Cookie Policy

Last updated: 20 June 2026 · Version 2.2 · Part of our Privacy Policy

We use first-party essential cookies and local storage to run the platform; these are always active and require no consent. Google Analytics 4 is also active, but only after you give explicit consent through the cookie banner — never before, and you can withdraw it at any time. We do not yet run advertising. We also rely on two technical third-party services already in use — hCaptcha (bot protection on our forms) and Nominatim / OpenStreetMap (address geocoding) — both detailed below. Google AdSense and Web Push notifications are planned for the future and will be enabled only after we update this policy and, where required, ask for your consent.

1. What Are Cookies?

A cookie is a small data file placed on your device when you visit a website. Cookies allow a site to recognise your device and remember information about your visit — such as whether you are logged in or which preferences you have set.

This policy also covers similar technologies that serve the same purpose, including browser localStorage, which we use instead of traditional cookies for session management. Under Article 5(3) of the ePrivacy Directive 2002/58/EC and the related guidelines of the European Data Protection Board, the consent rules described below apply to any storage of or access to information on your device, regardless of the technical mechanism used.

2. Strictly Necessary Storage (no consent required)

These are required for the platform to function and are set regardless of your cookie preferences. They are all first-party and contain no advertising or cross-site tracking data.

Key / Name	Purpose	Duration	Type
`bit_jwt`	Your authentication token (JWT). Keeps you logged in between sessions. Signed and expiring — cannot be forged.	24 hours, then invalidated server-side	localStorage — First party
`bit_user`	Cached profile data (alias, role, avatar) to avoid re-fetching on each page load.	Cleared on logout	localStorage — First party
`bit_support`	Local record of events you have supported, used to prevent duplicate support actions within the same session.	Persistent, cleared on logout	localStorage — First party
`bit_consent`	Stores your cookie preference (accepted / declined) so the banner does not reappear on every visit.	Persistent (until you clear browser data or manage preferences)	localStorage — First party
CSRF token	Protects forms from cross-site request forgery attacks. Contains no personal data.	Session (deleted when browser closes)	Session cookie — First party
PHP session cookie `bit_admin_session`	Maintains the admin panel session for authenticated administrators only. Never set for regular users.	Session (deleted when browser closes or on logout)	Session cookie — First party
Map style preference	Remembers whether you last used the dark or light map style.	Persistent (until you clear browser data)	localStorage — First party

3. Cookies and Storage Requiring Consent (active)

The following service is active on the Platform today but is loaded only after you give explicit consent through the cookie banner. If you decline, or until you accept, it is never loaded and no data is sent to its provider.

3.1 Google Analytics 4 (active — consent required)

We use Google Analytics 4 to understand how visitors use the platform in aggregate — pages visited, session duration, traffic sources, approximate location. When you click "Accept all" in the cookie banner, we load the Google Analytics script and it may set cookies (such as _ga and related identifiers) on your device and send usage data to Google. The provider for users in the European Economic Area is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google LLC (USA) may act as a sub-processor. See Google's Privacy Policy and how Google uses cookies.

Consent is required and remembered. Analytics is loaded only after you click "Accept all". Your choice is stored on your device (bit_consent); if you have accepted on a previous visit, Analytics will load automatically on your next visit without asking again. You can withdraw consent at any time via the "Manage cookie preferences" button above, after which Analytics is no longer loaded. Google Analytics 4 by design does not log full IP addresses; we do not configure any additional advertising or data-sharing features within Analytics.

Transfers outside the EEA. Because Google operates globally, accepting Analytics may involve transferring data to servers outside the European Economic Area. Google states that such transfers are covered by appropriate safeguards under Chapter V of the GDPR (including standard contractual clauses and the EU–US Data Privacy Framework). For the exact mechanism Google applies, see Google's Privacy Policy linked above.

4. Functional Third-Party Services (active)

The following third-party services are already in use and are technically necessary for specific features (form protection and address geocoding). They are not advertising or analytics services. They run only when the relevant feature is used — for example, when you submit a protected form or enter an address — and they may process data or set their own storage on your device as described in each provider's own policy.

4.1 hCaptcha (bot protection)

We use hCaptcha on registration, contact and report forms to tell humans apart from automated bots and protect the Platform from spam and abuse. hCaptcha is provided by Intuition Machines, Inc. (USA). When the widget loads, it may set its own cookies or local-storage items and process your interaction with the challenge in order to assess whether you are human, as described in the hCaptcha Privacy Policy. We do not receive or store the data hCaptcha collects to make this assessment.

Transfers outside the EEA. Because Intuition Machines is established in the United States, using the anti-bot widget involves a transfer of data outside the European Economic Area. The provider declares that such transfers are subject to appropriate safeguards under Chapter V of the GDPR (such as standard contractual clauses or an equivalent framework); the details are set out in the hCaptcha Privacy Policy linked above.

4.2 Nominatim / OpenStreetMap (address geocoding)

When you enter an address — for example when registering a venue or creating an event — we send that address text to Nominatim, the geocoding service of OpenStreetMap, to obtain the corresponding map coordinates so the location can be shown on the map. The service is operated by the OpenStreetMap Foundation (United Kingdom). Only the address text you type is sent for this lookup. The United Kingdom benefits from a European Commission adequacy decision, so this transfer takes place within an environment recognised as providing an adequate level of protection. See the OpenStreetMap Foundation Privacy Policy.

