Privacy Policy.

Last updated: 15 April 2026

1. Data collected

We collect booking data (first name, last name, email, phone, date of birth, number of passengers), payment data (handled by Stripe and SumUp, never stored directly) and navigation data (technical and analytics cookies, see Cookie Policy).

2. Purposes of processing

We use the data to manage the booking and payment, communicate information about the tour (timing, meeting point, changes), send confirmations and receipts, comply with tax and legal obligations. Marketing only with explicit consent.

3. Legal basis

Performance of the contract (art. 6.1.b GDPR), legal obligation (art. 6.1.c) and explicit consent for marketing communications (art. 6.1.a).

4. Data retention

Tax and accounting documents (e.g. invoices, transaction data, amount) are retained for 10 years as required by Italian tax law (D.P.R. 633/1972 and Italian Civil Code art. 2220).

Operational data (phone, date of birth, number of passengers) is retained for the period necessary to manage the tour and until the limitation period for any claims expires (max 24 months). Marketing data is retained until consent is revoked.

5. Disclosure to third parties

Data may be shared with: Stripe and SumUp (payment processors), Google (Analytics), hosting providers (Cloudflare), email services (transactional). Stripe and SumUp act as processors under art. 28 GDPR for payment data. Google (Analytics) acts as processor, with possible extra-EU transfers covered by Standard Contractual Clauses (arts. 44-49 GDPR). Cloudflare acts as processor for hosting/CDN.

6. Data subject rights

You have the right to access, rectification, erasure, restriction, portability, objection and withdrawal of consent. To exercise your rights please write to info@boatpartygallipoli.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante).

7. Security

We adopt adequate technical and organisational measures to protect the data: HTTPS connection, restricted access, encrypted backups, staff training.

8. Cookie Policy

For detailed information on the cookies used on the site, how to manage them and revoke consent, please refer to our dedicated Cookie Policy.

9. Privacy contacts of the Controller

For any question regarding this Privacy Policy or the processing of personal data, you can contact the Data Controller:

10. Complaint to the Supervisory Authority

If the data subject believes that the processing of their personal data violates the data protection regulations, they have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or to bring the matter before the competent courts.

11. Changes to the Privacy Policy

This Privacy Policy is updated as of 15 April 2026. The Controller reserves the right to amend it at any time, giving notice to data subjects through this site. We recommend checking this page periodically to stay up to date on personal data processing methods.

Contacts