AmalfiCoastLovers.com
Privacy and Cookie Policy
Information on the processing of personal data provided under Articles 12, 13 and, where applicable, 14 of Regulation (EU) 2016/679 (the “GDPR”), Italian Legislative Decree No. 196/2003 as amended, and the Italian rules governing cookies and other tracking technologies.
Last updated:
Scope
Who and which services this policy applies to
This policy explains how personal data is processed through AmalfiCoastLovers.com, its language versions, contact and quotation forms, personal accounts, the online shop, tourism service booking systems, newsletters and communications with customer support.
It applies to visitors, registered users, customers, travellers, service participants, people requesting quotations and subscribers to promotional communications. Third-party websites, apps and platforms reached through external links apply their own privacy policies, which should be reviewed before those services are used.
Identity and contact details
Data Controller
The Data Controller for personal data collected directly through AmalfiCoastLovers.com is:
- Legal business name
- 3DICI STUDIO di Fabio Olivieri
- Trading name
- VISTA – Travel Signature
- Legal form
- Sole proprietorship
- Registered business address
- Via Cretazza 74, 83025 Montoro (AV), Italy
- Travel agency operational office
- Via del Commercio 44, 44121 Ferrara (FE), Italy
- VAT number
- IT03152400648
- Tax code and Companies Register number
- LVRFBA83E13A717I
- REA registration
- AV-302496 · Ferrara local unit FE-262407
- Certified email (PEC)
- 3dicistudio@postecertifica.it
- Telephone
- +39 333 579 3745
- Additional company details
- View the Legal Information page
When a service is supplied by a tourism operator, carrier, accommodation provider, attraction, booking platform or other third party, that party may process personal data as an independent data controller for its own purposes. Its identity will be stated in the offer, booking documents or the relevant privacy policy.
Categories and sources
Personal data we process
Browsing and technical data
IP address, date and time of the request, page visited, referring URL, browser and device type, operating system, language, technical identifiers, logs, security events, and information about cookies and consent preferences.
Identity and contact data
First name, surname, address, country, email address, telephone number, account details, encrypted credentials, language and the contents of communications sent through forms, email, telephone, WhatsApp or other channels chosen by the user.
Booking and travel data
Service requested, dates, times, departure point, number and composition of participants, age or age range where required, preferences, operational requests, documents and other information needed to organise or arrange the service.
Purchase and payment data
Products or services purchased, amount, currency, payment status, billing and shipping details, tax code or VAT number where required, refunds and transaction references. Full card details are normally processed by the payment provider and are not stored by the Controller.
Newsletter and marketing data
Email address, name, language, consent, preferences, date and source of subscription, and information about opening or interacting with communications where those features are enabled and permitted.
User-provided content
Enquiries, reviews, comments, photographs, attachments and other information voluntarily provided. Please do not submit irrelevant information or personal data relating to third parties unless you have a valid legal basis or authorisation to do so.
Special categories of personal data
The website does not normally request special categories of personal data under Article 9 GDPR. Where information about health, disability, allergies, dietary requirements or assistance is strictly necessary to provide a service safely, it will be processed only to the extent necessary and on the basis of explicit consent or another condition permitted by law. Such information should not be entered in free-text fields unless it is necessary.
Children and other participants
Bookings must be made by an adult. Anyone providing personal data concerning children or other participants confirms that they are authorised to do so and undertakes to provide them with the essential information about the processing. Children’s data is used only where required for the booking, safety or the application of age-based rates.
Sources of personal data
Data is collected directly from the data subject, automatically while the website is used, or, where necessary to manage a booking, from relatives, group leaders, travel agencies, operators, booking platforms, payment providers and partners involved in the service.
Why we use personal data
Purposes and legal bases
Website operation and security
Purpose: to provide pages and functions, manage sessions, prevent abuse, fraud and unauthorised access, diagnose errors and protect systems and users.
Legal basis: the Controller’s legitimate interests under Article 6(1)(f) GDPR; for strictly necessary cookies, the rules governing electronic communications.
Enquiries, quotations and customer support
Purpose: to answer questions, prepare quotations, organise personalised requests and provide assistance before and after a booking.
Legal basis: steps taken at the user’s request before entering into a contract or performance of a contract under Article 6(1)(b) GDPR; legitimate interests for non-contractual enquiries.
Bookings, tours and tourism services
Purpose: to enter into and manage contracts, check availability, transmit necessary data to suppliers, issue documents and service communications, and handle amendments, cancellations, refunds and complaints.
Legal basis: Article 6(1)(b) GDPR and, where necessary, compliance with legal obligations under Article 6(1)(c) GDPR.
E-commerce, payments and tax compliance
Purpose: to process orders, payments, deliveries, invoices, returns, refunds, anti-fraud checks and accounting records.
Legal basis: contract under Article 6(1)(b) GDPR; legal obligation under Article 6(1)(c); legitimate interests in preventing fraud under Article 6(1)(f).
Newsletters and promotional communications
Purpose: to send news, offers and commercial content by email or another channel expressly selected by the user.
Legal basis: consent under Article 6(1)(a) GDPR. Subject to the conditions of Article 130(4) of the Italian Privacy Code, a customer’s email address may be used for similar products or services, always providing a simple and free right to object.
Analytics, measurement and improvement
Purpose: to understand website use, measure visits and interactions with forms, the basket and content, produce statistics, and improve services and performance.
Legal basis: consent under Article 6(1)(a) GDPR where cookies or identifiers that are not strictly necessary are used.
External content and services
Purpose: to display videos, maps, social feeds, booking systems, messaging buttons and other third-party content.
