Gnammus Cookie Policy

Last updated: 21 October 2026

Preamble

This Cookie Policy ("Policy") constitutes an Appendix to the Gnammus Terms and Conditions, hereinafter the "General Terms", and describes the tracking technologies used by the Platform, both through the website and through the mobile application. This Policy shall also be deemed to form an integral part of the Gnammus Privacy Policy, hereinafter the "Privacy Policy".

Matters not expressly governed by this Policy shall be governed by the General Terms and the Privacy Policy.

Gnammus is a service of:

RTLP S.r.l. — Corte dei Mesagnesi 30 — 73100 Lecce (LE) — Italia

VAT number and tax code: 02683850743 — REA: LE-361688

Email address: [email protected] — Certified email (PEC): [email protected]

Art. 1 — Definitions

1.1. For the purposes of this Policy, the definitions set out in Art. 1 of the General Terms and in Art. 1 of the Privacy Policy apply. In addition, the following definitions apply.

a. Tracking Tool. Any technology — for example cookies, scripts, tags, pixels, web beacons, fingerprinting, device or advertising identifiers — that enables Users to be tracked, for example by collecting or storing information on the User's device or by gaining access to information already stored on it.

b. Cookie. Small pieces of data stored within the User's browser.

c. Device Identifier. A code generated by the operating system or by software installed on the User's device that makes it possible to recognise a specific installation of the application. In the mobile application, it performs a function similar to that of Cookies in the browser.

d. Strictly necessary Tracking Tool. A Tracking Tool the use of which is strictly necessary in order to provide the Service explicitly requested by the User or to carry out the transmission of a communication over an electronic communications network. Pursuant to Article 122 of Italian Legislative Decree No. 196/2003 (Personal Data Protection Code) and applicable legislation, its use does not require the User's prior consent.

e. Non-necessary Tracking Tool. Any Tracking Tool other than those referred to in letter d, including those used for the purposes of third-party statistical measurement, profiling, behavioural advertising or personalisation not requested by the User. Its use requires the User's prior consent.

Art. 2 — Tracking Tools used

2.1. The Platform uses Tracking Tools managed directly by RTLP ("first-party Tracking Tools") and Tracking Tools that enable services provided by third parties ("third-party Tracking Tools"). Unless otherwise specified in this Policy, third-party providers may access the Tracking Tools they manage.

2.2. The validity and expiry of Cookies and other Tracking Tools may vary depending on the duration set by RTLP or by the third-party provider concerned. Some of them expire at the end of the User's browsing session, while others have a specific duration indicated in this Policy.

2.3. The Tracking Tools used by the Platform are listed in Arts. 3 and 4; Art. 5 describes the statistical measurement of the website and campaign measurement in the application. The list is updated by RTLP whenever the services or providers used change.

2.4. Any processing of personal data connected with the use of Tracking Tools is governed by the Privacy Policy, to which reference is also made for details of the third-party providers, their role and the place of processing.

Art. 3 — Strictly necessary Tracking Tools on the website

3.1. Through the website, the Platform uses the technical Cookies and Tracking Tools listed below, which are strictly necessary for the operation and provision of the Service. Refusing or disabling these Tracking Tools may make it impossible to use the Platform.

a. First-party Tracking Tools

These are managed directly by RTLP and perform functions essential to the provision of the Service:

Authentication Cookies — keep the User logged in, associate requests with the current session, allow the session to be renewed without the credentials being requested again at each access and, once the procedure is complete, return the User to the page from which they started logging in or registering. Duration: one day for the session cookie, up to twelve months for the renewal cookie, one hour for the return-page cookie. Where access takes place through a third-party authentication service, the Platform's authentication server also sets its own session and security cookies, with a duration limited to the browsing session.
Security Cookies — protect access to and use of the Platform against unauthorised requests. Duration: no longer than the browsing session.
Technical Preference Cookies — store the settings needed to provide the Service correctly, such as the interface language. Duration: up to twelve months.
Interface State Cookies — record that a service notice has already been shown to the User, so that it is not shown again at each access. Duration: browsing session.

b. Cloudflare

Company: Cloudflare, Inc. — Place of processing: United States of America

Cloudflare is a traffic optimisation, protection and distribution service. The way in which this service is integrated means that all Platform traffic is filtered through the Cloudflare network. Cloudflare processes tracking data and may process Personal Data as a Processor, as set out in Art. 9 of the Privacy Policy.

