Legal area

Privacy Policy

This page explains how personal data is processed when you browse the website, send a request, join the newsletter or book a tour.

Go to Cookie Policy

Data controller

The data controller is Luisa Quaglia Tour Guide, VAT no. 02436070508. For questions, requests or to exercise your rights, contact luisaquaglia.tourguide@gmail.com.

Data we process

We process only the data needed to reply to requests, manage bookings, send requested communications and keep the website secure.

Contact data: name, surname, email, messages and preferences entered in forms.
Booking data: selected tour, date, number and names of attendees, operational notes.
Technical data: IP, logs, cookie preferences, security data and browsing information.
Payment data: Stripe references, amount, currency, payment status and customer email. Full card details are not stored on the website.

Purposes and legal bases

Each processing activity has a specific purpose and a legal basis under the GDPR.

PurposeReplying to requests
Legal basisPre-contractual steps or legitimate interest
ExamplesEmail, contact forms, tour enquiries
PurposeManaging bookings and payments
Legal basisContract or pre-contractual steps
ExamplesStripe checkout, confirmations, seat availability
PurposeSending newsletters
Legal basisConsent
ExamplesPromotional messages and tour updates
PurposeTax and accounting duties
Legal basisLegal obligation
ExamplesAdministrative documents and accounting data
PurposeAnalytics and external content
Legal basisConsent
ExamplesGoogle Analytics, widgets and non-essential embedded content

External services

The website uses technical and infrastructure providers for specific services. Some act as processors, others as independent controllers under their own notices.

ServiceVercel
UseHosting, deployment and web infrastructure
Data involvedTechnical data, logs, IP address and information required for website security
ServiceIONOS
UseDomain, DNS, email or connected infrastructure services
Data involvedTechnical data, contact data and information required to manage the domain or communications
ServiceSupabase
UseDatabase and backend
Data involvedBookings, technical data, application logs
ServiceStripe
UseOnline payments
Data involvedPayment session, amount, customer email, payment status
ServiceMailchimp
UseNewsletter
Data involvedEmail, name, surname and marketing consent
ServiceGoogle Analytics
UseWebsite statistics
Data involvedAggregate browsing data, loaded only after consent
ServiceElfsight and Instagram
UseWidgets and embedded content
Data involvedTechnical data and identifiers according to each service notice
ServiceGmail/Nodemailer
UseEmail communications
Data involvedData required to send and receive messages

Retention

Data is kept for the time required by the purpose for which it was collected and, where applicable, to comply with tax, accounting or legal obligations.

Contact requests: for the time needed to reply and manage the conversation.
Bookings and payments: for service management and administrative obligations.
Newsletter: until consent is withdrawn or the user unsubscribes.
Cookie preferences: stored in the browser to remember the user's choices.

Transfers outside the EEA

Some providers may process data outside the European Economic Area. In these cases, transfers rely on GDPR tools such as adequacy decisions, standard contractual clauses or equivalent safeguards adopted by the providers.

Your rights

You may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent. You may also lodge a complaint with the Italian Data Protection Authority.