Legal basis: performance of the user’s request or consent where activation involves non-essential cookies, trackers or communications to third parties.
Legal claims and compliance
Purpose: to comply with requests from public authorities, manage disputes and litigation, and protect the rights, security and assets of the Controller or third parties.
Legal basis: legal obligation under Article 6(1)(c) GDPR and legitimate interests under Article 6(1)(f) GDPR.
Whether providing data is mandatory
Data marked as mandatory is required to answer an enquiry, enter into or perform a contract, or comply with legal obligations. Failure to provide it may make it impossible to supply the requested service. Providing data for newsletters, marketing, non-essential analytics and external content is optional; refusal does not prevent access to essential website functions.
Processing methods and security
Data is processed using digital tools and, where necessary, paper records in accordance with the principles of lawfulness, fairness, transparency, data minimisation and accuracy. The Controller adopts technical and organisational measures proportionate to the risk, including encrypted connections, access controls, system updates, backups and incident-management procedures. No system can, however, guarantee absolute security.
Who may receive personal data
Recipients and service providers
Personal data is accessible only to the extent required for the relevant duties. It may be disclosed to the following categories of recipients, appointed as processors under Article 28 GDPR where appropriate or acting as independent controllers:
- employees, collaborators and people authorised by the Controller;
- hosting, maintenance, security, email, backup and IT infrastructure providers;
- providers supporting WordPress, e-commerce and multilingual functions, including WooCommerce and WPML;
- activity booking and management platforms, including Regiondo;
- operators organising or delivering tours, transport, rentals, visits, experiences, tickets and other booked services;
- payment providers displayed at checkout, including PayPal and any WooPayments services, banks and payment networks;
- newsletter and email automation providers, including Mailchimp/Intuit when used;
- analytics and measurement providers, including Google Analytics through Google Site Kit;
- map, font, video, social media and messaging providers, including Google, YouTube, Meta, Instagram and WhatsApp when their services are activated;
- couriers, shipping companies and suppliers needed to deliver purchased products;
- accountants, consultants, insurers, lawyers and other professionals bound by confidentiality obligations;
- public authorities, law-enforcement bodies and other parties where disclosure is required by law.
An up-to-date list of processors may be requested from the Controller using the contact details stated in this policy.
EEA and third countries
International transfers of personal data
Some technology, analytics, newsletter, social media, messaging or payment providers may process personal data outside the European Economic Area or permit access from third countries. In such cases, transfers are based on an adequacy decision of the European Commission, the EU–US Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission, or another safeguard permitted by Articles 44 and following of the GDPR.
A data subject may ask which transfer mechanism applies and how to obtain information about the relevant safeguards by contacting the Controller.
How long we keep personal data
Retention periods and criteria
| Processing activity | Period or criterion |
|---|---|
| Technical and security logs | Normally up to 12 months, unless longer storage is required to investigate incidents, misuse or unlawful activity. |
| Contact enquiries and quotations not resulting in a contract | Up to 24 months after the last interaction, unless a dispute arises or earlier erasure is requested. |
| User accounts | For the life of the account; after closure, for as long as required for legal obligations, security and the establishment or defence of claims. |
| Bookings, orders, invoices and contractual records | As a rule, 10 years from the end of the relationship, or for another period required by tax, accounting or civil law. |
| Payment data and transaction references | For the time needed to complete the transaction, issue refunds, carry out anti-fraud checks and meet legal obligations; full payment credentials are retained by the payment provider under its own policy. |
| Newsletters and marketing | Until consent is withdrawn or an objection is made, with periodic relevance checks and normally no longer than 24 months after the most recent consent or meaningful interaction, unless renewed. |
| Evidence of consent and privacy requests | For as long as needed to demonstrate compliance and until the applicable limitation periods have expired. |
| Complaints and legal proceedings | For the duration of the dispute and afterwards until the limitation period expires or the final decision has been enforced. |
| Cookies and online identifiers | According to the periods stated in the Cookie Policy below and the settings of the relevant provider. |
At the end of the applicable period, personal data is erased, anonymised or stored separately where this is necessary to comply with a legal obligation or protect a legal right.
Automated processing
Profiling and automated decision-making
The Controller does not make decisions producing legal effects or similarly significant effects on a person based solely on automated processing. Analytics tools may group website usage and interaction data for measurement purposes, but the Controller does not use those tools to make individual decisions having such effects.
Any future commercial profiling will be introduced only after providing specific information and obtaining consent where required.
Control over your personal data
Your data protection rights
Where the conditions in Articles 15–22 GDPR are met, a data subject may request:
- confirmation that personal data is being processed and access to that data;
- rectification of inaccurate data and completion of incomplete data;
- erasure of personal data where the legal conditions are met;
- restriction of processing;
- portability of data provided by the data subject, where technically applicable;
- objection to processing based on legitimate interests;
- objection to direct marketing at any time;
- withdrawal of consent without affecting the lawfulness of processing carried out before withdrawal;
- information about international transfers and the safeguards used.
Requests may be sent to info@vistatravelsignature.com or to the certified email address 3dicistudio@postecertifica.it. To protect personal data, the Controller may ask for information reasonably necessary to verify the requester’s identity. A response will be provided within the time limits set by the GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority or with the competent supervisory authority in the EU Member State of habitual residence, place of work or place of the alleged infringement.
Future versions
Changes to this policy
The Controller may update this policy following legal, organisational or technical changes. The current version is published on this page together with its update date. Where a material change affects data-subject rights or requires new consent, suitable notice will be provided through the website or the available contact details.
Privacy contact
Exercise your rights
Contact the Data Controller directly for a privacy request or question.