Privacy policy

PRIVACY NOTICE — TOUR BOOKINGS Information pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Italian Legislative Decree no. 196/2003 as amended by Legislative Decree no. 101/2018. 1. Data controller The data controller is Kai Travel, VAT no. 03636910402, registered office Via Andreotto Saracini, 34 - 00121 Roma, email tour@kaitravel.it, phone +393792166627 ("we", "us"). Best Italy Tours is the trade name of our online booking service. We have not appointed a Data Protection Officer: for any privacy matter please write to tour@kaitravel.it. 2. Personal data we process a) Booking and contact data: name and surname of the lead guest, email address, mobile phone number, tour language, notes you write. b) Participant data required by the tour: names of the participants and, where required by the attraction or by the tour (for example nominative tickets or age-based fares), date of birth or other details requested in the booking form. c) Payment data: amounts paid, payment status, card brand and last four digits. Card numbers are entered only on the secure page of Stripe and are never received or stored by us. d) Technical data: a pseudonymised (hashed) form of your IP address, used only to limit abusive bookings, and the technical logs of the booking system. We do not ask for special categories of data. If you choose to tell us about health needs (for example reduced mobility or allergies) in the notes, we use that information only to arrange your tour, on the basis of your explicit consent (Article 9(2)(a) GDPR), which you may withdraw at any time. 3. Purposes and legal bases a) To manage your booking and deliver the tour: checking availability, confirming the booking, issuing the voucher, organising guides, drivers, tickets and local suppliers, contacting you about the tour and any changes — performance of a contract (Article 6(1)(b) GDPR). b) To handle payments, deposits, card guarantees, cancellations and refunds according to the cancellation policy — performance of a contract (Article 6(1)(b) GDPR). c) To comply with accounting, tax and other legal obligations — legal obligation (Article 6(1)(c) GDPR). d) To prevent fraud and abuse, keep the booking system secure and establish, exercise or defend legal claims — our legitimate interest (Article 6(1)(f) GDPR). We do not use your data for marketing or newsletters without your prior consent, we do not sell it and we do not carry out profiling or automated decision-making that produces legal or similarly significant effects on you. 4. Is providing the data mandatory? Name, email, mobile phone and the participant details required by the tour are necessary to conclude and perform the contract: without them we cannot accept the booking. Notes are optional. 5. Recipients Your data are shared only as far as necessary with: - the guides, drivers, ticket offices, attractions and local suppliers involved in your tour; - the hotel, accommodation or partner through which you booked (if you booked through its page, its website or its front desk), for the details of your booking; - our service providers acting as data processors under written agreements: Bókun (booking and availability platform, Iceland - EEA), Stripe (payment processing), Google (email), Supabase (database hosting) and Vercel (website hosting); - accountants, tax advisors, lawyers and public authorities where required by law. Stripe also processes some payment data as an independent controller for fraud prevention and legal compliance; see stripe.com/privacy. Your data are never disseminated. 6. Transfers outside the European Economic Area Some providers (Google, Stripe, Supabase, Vercel) may process data in the United States. Transfers take place on the basis of the European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified companies, or of the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914). You can obtain a copy of the safeguards by writing to tour@kaitravel.it. 7. Retention Booking data are kept for as long as necessary to deliver the tour and handle any request, cancellation, refund or claim, and in any case accounting records are kept for 10 years as required by Article 2220 of the Italian Civil Code. Data based on consent are kept until you withdraw it. After these periods data are deleted or anonymised. 8. Your rights Under Articles 15 to 22 GDPR you have the right to access your data, to have them corrected or erased, to restrict their processing, to receive them in a portable format and to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights write to tour@kaitravel.it: we will reply within one month. 9. Complaints You have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work. 10. Participants under 18 Data of participants under 18 are provided by the adult who makes the booking, who confirms being authorised to do so. 11. Cookies The booking pages use only technical cookies and storage strictly necessary for them to work. We do not use profiling or advertising cookies. 12. Changes We may update this notice; the current version is always available on the booking site. Last updated: 12 October 2026.