Privacy Policy of www.costieradelcilento.it
1. Introduction
This Privacy Policy explains how personal data is collected, used, stored and protected when users visit or interact with the website www.costieradelcilento.it, hereinafter referred to as the “Website”.
The Website provides information about boat tours, private excursions, boat rental services and related tourism services in Palinuro and along the Cilento Coast.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679, commonly known as the General Data Protection Regulation or “GDPR”, and with the applicable Italian data protection legislation.
2. Data Controller
The Data Controller is:
Servizi Quadrifoglio Palinuro
Piazza Virgilio, 18
84051 Palinuro, Salerno (SA)
Campania, Italy
Email: info@costieradelcilento.it
The Data Controller determines the purposes and methods by which personal data collected through the Website is processed.
3. Categories of Personal Data Collected
Depending on how users interact with the Website, the following categories of personal data may be collected.
Data provided directly by the user
This may include:
- First name and surname
- Email address
- Telephone number
- Information entered in contact, booking or quotation request forms
- Tour date and time preferences
- Number and age category of participants
- Billing or payment-related information
- Information provided in emails or other communications
- Any other information voluntarily supplied by the user
Users are requested not to provide special categories of personal data, such as information concerning health, religious beliefs or other sensitive personal circumstances, unless such information is strictly necessary and specifically requested.
Data collected automatically
When users browse the Website, certain technical and usage information may be collected automatically, including:
- IP address or technical information derived from it
- Browser type and version
- Device type and operating system
- Referring website
- Pages visited
- Date and time of access
- Time spent on individual pages
- Actions performed on the Website
- Cookie identifiers and similar technologies
- Approximate geographical information
- Diagnostic and system log data
Cookies and tracking technologies
The Website may use technical cookies, preference cookies, analytics cookies and marketing or profiling technologies.
Further information about the cookies used, their duration, purposes and methods for managing consent is provided in the Website’s separate Cookie Policy and in the cookie preference panel.
4. Mandatory and Optional Data
Personal data marked as mandatory is necessary to process a booking, respond to a request, provide a quotation, complete a payment or supply another service requested by the user.
If the user does not provide mandatory information, the Data Controller may be unable to process the request or provide the relevant service.
The provision of data for marketing, analytics or profiling purposes is optional and, where required by law, is based on the user’s consent. Refusing or withdrawing such consent does not prevent the user from accessing the essential functions of the Website.
5. Purposes and Legal Bases of Processing
Personal data may be processed for the following purposes.
Responding to enquiries and contact requests
Data submitted through contact forms, email, telephone or other communication channels is used to respond to requests for information, availability or quotations.
Legal basis: taking steps at the user’s request prior to entering into a contract and, where applicable, the legitimate interest of the Data Controller in responding to communications.
Managing bookings and providing tourism services
Personal data is processed to:
- Manage boat tour and private excursion bookings
- Confirm dates and departure times
- Manage participant information
- Organise shuttle or boarding services
- Communicate operational information
- Handle changes, cancellations and refunds
- Provide customer assistance
Legal basis: performance of a contract or implementation of pre-contractual measures requested by the user.
Managing payments
Where online payments or deposits are available, the necessary information may be processed to manage transactions, payment confirmation, refunds and accounting obligations.
Payment card details are normally processed directly by the chosen payment service provider and are not stored by the Website unless expressly stated otherwise.
Legal basis: performance of a contract and compliance with legal obligations.
Administrative, accounting and tax obligations
Personal data may be processed to issue invoices, maintain accounting records, comply with tax requirements and fulfil other obligations established by law.
Legal basis: compliance with a legal obligation.
Website security and fraud prevention
Technical data and system logs may be processed to:
- Protect the Website and its users
- Prevent unauthorised access
- Detect malicious or fraudulent activity
- Maintain the security of systems and infrastructure
- Investigate technical problems or misuse
Legal basis: the legitimate interest of the Data Controller in ensuring the security, integrity and proper operation of the Website.