5. Planned Future Services (not yet active)

We intend to introduce the following services in the future. They are not currently loaded or active on the Platform and no data is collected or sent to any provider through them at this time.

5.1 Google AdSense (planned)

When activated, Google AdSense will display contextual advertising on the platform. Advertising will be shown only to non-paying users — Pro Members will see no ads. Google AdSense may use cookies to serve ads based on your interests and prior visits to other websites. See Google's advertising policies.

Before activation, we will update this Cookie Policy, present a renewed consent banner, and load Google AdSense only after explicit consent. In accordance with Articles 26 and 28 DSA, we will not use sensitive categories of personal data for ad targeting and will not display targeted advertising to users we know to be minors. Declining advertising cookies will not affect your access to any platform feature.

5.2 Direct sponsorships and sponsored content (planned)

Separately from programmatic advertising such as AdSense, we may in the future host direct sponsored content — for example a section or placement agreed directly with a sponsor (such as a musical-instrument brand or a festival). This is a direct commercial relationship, not third-party ad targeting, and would not by itself require advertising cookies.

If and when we introduce such content, we commit to clearly and prominently labelling it as sponsored or advertising, so that its commercial nature is immediately recognisable to you, in line with Directive 2005/29/EC on unfair commercial practices (as amended by the "Omnibus" Directive (EU) 2019/2161) and Article 26 of the DSA. The exact form and implementation are not yet decided; this Policy will be updated before any such content goes live.

5.3 Stripe (planned)

Stripe will be used for processing Pro Membership and Event Boost payments when paid services are activated. Stripe may set its own cookies for fraud prevention and session integrity on the checkout pages. These are considered strictly necessary to complete a payment you have initiated and will be set only on the relevant checkout pages.

5.4 Web Push notifications (planned)

We are preparing browser push notifications (for example, to alert you about nearby availability or events). This feature is not yet active: no push data is collected today. When activated, enabling notifications will require the browser's own native permission prompt, which you must accept before any subscription is created — this happens independently of, and in addition to, any cookie consent. If you enable it, we will store a push subscription endpoint provided by your browser, associated with your account, used solely to deliver the notifications you asked for. You will be able to disable notifications at any time from your browser or your account settings. This Policy will be updated before the feature goes live.

6. Legal Basis for Processing

Essential storage (JWT, CSRF, session, bit_user, bit_support, map preference, bit_consent): contract performance (GDPR Art. 6.1.b) and, where applicable, legitimate interest (Art. 6.1.f). Exempt from consent under Article 5(3) of the ePrivacy Directive ("strictly necessary" exception).
Analytics cookies (Google Analytics 4, active): your explicit prior consent (Art. 6.1.a GDPR and Art. 5(3) ePrivacy), given through the cookie banner and withdrawable at any time via the "Manage cookie preferences" button above. Analytics is never loaded without this consent.
Functional third-party services: for hCaptcha, our legitimate interest in keeping the Platform secure against bots, spam and abuse (Art. 6.1.f); for Nominatim/OpenStreetMap geocoding, contract performance (Art. 6.1.b), since it is strictly necessary to register a venue or create an event you have asked to publish. These services are necessary to provide features you actively request and are not optional cookies subject to the consent banner; any storage they set is part of delivering a function you initiated.
Future advertising cookies (AdSense): will require your explicit prior consent (Art. 6.1.a GDPR and Art. 5(3) ePrivacy) before activation.
Future payment cookies (Stripe): strictly necessary to complete a payment you have initiated, exempt from consent on the checkout pages only.
Future push notifications (Web Push): your consent (Art. 6.1.a), given through your browser's native notification permission prompt before any subscription is created.

7. Managing Your Preferences

You can change your cookie preferences at any time:

On this page — click "Manage cookie preferences" above to reopen the consent banner.
Via browser settings — clear site data for bandintour.com. This resets all preferences including your login session.
Via browser developer tools — open Developer Tools (F12) → Application → Local Storage → delete bit_consent to reset only the cookie preference.

Withdrawing consent stops any future data collection but does not affect data already collected prior to withdrawal. Accepting or refusing non-essential cookies is equally easy and requires the same single click: the consent banner presents a "Decline" button and an "Accept all" button side by side at the same level, with no obligation to accept. Refusing is the default outcome — until you actively click "Accept all", no analytics or advertising technologies are loaded.

8. Third-Party Content

Profiles may contain links to external platforms (social media, streaming services, ticket vendors). If you follow those links, those platforms may set their own cookies independently of your choices here.

If a profile contains a video trailer link (e.g. a YouTube embed), it is loaded only when you explicitly open that profile. YouTube may set cookies when the embed loads; we use the privacy-enhanced embed mode where available.

9. Changes to This Policy

We will update this Cookie Policy when we introduce new cookies or storage technologies, and in particular before activating Google AdSense, direct sponsored content, Stripe payments or Web Push notifications. The version date at the top reflects the last update. Material changes will be notified to registered users by email and will be subject to a renewed consent request where required by law.

10. Contact

Questions about our use of cookies? Contact us at privacy@bandintour.com. Data controller: IOCOS di G.C., Via F. Baracca traversa De Salvo 15, 89123 Reggio Calabria, Italy (P.IVA 02758080804).