Privacy and cookie notice

Last updated: 10 October 2026.

This is a courtesy translation. The Italian text prevails and Italian law applies.

1. Data controller

The Radar Concessioni service (radarconcessioni.it; in English BeachStake, beachstake.com) is run by Bellucci Srl, registered office at Via Giacomo Brodolini 4, 47922 Rimini (RN), Italy, VAT/tax code 04882010400, REA RN-448816, the data controller for the personal data collected through this website. For any request about your data you can write to info@radarconcessioni.it or to the certified email (PEC) srlbellucci@pec.it. Full company details are in the Legal notice.

Bellucci Srl has been the data controller since 17 September 2026, having taken over the role also for data collected before that date: same purposes, same office and same contacts as stated in this notice. Nothing has changed in the way your data is used.

2. What data we collect

• Account and sign-in: the email address and password you choose at sign-up (the password is stored as a cryptographic hash, rather than in plain text), your name and the sign-in sessions open on your devices.
• Sign-in log: at every sign-in we record the IP address and the browser type (user agent). They enforce the limit of 3 active sessions per account and detect sharing of the account with third parties, on the basis of our legitimate interest in protecting the service (art. 6.1.f GDPR). They are kept as long as the account exists.
• Contact forms (advisory request): the email, the message and, if you give them, name and phone number, with the date of the request and the ticked privacy-notice checkbox needed to send it. The form does not ask for consent to commercial communications. We do not store the IP address with the request: when it is sent we use a fingerprint of it, held in memory for one minute, only to limit repeated requests. To answer and prepare the quote, the request is passed to the advisory company that performs the engagement, named in the quote.
• Newsletter sign-up (the form at the bottom of some pages of the site, no account needed): the email, the page you signed up from, the date, the ticked privacy-notice checkbox and the ticked consent to receive the newsletter, with the version and the fingerprint of the accepted text. Here too we do not store the IP address: we use a fingerprint of it, held in memory for one minute, only to limit repeated requests.
• Subscriptions and payments: the email, the chosen plan, the customer and subscription identifiers at the payment provider. Card details do not pass through our servers: they are collected and stored by Stripe.
• Billing data: at checkout we collect, through the payment page, the data needed to issue the electronic invoice: company name or first and last name, address, VAT number for businesses and professionals, tax code for individuals and, if you provide it, the recipient code or the certified email (PEC) it should be delivered to. We process them to comply with a legal obligation (art. 6.1.c GDPR: invoicing and tax record keeping) and keep them for the period required by tax law (ten years).
• Browsing and statistical data: the analytics tool (Google Analytics 4, with anonymised IP) is used only if you give consent through the cookie banner; without consent it stays off (see section 8).
• Sign-up source: if you sign up from the page you reached through one of our ads, our server adds one to the daily count for that campaign. The count records only the day, the platform, the type of channel, the name of the ad and the version of the headline, taken from our own list (everything else becomes “other”). It does not contain your email, your IP address or any other data about you, and it is not linked to your account. No cookies are used for this, so it works even if you refuse cookies. If the page address carries click identifiers (gclid, fbclid), they go to Google Analytics only if you have given consent (see section 8). The counts are not shared with anyone and are kept for at most 24 months.
• Source linked to your account: when you create your account we store, linked to it, the ad or channel you came from (utm parameters, the gclid and fbclid click identifiers), the first page you visited, the referring site (domain and path only, without parameters) and the time of first arrival. If you accepted cookies in the banner (“Analytics and marketing” category), your browser remembers this until you close the tab; if you did not, we only use the parameters in the address of the sign-up page. It is kept for 365 days after sign-up, then deleted, or earlier if you delete your account. If you accepted cookies in the banner, the sign-up is also reported by our server: to Meta (Conversions API) with your email address turned into a SHA-256 hash (the platform uses it for matching: it remains personal data), your IP address and browser (which we do not keep) and, if present, the click data; to Google Ads with the click identifiers and, only when a gclid is present, the email hash. Without consent in the banner we send nothing.