Website performance and statistical analysis
Subject to the applicable consent requirements, analytics tools may be used to understand how visitors use the Website, measure traffic, improve content and evaluate the effectiveness of advertising campaigns.
Legal basis: user consent, where required, or another legal basis permitted by the applicable legislation for strictly limited and appropriately configured analytics activities.
Marketing communications
Where the user has provided specific consent, contact details may be used to send information about boat tours, private experiences, promotions, special offers and related tourism services.
Legal basis: consent.
Users may withdraw their consent or unsubscribe at any time by following the instructions contained in each communication or by contacting the Data Controller.
Advertising measurement, remarketing and personalised advertising
Subject to the user’s consent, tracking technologies may be used to:
- Measure advertising campaign performance
- Create aggregated audiences
- Show advertisements to users who have previously visited the Website
- Limit repeated advertisements
- Personalise advertising content
- Analyse conversions generated by Google or Meta advertising campaigns
Legal basis: consent.
6. Processing Methods and Security Measures
Personal data is processed using electronic, digital and, where necessary, paper-based tools.
The Data Controller adopts appropriate technical and organisational measures designed to protect personal data against:
- Unauthorised access
- Accidental loss
- Unlawful disclosure
- Alteration
- Destruction
- Misuse
- Unauthorised processing
Such measures may include access controls, authentication systems, encrypted connections, backups, security monitoring, software updates and restricted access to authorised personnel.
No internet-based transmission or storage system can be guaranteed to be completely secure. The Data Controller nevertheless undertakes to apply security measures appropriate to the nature of the data, the purposes of processing and the risks involved.
7. Persons Authorised to Process Data
Personal data may be accessed by authorised persons acting under the authority of the Data Controller, including personnel responsible for:
- Booking management
- Customer assistance
- Administration and accounting
- Marketing and communication
- Website management
- Information technology and system security
- Legal or regulatory compliance
These persons process data only when necessary for their assigned duties and in accordance with the Data Controller’s instructions.
8. Service Providers and Other Recipients
Personal data may also be disclosed to external service providers where necessary for the operation of the Website or the provision of requested services.
These recipients may include:
- Hosting and infrastructure providers
- Website developers and IT support providers
- Booking and reservation platforms
- Payment service providers
- Email and communication providers
- Accounting and tax consultants
- Legal advisers
- Marketing and advertising service providers
- Analytics providers
- Cybersecurity and backup providers
- Restaurants, catering companies or operational partners involved in a service requested by the user
- Public authorities where disclosure is required by law
Where required, such providers are appointed as Data Processors under Article 28 of the GDPR.
An updated list of Data Processors may be requested from the Data Controller.
Personal data is not sold or rented to third parties.
9. Hosting and Technical Infrastructure
The Website may use hosting services supplied by:
Hosting Solutions – Genesys Informatica S.r.l.
The hosting provider processes technical data and files necessary to make the Website available online, maintain its infrastructure and provide related security and backup services.
The categories of data processed may include IP addresses, connection data, server logs and information transmitted through the Website.
The processing location and applicable safeguards are described in the service provider’s own privacy documentation.
10. Contact Forms and Support Requests
When a user submits a contact, booking or quotation request, the information entered in the form is transmitted to the Data Controller and used to respond to the request.
The data processed may include:
- Name and surname
- Email address
- Telephone number
- Tour or service selected
- Preferred date
- Number of participants
- Message content
- Any additional information voluntarily provided
This information is retained for the time necessary to process the request and, where a contractual relationship is established, for the period required to manage the service and comply with legal obligations.
11. Mailing Lists and Promotional Communications
Where newsletter or promotional communication services are available, the user’s email address may be added to a mailing list only on the basis of a valid legal basis, normally the user’s consent.
The user may unsubscribe at any time by:
- Using the unsubscribe link in the communication
- Contacting the Data Controller at info@costieradelcilento.it
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
12. Google Analytics
The Website may use Google Analytics, a web analytics service provided by Google.
Google Analytics may collect information about how visitors interact with the Website, including pages visited, session duration, device information, browser characteristics, approximate geographical area and traffic source.
