Privacy notice — Always bestprice Travel
Last updated:
This notice describes the processing of data associated with visiting always-bestprice.com and using its account features, travel content, favourites, alerts, groups and related services. Information specifically about statistics is also available in Statistics privacy and Cookies and statistics preferences.
Controller and contact details
The controller is M-TECH SRL, Via Palma il Vecchio 17, 30021 Caorle (VE), Italy, Italian tax code/VAT number 05008800277, REA VE-472593. For information about the processing or to exercise your rights, you can write to info@always-bestprice.com.
What data we process and where it comes from
When you visit the website, the systems needed to provide it may process your IP address, the date and time of requests, the pages and resources requested, technical information about your browser and device, request outcomes and error reports. This information may also appear in the logs of the infrastructure hosting the service.
If you sign in with Google through Emergent Auth, we receive the profile data used by the integration: your name, email address, profile picture and the identifiers needed for your account and session. Your Google account password is not shared with the portal. Signing in to Google and managing the connection are also subject to Google’s information about its sign-in service.
If you use personal features, we process what you choose to save or send: favourites, destinations, selected properties and rooms, travel dates, occupancy, currency, reference prices, alert preferences, notifications, savings goals and records, group memberships and messages. Technical identifiers allow this data to be linked to your account.
For push notifications, when you enable them, we process the browser subscription, including the endpoint and technical keys needed for delivery. The browser’s push service may receive the data needed to deliver the notification.
If you are authorised to use Studio and the editorial tools, we process the content entered, the associated media or links, location coordinates, publication status and information about the author and changes. Avoid entering personal data about other people that is unnecessary or that you are not authorised to share.
The information you send by email or through communication features includes the sender’s address and the content of the request. We do not ask you to include health data, identity documents or other particularly sensitive data in messages or travel content.
Purposes and legal bases
| Purpose | Data and legal basis |
|---|---|
| Provide pages, resources and technical features; prevent errors and abuse | Relevant connection data and logs. Legitimate interest in maintaining a functioning and secure service, within the limits necessary for this purpose: Article 6(1)(f), GDPR. |
| Create and manage the account, session, favourites and other requested personal features | Sign-in data, profile and saved choices. Performance of the requested service or pre-contractual steps requested by the user: Article 6(1)(b). |
| Manage configured alerts and service-related communications | Travel and price settings, contact details and the chosen channel. Performance of the request: Article 6(1)(b). Promotional messages unrelated to these requests require a separate choice. |
| Enable groups, messages, shared results and editorial activities | Data and content you enter, group membership, author and changes. Performance of the requested feature: Article 6(1)(b). |
| Respond to requests and handle any disputes | Relevant correspondence and documents. The data subject’s request, applicable obligations or interest in managing and defending the relationship, depending on the circumstances: Article 6(1)(b), (c) or (f). |
| Produce statistics with Google Analytics 4 | Data about visits to public pages. Consent: Article 6(1)(a), as described in the two dedicated notices. |
For processing based on legitimate interest, you can object by explaining your situation. For processing based on consent, you can withdraw your choice without affecting the processing carried out before withdrawal. Reference: GDPR, Articles 6 and 13.
Automated comparisons and alerts help you view prices and opportunities: an alert, a click or the internal status «avviata» do not confirm a booking or a payment.
Hotel searches, booking initiation and partners
The server may query integrated hotel search and comparison services, including Nuitée/LiteAPI and MakCorps, transmitting the criteria needed for the search, such as the property or destination, dates, occupancy and currency.
The internal record of an initiated booking links the selected service, its link, the dates, the displayed price and the request status to the account. Payment card details are not required for this record.
External links, including Nuitée and Booking, are used to proceed with a booking, depending on the selected service. The data requested and actions performed on the provider’s website follow that process and its privacy notice. Merely saving the status «avviata» on the portal is not equivalent to contractual or payment confirmation.
When you open a partner link, you also visit an external service: the recipient may receive the technical data of the request and the parameters contained in the link. For processing carried out on its own website, the partner applies its own privacy notice. Nuitée: privacy, Nuitée: terms and privacy roles, MakCorps: privacy.
Who may receive the data
Data may be accessed by people authorised by M-TECH to manage the service and by the technical providers involved in the features used: infrastructure, database, authentication, email delivery, push notifications, support and travel APIs. Data from personal features is stored in the service’s application database.
The Emergent platform is involved in hosting and integrated technical features, including authentication and the email relay service. For activities performed on behalf of the customer, Emergent describes its role and terms in its DPA, with information about subprocessors and locations.
In groups and leaderboards, names, messages and results may be visible to the other users for whom that feature is intended. Editorial and travel content becomes publicly visible when published or shared through the available features: do not include confidential information in content intended for publication.
Google, Mapbox, Vimeo and other external services may also process data for their own purposes, in accordance with their respective privacy notices; they are not all categorised indiscriminately as M-TECH’s processors. Data may be disclosed to authorities or other parties when required by an applicable obligation or the protection of a right.