3. Why we process it (purposes and legal basis)

• Sign-up, sign-in and service (reading the briefs, Pro subscription, reserved area) — performance of the contract (art. 6.1.b GDPR).
• Account security (session limit, device checks) — legitimate interest (art. 6.1.f GDPR).
• Replying to requests sent through the forms — pre-contractual steps at your request (art. 6.1.b GDPR).
• Commercial communications and news — only with explicit, separate consent to commercial communications (art. 6.1.a GDPR). The checkbox is optional and appears at sign-up: leaving it unticked does not prevent you from creating an account. The advisory request form does not contain it. The newsletter form has a checkbox of its own, separate from the privacy-notice one and never pre-ticked: it is the consent to receive the newsletter (new tenders and regulatory news, together with news about the service and commercial offers), and without it the sign-up does not go through. As proof of consent we record the date, the version and the fingerprint of the accepted text; not the IP address. At sign-up only the privacy notice and terms-of-service checkboxes are required, and those are not consent: they are the acknowledgement of a contract and of this notice.
• Invoicing and tax/accounting obligations — legal obligation (art. 6.1.c GDPR).
• Measuring how well our ads work — legitimate interest (art. 6.1.f GDPR) in understanding where to spend our advertising budget. The count does not allow anyone to be identified directly; however, on days with very few sign-ups, comparing it with the time an account was created might make it possible to guess which ad that person came from. To reduce this risk the counts are visible only to administrators and we hide numbers below 5, which are left out of every total. You may object (art. 21 GDPR) by writing to the address given in this notice; because the count is not linked to your account, we may not be able to recognise your data (art. 11 GDPR). If you do not want to be counted, remove the ad information from the page address before opening it.
• Source linked to the account and its reporting to Meta and Google Ads — only the parameters in the address of the sign-up page (ad and click identifiers), without consent, rest on legitimate interest (art. 6.1.f GDPR) in understanding which ads bring sign-ups; everything else — storage in the browser, the first page, the referring site, fbc and fbp and the reporting to Meta and Google Ads — happens only with the consent given in the cookie banner (art. 6.1.a GDPR). You can object to the first processing by writing to us.

You can withdraw consent at any time by writing to us or using the unsubscribe link in the emails: we will stop the related mailings. Consent given in the cookie banner is withdrawn from the “Manage cookies” link at the bottom of the pages: from then on we no longer send later sign-ups to Meta and Google Ads (those already sent cannot be recalled from here: you can ask us and the two platforms to delete them). Withdrawal does not delete an existing account or end an active subscription.

4. Retention

Account data is kept as long as the account exists; you can ask for its deletion at any time. Form requests are kept for the time needed to reply. A newsletter subscription lasts until you withdraw your consent: from then on the address stays with Brevo only as an address not to be contacted, and the proof of consent is deleted at your request. For the tax and accounting obligations tied to subscriptions and purchases, documents are kept for the statutory period (up to 10 years). Per-campaign sign-up counts are kept for at most 24 months. The source linked to your account is kept for 365 days after sign-up. We do not sell your data to third parties.

5. Providers, recipients and transfers outside the EU

To run the service we rely on third-party providers that process data on our behalf as data processors (art. 28 GDPR), within their respective purposes:

• OVH SAS (Roubaix, France) — the website's server and database, in the Milan (Italy) data centre: this is where account, session, form and subscription data lives;
• Cloudflare, Inc. — content delivery and protection network (CDN and proxy) in front of the website (technical browsing data, IP address) and storage of the public tender documents;
• Brevo (Sendinblue SAS, France) — sending of service emails (e.g. password reset) and, to those who consented, of commercial communications;
• Stripe — subscription payments (payment and billing data);
• A-Cube GOV S.r.l. — issuing, sending to the Italian Interchange System (SdI) and legally compliant storage of the electronic invoices for subscriptions (customer identification and tax data: company or personal name, address, VAT number, tax code, recipient code or certified email);
• Google Ireland Ltd — browsing statistics through Google Analytics 4 (with anonymised IP), active only after consent in the cookie banner (see section 8);
• Google Cloud (Document AI) — optical reading of scanned public tender documents, to find and blank out the personal data they contain before publication in the service. It receives no data about the website's users;
• any further providers are appointed as processors under art. 28 and disclosed on request.

Meta and Google Ads are not our processors. If you accepted cookies in the banner, Meta Platforms Ireland Ltd and Google Ireland Ltd (Google Ads) receive from our server the fact that you signed up, with the data listed in section 2 (SHA-256 email hash, click identifiers), and process it for their own advertising measurement purposes as independent controllers or, under the terms of their services, joint controllers: please see their notices for details.

Some of these providers are based or have infrastructure outside the European Union (in particular in the United States: Cloudflare, Stripe, Google). In those cases the transfer takes place under appropriate safeguards provided by the GDPR — the EU Commission's Standard Contractual Clauses and/or participation in the EU-U.S. Data Privacy Framework. You can ask us for more information at the contacts above.