Google states that Google Analytics does not log or store individual IP addresses collected from users located in the European Union, Switzerland or the United Kingdom. Technical information may nevertheless be processed to provide measurement, security and reporting functions.
Where required, Google Analytics is activated only after the user has given consent through the cookie banner.
Users may withdraw or modify their consent at any time through the Website’s cookie preference settings.
Data processed by Google may be transferred or made accessible outside the European Economic Area in accordance with the safeguards described in Google’s privacy documentation.
13. Google Ads Conversion Tracking and Remarketing
The Website may use Google Ads conversion tracking and remarketing technologies.
These services help the Data Controller understand whether users perform certain actions after interacting with an advertisement, such as submitting a request, opening a booking page or completing a reservation.
Subject to consent, Google may use cookies or similar identifiers to:
- Measure advertising conversions
- Attribute visits and actions to advertising campaigns
- Create remarketing audiences
- Display relevant advertisements on Google services and partner websites
Users can manage consent through the Website’s cookie preference panel and through the advertising settings made available by Google.
14. Meta Pixel, Meta Ads and Custom Audiences
The Website may use the Meta Pixel and other Meta Business Tools supplied by Meta Platforms Ireland Limited.
Subject to the user’s consent, these technologies may collect information about visits and actions performed on the Website, such as:
- Page views
- Button clicks
- Form submissions
- Booking-related actions
- Device and browser information
- Cookie or advertising identifiers
This information may be used to:
- Measure Meta advertising campaign performance
- Analyse conversions
- Create audiences of users who have interacted with the Website
- Show relevant advertisements on Facebook, Instagram and other Meta services
- Limit or optimise advertising delivery
Meta processes information in accordance with its own privacy policy and may act as an independent data controller for certain processing operations.
Users may manage their choices through the Website’s cookie settings and the privacy and advertising controls provided by Meta.
15. YouTube Videos and External Content
The Website may include videos supplied through YouTube, a service operated by Google.
Embedded content may allow users to view videos directly from the Website. When a video is displayed or played, Google and YouTube may receive technical and usage information, including device information, IP-related information, cookie identifiers and details about the page visited.
Where required, YouTube content and related tracking technologies are activated only after the user has provided consent.
The Website may also display maps, social media content or other resources hosted by third-party platforms. These services may collect data according to their own privacy policies.
16. Social Media Links and Widgets
The Website may include links, buttons or widgets connected to social networks such as Facebook and Instagram.
When users interact with such features, the relevant platform may receive information about the interaction and the page visited.
The processing performed by each social network is governed by the user’s account settings and by the platform’s own privacy policy.
Merely following an external link takes the user to a service that is independently managed by the relevant third party.
17. International Data Transfers
Some technology providers used by the Website may process or make personal data accessible in countries outside the European Economic Area.
Where such transfers take place, they are carried out in accordance with the GDPR and may be based on:
- An adequacy decision adopted by the European Commission
- The EU–US Data Privacy Framework, where applicable
- Standard Contractual Clauses approved by the European Commission
- Additional technical and organisational safeguards
- Another transfer mechanism permitted under the GDPR
Users may contact the Data Controller for further information about the safeguards applicable to a specific transfer.
18. Data Retention
Personal data is retained only for as long as necessary for the purposes for which it was collected.
In particular:
Contact and quotation requests
Data is retained for the time necessary to respond to and manage the request and may subsequently be retained for a reasonable period to document the communication and protect the Data Controller’s rights.
Booking and contractual data
Data connected with a booking or service is retained for the duration of the contractual relationship and for the additional period required by accounting, tax, legal and limitation rules.
Accounting and tax data
Invoices and other accounting records are retained for the period required under applicable Italian law.
Marketing data
Data processed for marketing purposes is retained until consent is withdrawn or until the data is no longer necessary for the relevant purpose, subject to periodic reviews.
Cookies and analytics data
Cookies and related identifiers are retained for the periods specified in the Cookie Policy and in the cookie preference panel.
