Privacy notice

1. Data controller

The controller of your personal data is:

Controller

[to be added: name or company name]

Address

[to be added: registered address]

VAT / tax code

[to be added: VAT number or tax code]

Email

[to be added: email]

2. What data we process

• Booking: first and last name, phone number, email, hotel for the pick-up, guide language, date, time and type of tour, number of guests, language of the site and, if you tick the box, your choice to receive WhatsApp messages.
• Payment (if you pay online): your card or PayPal details are entered on the pages of Stripe or PayPal and never pass through, or are stored on, our site. We keep the amount, the result, the transaction references and any refund.
• Messages: content and delivery status of confirmation, reminder and cancellation messages (email and, if you agreed, WhatsApp).
• Technical data: IP address and time of requests, used for security and to prevent abuse (request limits, login attempts, log of actions in the staff area).
• Notifications (only if you turn them on): the technical delivery address your browser gives us and your ticket codes, to send you the tour reminder and booking alerts. You can turn them off at any time from “My tickets” or in your browser settings.
• Robot check (if enabled): Cloudflare Turnstile processes technical data of your device to tell people from robots.

3. Purposes and legal bases

• Managing your booking and the service (confirmation, operational reminders, support, changes and cancellations, payments and refunds): performance of a contract or pre-contractual steps (art. 6(1)(b) GDPR).
• Tax, accounting and other legal obligations: legal obligation (art. 6(1)(c)).
• Security of the site, prevention of fraud and abuse, defence of legal claims: legitimate interest (art. 6(1)(f)).
• WhatsApp messages about your booking, only if you tick the box: consent (art. 6(1)(a)), which you can withdraw at any time without affecting earlier processing.

We do not use your data for marketing or profiling.

4. Is providing the data mandatory?

The data requested in the booking form are necessary to book: without them we cannot confirm the tour. The WhatsApp option is optional.

5. Who receives the data

Data are processed by authorised persons (staff and guides, only what is needed to run your tour: name, hotel, time, language, number of guests) and by providers acting on our behalf or as independent controllers: hosting and server, email service, Meta (WhatsApp Business, if enabled), Stripe and PayPal (payments), Cloudflare (robot check, if enabled), accountants and legal advisers, and public authorities where required by law. We do not sell your data.

6. Transfers outside the EU

Some providers (e.g. Stripe, PayPal, Meta, Cloudflare) may process data outside the European Economic Area, including the United States, on the basis of an adequacy decision (such as the EU-US Data Privacy Framework) or standard contractual clauses (arts. 44 et seq. GDPR).

7. How long we keep the data

Booking data (contact details, hotel, messages) are kept for 24 months after the tour date and then made anonymous; only date, tour and amounts remain for accounting.

• Accounting and tax documents: 10 years, as required by law.
• Security logs: up to 13 months (log of actions in the staff area); request limits and login attempts: 24 hours.

8. Cookies and similar technologies

The public site does not use profiling or marketing cookies, nor third-party analytics. A technical session cookie is used only in the staff area. After a booking, the ticket (code, tour, date, time, hotel, name) is saved only in your phone's local storage, so you can show it without a connection; it is not sent to us again and you can remove it at any time from “My tickets”. The site loads its fonts from Google Fonts (Google LLC), which receives your IP address; if the robot check is enabled, a script from Cloudflare is loaded when you book without paying online.

9. Your rights

You can ask us for access to your data (art. 15), rectification (16), erasure (17), restriction (18), portability (20), object to processing (21) and withdraw consent (art. 7(3)). Write to [to be added: contact email]. We reply within one month (art. 12(3)).

You also have the right to lodge a complaint with the supervisory authority: the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it).

10. Automated decisions

We do not carry out solely automated decision-making or profiling that produces legal effects on you.

11. Updates

This notice may be updated; the date of the latest version is shown at the top of the page.