Cookies that Cloudflare may set when necessary:

_cfuvid — distinguishes individual sessions for the purpose of rate limiting requests. Duration: browsing session.
__cf_bm — distinguishes traffic generated by people from automated traffic, in order to protect the Platform. Duration: 30 minutes. It cannot be disabled, as it is an integral part of the traffic protection service.
cf_clearance — certifies that a security check has been passed, so that it is not repeated on every request. Duration: up to 7 days.

Art. 4 — Tracking Tools in the mobile application

4.1. The Gnammus mobile application does not use Cookies, which are a technology specific to browsers, but uses device identifiers and equivalent technologies that fall within the definition of Tracking Tool in Art. 1.a.

4.2. First-party technical identifiers. The application generates and stores on the device the identifiers needed to maintain the User's session, ensure secure access and store the application settings. These identifiers are strictly necessary and are deleted when the application is uninstalled.

4.3. Embrace. The application integrates Embrace (Embrace Mobile, Inc.) to detect errors, anomalies and performance issues. The provider receives an installation identifier and data relating to the device and to application errors. This tool is strictly necessary for the security and stability of the Service. Further information is provided in Art. 9 of the Privacy Policy.

4.4. WonderPush. The application integrates WonderPush (Wonder Push SAS) to deliver push notifications. The tool generates and stores on the device an installation identifier, which the provider receives together with the identifier assigned by the operating system for receiving notifications and the technical characteristics of the device set out in Art. 9 of the Privacy Policy. This tool is activated only if the User grants permission to send notifications through their device settings, and ceases to operate when that permission is withdrawn. Further information is provided in Art. 9 of the Privacy Policy.

4.5. AppsFlyer. The application integrates AppsFlyer (AppsFlyer Ltd.) to measure, at device level, the promotional campaigns that generate installs, app opens and sign-ups, to optimise those campaigns and to enable the advertising networks listed in Art. 9(m) of the Privacy Policy to show Gnammus ads to the User and to people with similar interests. The tool generates and stores on the device its own identifier, which persists until the application is uninstalled, save where the device is restored from a backup, and accesses the device's advertising identifier. The tool is not strictly necessary for the provision of the Service and is activated only with the prior consent of an adult User and, on iOS devices, subject to the tracking authorisation requested by the operating system, as provided for in Art. 6.5. Further information is provided in Art. 9 of the Privacy Policy.

4.6. Device permissions. The application requests certain permissions from the operating system — camera, microphone, media library, location, network status and wireless connection status — described in Art. 3.8 of the Privacy Policy. Access to the media library and to location involves reading information present on the User's terminal equipment, but takes place only upon the User's action and solely to the extent necessary to perform the function requested by the User: the exemption provided for in Article 122(1) of Italian Legislative Decree No. 196/2003 therefore applies, and no consent is required in addition to the permission granted through the operating system.

Art. 5 — Statistical measurement and non-necessary Tracking Tools

5.1. Statistical measurement of website use. The Platform uses Fathom Analytics, a service provided by Conva Ventures Inc., to measure use of the website. The service does not store information on the User's device or access information stored on it: it therefore does not fall within the definition of Tracking Tool in Art. 1.a and its use does not require the User's consent. The processing is based on the legitimate interest referred to in Art. 11.2(c) of the Privacy Policy.