Security logs
Technical logs may be retained for the period reasonably necessary to ensure system security, investigate incidents and prevent misuse.
At the end of the applicable retention period, personal data is deleted, anonymised or otherwise rendered unavailable, unless further retention is required by law or necessary for the establishment, exercise or defence of legal claims.
19. User Responsibilities
Users are responsible for the personal data of third parties that they provide through the Website.
By submitting personal data relating to another person, the user confirms that they are authorised to provide such information and, where necessary, have informed the person concerned about the processing.
Users should avoid entering unnecessary or sensitive information in free-text fields.
20. Rights of Data Subjects
Under the GDPR, users may exercise the following rights, subject to the conditions established by law.
Right of access
Users may request confirmation as to whether their personal data is being processed and obtain a copy of that data, together with information about the processing.
Right to rectification
Users may request the correction of inaccurate personal data and the completion of incomplete information.
Right to erasure
Users may request the deletion of their personal data where the conditions established by the GDPR apply.
Right to restriction of processing
Users may request that processing be restricted in the circumstances provided for by law.
Right to data portability
Where processing is based on consent or contract and is carried out by automated means, users may request to receive their personal data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
Right to object
Users may object to processing based on the legitimate interests of the Data Controller or on the performance of a task carried out in the public interest, for reasons relating to their particular situation.
Users may object to processing for direct marketing purposes at any time and without providing a reason.
Right to withdraw consent
Where processing is based on consent, users may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Right not to be subject to certain automated decisions
Where applicable, users have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them, except in the cases permitted by law.
Right to lodge a complaint
Users may lodge a complaint with the competent supervisory authority.
In Italy, the competent authority is the:
Garante per la Protezione dei Dati Personali
Users also retain the right to seek a judicial remedy.
21. How to Exercise Your Rights
To exercise their rights or request further information about the processing of personal data, users may contact the Data Controller at:
Requests should contain sufficient information to allow the Data Controller to identify the user and understand the nature of the request.
Requests are normally handled free of charge and without undue delay, in any event within one month of receipt. This period may be extended where permitted by the GDPR, taking into account the complexity and number of requests.
Where there are reasonable doubts concerning the identity of the person making the request, the Data Controller may request additional information necessary to confirm their identity.
Manifestly unfounded or excessive requests may be subject to the measures permitted under Article 12 of the GDPR.
22. Legal Claims and Requests from Public Authorities
Personal data may be retained or used where necessary for the establishment, exercise or defence of legal claims.
The Data Controller may also be required to disclose personal data to courts, law enforcement agencies, tax authorities, supervisory authorities or other public bodies where required by law or by a legally binding order.
23. System Logs and Maintenance
For operational, maintenance and security purposes, the Website and its service providers may collect system logs.
Such logs may include IP addresses, access times, requested resources, browser information, error reports and other technical data relating to interactions with the Website.
24. Do Not Track Signals
The Website may not automatically respond to browser-based “Do Not Track” signals.
Users can manage cookies and tracking preferences through the Website’s cookie preference panel and through their browser or device settings.
Third-party services may apply their own rules regarding Do Not Track signals and privacy preference technologies.
25. Cookie Policy
The Website uses cookies and similar technologies.
Detailed information about the categories of cookies used, their providers, purposes, duration and the methods available for granting or withdrawing consent is provided in the separate Cookie Policy.
Users can review or change their preferences at any time through the cookie settings available on the Website.
26. Changes to This Privacy Policy
The Data Controller may update this Privacy Policy to reflect:
- Changes to the Website or its services
- The introduction or removal of third-party technologies
- Changes in processing activities
- Legal or regulatory developments
- Instructions or decisions issued by supervisory authorities
Any updated version will be published on this page together with its revision date.
Where changes materially affect processing based on consent, the Data Controller will request new consent where required by law.
27. Further Information
Users may request further information about this Privacy Policy or about the processing of their personal data by contacting:
Servizi Quadrifoglio Palinuro
Email: info@costieradelcilento.it