External maps, fonts, images and videos
Mapbox maps are activated only after an explicit action by you, accompanied by a notice and a link to Mapbox Privacy. Before activation, the portal does not request maps, tiles or remote previews from Mapbox. After activation, the browser communicates with Mapbox to provide the map and may transmit your IP address, technical information and service usage data. Collection of map performance metrics is disabled; this setting does not eliminate other communications with Mapbox, including events relating to loading and using the service. The provider’s privacy notice also describes identifiers and browser storage.
Fonts are served by the portal, without asking the browser to load them remotely from Google Fonts. Images, however, may be hosted on external domains: loading them involves requests to the respective providers, with technical data such as your IP address, browser information and potentially the referring page.
Content may include YouTube and Vimeo players, loaded after an explicit action by you on the relevant content. YouTube’s privacy-enhanced mode and Vimeo’s DNT option are used. These settings do not eliminate all processing: connection data is communicated when loading, and technical storage may remain or provider cookies already present in the browser may be transmitted. Being already signed in to these services may affect the data processed. YouTube information, Vimeo privacy, Vimeo player cookies.
The Statistics preferences panel controls only the GA4 integration and the storage of the choice described in the dedicated pages: it should not be interpreted as a general control for every external service. Processing or storage that is not necessary for the requested feature requires the relevant legal basis and, where required, the relevant consent; accepting GA4 statistics alone does not authorise it.
Cookies and other browser storage
The website uses the technical cookie session_token, with a configured duration of 7 days, for the sign-in session; logging out requests its removal. The cookie’s duration alone does not determine how long the account is retained in the database.
Local storage includes language and currency preferences, operational information for returning after sign-in or joining a group, the state of some interface elements and the statistics choice abp_consent. Some items remain in the browser until site data is cleared or the application updates them; others belong to the browser session. Manual clearing may also reset preferences and the remembered refusal.
GA4 cookies are managed only according to the Analytics choice. Their configured duration of approximately two years may be renewed through consented activity and shortened by the browser; it is not an overall limit from the first visit. Details are provided in Cookies and statistics preferences. Storage used by third-party services is distinct from that used by the portal.
Data retention
Not all data has the same retention period. For data without a fixed period, the need for retention is assessed using the following events and criteria, distinguished by feature:
| Category | Retention criterion |
|---|---|
| Profile and account connection | Availability of the requested personal features and management of the account relationship; a request to close the account or erase data leads to a review of the data still needed and any specific grounds for retaining it. |
| Favourites, saved searches and alerts | Continued existence of the saved item or requested alert; ending the alert, removing the favourite or the travel dates passing ends or reduces the operational need, which must be distinguished from any requests still open. |
| Booking initiations and correspondence | Handling the request and any related outcomes, checks or disputes; data strictly necessary for an obligation or dispute is retained in relation to that specific obligation or proceeding. |
| Groups and messages | Conversation and sharing function for participants; leaving a group does not automatically mean erasing the other participants’ entire conversation. |
| Studio content and editorial history | Publication and management of content, attribution of changes and resolution of errors or disputes concerning the content; copies no longer needed are not retained as an indefinite personal archive. |
| Technical logs and security | Relevance of the data for identifying and resolving the specific error, incident or abuse; any need to retain it to handle a request from an authority or a related dispute. The criterion concerns the log’s specific purpose and not the account’s duration. |
M-TECH applies these criteria by reviewing data in relation to the events indicated and requests received at info@always-bestprice.com, including through manual review. Data no longer needed is erased or anonymised; when a specific reason for retention remains, processing is limited to that purpose. You can use the same contact to request review or erasure of your account data. The handling of shared data also takes the rights of other participants into account.
For GA4, the periods described in the dedicated notice apply: 2 months for events, 14 months for user data, with reset on new activity enabled. These settings concern the data to which GA4 retention applies and are distinct from cookie duration and aggregate reports.
Processing outside the European Economic Area
The services used have international infrastructure and providers and may involve processing outside the European Economic Area. Emergent indicates infrastructure in the USA, EU and India; the application’s region does not automatically determine that of all subprocessors. Mapbox and Vimeo describe processing in the United States as well. Google services use international infrastructure in accordance with their respective terms.
Providers publish the relevant transfer terms and mechanisms, such as adequacy decisions, the Data Privacy Framework and standard contractual clauses where applicable. You can consult Emergent DPA, Emergent locations, Mapbox privacy, Google transfers and Vimeo privacy. For information about safeguards relating to processing performed for the portal, you can contact M-TECH at the address given above.
Choices and rights
You can view public content without creating an account. The data needed to sign in or use a requested feature serves to provide it; not providing it may prevent its use. Optional fields and preferences may be left blank. For push notifications, you can also change your browser’s permissions; disabling them prevents delivery to that device.
You can request access, rectification, erasure, restriction and, where applicable, portability; you can object to processing based on legitimate interest and withdraw consent. Requests are assessed according to the conditions for exercising the relevant right; any specific reasons requiring the retention of some data are communicated in the response. You can write to info@always-bestprice.com and lodge a complaint with the Italian Data Protection Authority. Information about rights — EDPB.
Updates
This notice is updated when relevant services, processing activities or providers change. Reading the new version does not replace the consent required for new or different optional processing.