Personal Data Policy

Information on the processing of Personal Data collected through this website
Last revised: 12/08/2026

1. Introduction and legal references

This Privacy Policy explains how personal data collected through this website is processed, including data collected through cookies, tracking technologies and — where available — contact forms and any other features active on the website.

This Privacy Policy applies to anyone who accesses or uses this website and describes how users’ personal data is collected, used and protected, as well as the rights granted to users by law.

These provisions do not apply to other websites, pages or online services that may be accessed through external links available on this website. Users are advised to consult the relevant privacy policies of those websites or services.

This Privacy Policy is provided in compliance with the main national and international regulations concerning the protection of personal data, including:

Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
Any other applicable regulations.

2. Who manages your data and how can you contact us?

Your personal data is processed by:

Turismo Sostenibile SRL
Piazza Virgilio 34, 57037 Portoferraio, LI
info@viaggidelgenio.it
VAT Number: 01708200496

For any information concerning the processing of personal data or to exercise the rights provided for by applicable legislation, data subjects may contact the Data Controller.

3. On what legal grounds do we process your data?

The processing of personal data collected through this website, including data collected through cookies, similar technologies, contact forms and any other features active on the website, is based on one or more of the following legal grounds:

Performance of pre-contractual or contractual measures: when processing is necessary to respond to user requests, provide requested services and, where applicable, manage orders, accounts or contractual relationships.
Compliance with legal obligations: when processing is necessary to comply with tax, accounting, administrative or security obligations, or with requests from public authorities.
Explicit consent given by the user for informational or commercial communications.

A further legal basis, the legitimate interest of the Data Controller, may be relied upon for specific purposes, for example to ensure IT security, prevent fraud or protect the Data Controller’s rights in legal proceedings.

Failure to provide consent, or withdrawal of consent, may limit certain website features or services, such as receiving commercial communications or subscribing to the newsletter.

4. What data do we collect when you visit the website?

When browsing this website, the following data may be collected, including through cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies:

Browsing and technical data: information such as IP address, device identifiers, operating system and browser information, requested URLs, connection times, technical logs, technical preferences and usage data collected through cookies and tracking technologies, including pixel tags, web beacons, local storage and equivalent tools.
Identification data voluntarily provided: information entered into digital forms available on the website, such as first name, last name, email address and telephone number, and/or information provided by sending emails or through other contact channels. Such data is used to respond to requests, provide services and possible consultation services and — subject to consent — send informational or commercial communications.

5. How do we process and protect your data, and how long do we retain it?

Personal data collected through this website is mainly processed using electronic and digital tools in accordance with the principles of lawfulness, fairness, data minimisation, integrity and confidentiality.

Appropriate technical and organisational measures are adopted to prevent unauthorised access, loss, alteration or unauthorised disclosure of data, including:

Encryption of communications (HTTPS): communications between your browser and the website are protected using HTTPS encryption, intended to reduce the risk of interception or manipulation of data transmitted while browsing;
Log monitoring: the system records and monitors access and activity in order to identify suspicious or unauthorised attempts and ensure data security;
Regular backups: data is periodically copied and stored in order to protect it from accidental loss or technical incidents;
Security audits and checks: security checks and tests are regularly carried out in order to identify and correct possible system vulnerabilities;
Restriction of access to data to duly authorised persons only: access to personal data is permitted exclusively to authorised and appropriately trained personnel, in accordance with internal security policies.

Data is retained according to the following periods:

Cookie preferences and consent: retained for 180 days, as specified in the Cookie Policy available on this website.
Browsing and technical data: retained for the period strictly necessary for security purposes and, as a rule, for no longer than 12 months. After this period, data is deleted or anonymised, unless longer retention periods are required by law or are necessary to establish, exercise or defend legal claims.
Data relating to contractual relationships with the Data Controller: where applicable, retained for the duration of the contractual relationship and subsequently for the period required by applicable legal obligations, including accounting and tax obligations.
Data processed for marketing purposes: retained until consent is withdrawn or deletion is requested. If no such request is made, data is retained for a maximum period of 24 months from the last significant interaction, for example opening a communication, clicking on a communication or submitting a request through the website.
Data submitted through forms or specific requests: retained for the period necessary to respond to the request and fulfil the relevant purpose, and subsequently for any additional period required by law.

6. Who may receive your data?

The following parties may access personal data collected through this website, within the limits of their respective responsibilities and purposes:

Internal parties authorised by the Data Controller and appropriately instructed regarding privacy and security;
Service providers and third parties appointed as Data Processors, including, for example, technical service providers and IT services, website maintenance providers, email service providers and consultants, where applicable;
Third parties providing services integrated into the website, such as fonts, maps or image display services, which may process technical data as independent Data Controllers in accordance with their own privacy policies. In such cases, users are also advised to consult the respective privacy policies of those third parties;
Competent public authorities and supervisory bodies, within the limits required by law or in order to comply with requests from judicial authorities.

An updated list of external recipients may be provided upon request by contacting the Data Controller using the contact details indicated above.

7. Where may your data be transferred?

Personal data collected through this website may be processed within the European Union / European Economic Area.

In some cases, the use of third-party services may involve the transfer of personal data to countries outside the European Economic Area.

Where transfers to the United States take place, they are made to providers participating in the EU-U.S. Data Privacy Framework or, where this is not applicable, on the basis of Standard Contractual Clauses.

Countries outside the European Economic Area to which data may be transferred: United States.

8. What are your rights regarding the data collected?

Under applicable legislation, users have the right to:

Obtain confirmation as to whether personal data concerning them is being processed and, where this is the case, obtain access to such data and related information (right of access).
Request the correction, updating or deletion of inaccurate data or data that is no longer necessary (right to rectification and erasure).
Request restriction of processing or object to the processing of personal data, including for promotional or profiling purposes, where applicable.
Request data portability in a structured and interoperable format, where technically possible.
Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, for example in relation to commercial communications or newsletters, where applicable.
Withdraw consent previously given for the use of non-essential cookies and for the processing of data collected through tracking tools.
Report any irregularities or unlawful practices to the competent supervisory authorities.

To exercise these rights, users may send a request using the Data Controller’s contact details.

The Data Controller will respond without undue delay and, in any event, within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity or number of requests. In such cases, the Data Controller will inform the data subject of the extension.

9. How is children’s data processed?

The protection of children is a fundamental priority.

This website is not directly intended for children and does not intentionally collect their personal data through its forms.

If, as part of a request or enquiry, a user provides personal data concerning third parties — including children — the user must ensure that they are legally authorised to provide such data.

Such data will be processed only to the extent necessary and for the purposes of handling the relevant request, in accordance with applicable legislation.

Requests for rectification, restriction or deletion may be submitted using the Data Controller’s contact details.

10. How can you submit reports or complaints to the authorities?

If you believe that the processing of your personal data through this website does not comply with applicable legislation, you may submit a complaint free of charge to the competent Supervisory Authorities, including:

The Data Protection Authority of your country of citizenship or residence

11. How do we inform you about changes to this Privacy Policy?

This Privacy Policy is periodically reviewed in order to comply with regulatory changes or changes to the services provided through the website.

Any significant changes will be communicated through this page.

Last revised: 12/08/2026