introduced in the future, they will be activated only after valid consent has been obtained and this policy will be updated.

Any content from, or links to, external platforms may result in processing by the relevant providers when the user chooses to interact with such content or open the link.

8. Managing cookies through the browser

Users may also delete or block cookies through their browser settings. Disabling technical cookies may prevent the restricted area or other Website features from functioning correctly.

9. Contact details and updates

For questions concerning this Cookie Policy or to exercise data subject rights, please write to privacy@samarcanda.it. The DPO can be contacted at dpo@samarcanda.it.

Last updated: 29 July 2026.