Technical components. The website's fonts and libraries are hosted on our own servers: displaying them involves no requests to third-party services other than those listed.

6. Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability (arts. 15-22 GDPR), as well as the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali). To exercise them write to info@radarconcessioni.it or to the PEC srlbellucci@pec.it.

7. Data of concession holders appearing in the service

Radar Concessioni processes information drawn from public and institutional sources (municipal notice boards, “Transparent administration” sections and e-procurement platforms of public bodies, Regional Official Bulletins, the Italian Official Gazette), within the re-use of public data allowed by Directive (EU) 2019/1024 and Italian Legislative Decree 200/2021. Some of this information may relate to natural persons (e.g. sole traders): business name or sign, location of the premises, economic data of the concession (fee, compensation), references of the deeds. We process no special categories of data.

Legal basis: legitimate interest (art. 6.1.f GDPR) in offering an information and analysis service on procedures of significant public and economic interest. We process this data only for that purpose and do not use it for advertising profiling.

The paid product is based on aggregated and statistical data. The Pro features and the Pro pages offer processing, statistics and analysis in aggregated form on the procedures (number and status of tenders, deadlines, territorial trends). We do not sell, transfer or commercialise in any way the names or the individual economic figures of concession holders: where such information appears it comes from public deeds and serves solely as informational context; it is not the object of the sale. Where the purpose can be achieved with aggregated or anonymous data, we always use the latter. In the documents published in the service, the personal data they contain (e.g. tax codes) is blanked out before publication.

Right to object. If you are a concession holder and your data appears in the service, you have the right to object to the processing (art. 21 GDPR) and to ask for its rectification or erasure: write to info@radarconcessioni.it or to the PEC srlbellucci@pec.it. We remove or rectify the data without undue delay, unless compelling and overriding legitimate grounds apply.

Retention and visibility. We keep this data while the procedure is of current informational interest and in any case no longer than 24 months from its closing/award (then removal or anonymisation). Names and individual figures are not indexed by search engines and remain accessible only to the service's authorised users. We keep a record of the provenance of each item (source and date).

8. Cookies and similar technologies

Technical cookies (always active). If you sign in to your account the website sets a single cookie, better-auth.session_token: the session cookie of the reserved area (HttpOnly, 7-day duration, renewed with each day of use; deleted when you sign out). It recognises you from one page to the next and is not used for profiling. Without signing in the website sets no cookies of its own. Your choice about cookies is saved only on your device (browser localStorage, for 6 months). The protection network in front of the website (Cloudflare) may set short-lived technical security cookies (e.g. __cf_bm), needed to tell visitors apart from automated traffic. None of these requires consent.

Analytics cookies (only with your consent). To measure the use of the website we use Google Analytics 4 (with anonymised IP), which sets cookies and identifiers. We do not do remarketing. If you accept cookies in the banner, the sign-up is reported to Meta and Google Ads by our server, as described in sections 2 and 5; any advertising tools in your browser would be activated only after consent in the banner and after this notice has been updated. With the same consent the browser also stores, in the tab's memory (sessionStorage, until the tab is closed), where you came from (section 2). Google Analytics is activated only after you have given consent through the cookie banner: until then it stays off thanks to Google's Consent Mode v2 (default setting “denied”; in that mode Google may receive aggregated technical signals without cookies or identifiers, the so-called Consent Mode pings). You can change or withdraw your choice at any time from the “Manage cookies” link at the bottom of every page. These providers may also process data outside the EU, with the safeguards described in section 5.

You can also manage or delete cookies from your browser settings.

9. Terms of service

• Informational nature of the data. Radar Concessioni collects and reworks information from public sources (the Italian Official Gazette, tender portals and official municipal websites). The data is purely informational and does not replace the official tender notice: before taking part in a tender, always check the official documents and their deadlines.
• No warranty. Although we update the data regularly, we do not guarantee completeness, accuracy or absence of errors. We are not liable for decisions taken on the basis of the service's information.
• Pro service and tender files. The Pro subscription unlocks additional features. Any tender-file preparation service is a separate professional activity, subject to a specific agreement and quote.
• Invoicing. Subscriptions are invoiced by Bellucci Srl. The full terms are in the Subscription terms.

← Back to the home page · Legal notice · Subscription terms · Accessibility