5.2. Campaign measurement in the application. For Users for whom the tool referred to in Art. 4.5 is not active, RTLP directly measures, in aggregate form, which promotional campaigns generate application installs and sign-ups. To this end, after registration, the application: on Android devices, reads once from the Google Play Store the parameters of the campaign through which it was installed; on iOS devices, reports the completed sign-up to the operating system's aggregated measurement systems (SKAdNetwork and AdAttributionKit) and requests from Apple the attribution of Apple Ads campaigns, which does not return data capable of identifying the User or the device. RTLP retains only the counts per campaign, without linking them to the account and without device identifiers. Since these are first-party tools used solely for aggregated statistics, they are treated as equivalent to strictly necessary Tracking Tools and their use does not require the User's consent; the processing is based on the legitimate interest referred to in Art. 11.2(c) of the Privacy Policy. For Users resident in Germany, the reading of campaign parameters and the attribution request to Apple are not carried out.

5.3. The only Tracking Tool used by the Platform that is not strictly necessary is the tool described in Art. 4.5, which operates solely in the mobile application and is subject to the User's consent.

6.1. The Tracking Tools listed in Art. 3 and in Arts. 4.2 to 4.4 are strictly necessary and, pursuant to Article 122 of Italian Legislative Decree No. 196/2003, do not require the User's prior consent. Nor is such consent required for the statistical measurement service referred to in Art. 5.1 or for the campaign measurement referred to in Art. 5.2, for the reasons stated therein. By contrast, the tool referred to in Art. 4.5 requires the User's prior consent, as provided for in Art. 6.5.

6.2. The User may in any event manage Tracking Tools through their browser or device settings, preventing their use or storage and deleting those already stored. Instructions are available in the documentation of the browser or operating system used.

6.3. The User is advised that blocking or deleting the Tracking Tools referred to in Art. 3 results in the loss of authentication and may prevent access to the Platform or the use of some of its functionalities.

6.4. Permission for the push notifications referred to in Art. 4.4 may be granted or withdrawn at any time through the User's device settings or the application settings.

6.5. Consent to the measurement and advertising tool. Consent to the tool referred to in Art. 4.5 is requested within the application, after registration, only from Users who have reached the age of 18; until consent is given, the tool remains inactive. On iOS devices, a User who gives consent is also presented with the operating system's tracking authorisation request: if the User does not grant it, the tool is not activated. The User may withdraw consent at any time from the application settings: withdrawing consent is as easy as giving it, stops the collection of data and its transmission to the advertising networks, and does not affect the lawfulness of processing carried out before its withdrawal. Refusal or withdrawal of consent does not entail any restriction on access to the Service or its functionalities; the aggregated measurement referred to in Art. 5.2 applies to any User for whom the tool is not active.

6.6. Through any opt-out or preference management links made available by each third-party provider, the User may also manage preferences specific to the individual service.

6.7. Since the use of Tracking Tools by third parties cannot be technically controlled by RTLP, any specific reference to third-party Tracking Tools is to be considered indicative. The User is invited to consult the privacy policies of the third-party services for full information.

Art. 7 — Controller and rights of the User

7.1. The Controller of any personal data collected through Tracking Tools is RTLP S.r.l., which can be contacted using the details set out in Art. 2 of the Privacy Policy, including the address [email protected].

7.2. To exercise their rights concerning the protection of personal data, including the right to lodge a complaint with the competent supervisory authority, the User is invited to consult Art. 12 of the Privacy Policy.

Art. 8 — Amendments and cross-reference

8.1. This Policy may be amended to adapt to technological and regulatory changes, as well as to the introduction or discontinuation of services and providers. In such case, the provisions on amendments to the Terms contained in the General Terms apply. The User is invited to consult this page periodically, with reference to the date of last update indicated at the top.

8.2. Matters not expressly governed by this Policy shall be governed by the General Terms and the Privacy Policy, including — by way of example — the provisions on governing law, jurisdiction, limitation of liability and the severability clause.