This Cookie Policy supplements the EL SPA Privacy Policy and describes cookies, localStorage, sessionStorage, scripts and other technologies used by the portal. Technologies that are not strictly necessary are disabled by default and are activated only where the required user choice has been made.
1. Controller
DREAMLAND SOCIETA' A RESPONSABILITA' LIMITATA, VAT No./Tax Code 13233911000, Via Plinio 15/C, 00193 Rome (RM), Italy, e-mail mail@elspa.it.
2. Consent management
On the first visit, the 'Your privacy preferences' banner appears with options to reject non-essential technologies, customise settings or accept all. Optional categories are disabled by default. Preferences may be changed at any time using the 'Privacy and cookie preferences' link in the footer.
3. Categories
- Essential: required for security, cart, payment, staff authentication and storage of privacy preferences. They cannot be disabled where they are indispensable to provide the requested service.
- Functional: improve continuity of the experience between visits, for example by remembering an AI conversation or a cart. They are disabled by default and require consent when they persist beyond the session.
- Analytics: currently inactive.
- Marketing/advertising: currently inactive; Meta Pixel, Google Analytics, Google Tag Manager, Hotjar or similar advertising trackers are not installed.
4. Active technologies
| Name/key | Type | Category | Purpose | Duration | Provider |
|---|---|---|---|---|---|
| elspa_consent | Cookie | Essential | Stores privacy/cookie choices | 6 months | EL SPA |
| sb-*-auth-token | localStorage | Essential - staff | Session/authentication for the restricted dashboard | Until logout/end of session | Lovable Cloud/Supabase |
| elspa-cart-v1 | localStorage | Essential | Stores cart contents | Until the cart is emptied | EL SPA |
| elspa-cart-identity-v1 | localStorage / sessionStorage | Functional | Remembers a cart to resume; without consent it remains limited to the session | Up to 30 days with consent | EL SPA |
| elspa_advisor_v1 | localStorage / sessionStorage | Functional | Remembers the AI Assistant conversation between visits; without consent it is limited to the session | Max. 90 days with consent | EL SPA |
| elspa_promo_popup_never | localStorage | Functional | Remembers the choice not to show a promotional popup again | Until withdrawal/deletion of preferences | EL SPA |
| Session UI states | sessionStorage | Session technical | Prevents repeated popups/banners during the same visit and maintains interface state | End of session | EL SPA |
| sidebar_state | Cookie | Essential - staff | State of the administrative dashboard menu | 7 days | EL SPA |
| __stripe_mid / __stripe_sid and Stripe technologies | Third-party cookie/script | Essential at checkout | Payment and fraud prevention | According to Stripe configuration; typically 1 year / 30 minutes for the two cookies indicated | Stripe |
5. Inactive technologies
As of the version date of this policy, no analytics/marketing cookies or trackers are active. Google Fonts has been removed as a remote resource and fonts are hosted locally; the relevant entry remains only in the internal historical technology register.
6. Withdrawal and deletion
Withdrawal of functional consent blocks unnecessary persistence and, where technically possible, deletes the related localStorage keys. Essential technologies remain active to the extent necessary to provide the requested service or maintain security.
7. Google Consent Mode
The website architecture is prepared to translate user choices in the future into Google Consent Mode v2 signals, all set to 'denied' by default. This readiness does not in itself install or activate Google Analytics/Ads tools.
8. Browser settings
The user may also delete cookies and website data through browser settings. Deletion may result in loss of the cart, a saved AI conversation or preferences previously stored on the device.
9. Updates
The technology register is managed internally and updated whenever cookies, storage, pixels, scripts or APIs affecting the user’s device are introduced, removed or changed.
Legal and documentary references
- Regulation (EU) 2016/679 - GDPR: https://eur-lex.europa.eu/eli/reg/2016/679/oj/?locale=it
- Italian Privacy Code - Legislative Decree No. 196/2003, Article 122: https://www.normattiva.it/
- Italian Data Protection Authority - Guidelines on cookies and other tracking tools, 10 June 2021: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876
- Italian Data Protection Authority - list of processing operations subject to a DPIA, 11 October 2018: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9058979
- Regulation (EU) 2024/1689 - AI Act, consolidated text 2026: https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/ita
- European Commission - AI literacy, Q&A: https://digital-strategy.ec.europa.eu/it/faqs/ai-literacy-questions-answers