Privacy Policy — Italy in a Week

1. Data Controller

ACS S.r.l. (Veditalia)

Via Villoresi 4, 20143 Milan, Italy

VAT/Tax Code: 07277970963

Website: www.italyinaweek.com

For any request regarding personal data processing, users may contact the Data Controller through the contact details available on the Website.

2. Personal Data We Collect

Veditalia may collect and process the following categories of personal data:

name and surname
date of birth
nationality
passport or identification details where required
email address
telephone number
billing information
booking details
messages submitted through contact forms or live chat
dietary, accessibility or medical information voluntarily provided by the Traveler
selected Travel Protection Formula and insurance-related information

2.1 Data Collected Automatically

Veditalia may also collect:

payment-related information processed via Stripe and PayPal
IP address and technical browsing data
approximate geolocation data through the live chat system
analytics and cookie-related data

3. Purposes and Legal Basis of Data Processing

Personal data may be processed for the following purposes and on the following legal bases:

Booking management and performance of the Italy in a Week package – processing is necessary to take steps at the Traveler’s request before entering into a contract and for the performance of the travel contract.

Customer support, booking communications and management of requests or complaints – processing is necessary for the performance of the travel contract and, where applicable, for Veditalia’s legitimate interest in managing customer relations and protecting its legal rights.

Payments, accounting, tax and administrative obligations – processing is necessary for compliance with legal obligations to which Veditalia is subject.

Fraud prevention, Website security and the establishment, exercise or defense of legal claims – processing may be based on Veditalia’s legitimate interests and/or compliance with applicable legal obligations.

Marketing communications – processing is based on the user’s consent where consent is required by applicable law. Consent may be withdrawn at any time.

Analytics, advertising and non-essential tracking technologies – processing is based on consent where required by applicable law and is further described in the Cookie Policy.

4. Special Categories of Personal Data

Where a Traveler voluntarily provides information concerning health conditions, allergies, accessibility requirements, reduced mobility or other information that may constitute special categories of personal data, Veditalia will process such information only where necessary for the relevant request or service and where a valid condition under Article 9 GDPR applies.

Where required, Veditalia will obtain the Traveler’s explicit consent before processing such information.

Travelers are requested to provide only information reasonably necessary for Veditalia to assess or facilitate the relevant request or assistance.

5. Provision of Personal Data

Personal data marked as mandatory during the booking process are required in order to process the booking request, conclude or perform the travel contract, or comply with applicable legal requirements.

Failure to provide mandatory information may prevent Veditalia from processing or confirming the booking or from providing the relevant service.

Information requested for optional purposes, such as marketing, is voluntary and refusal to provide it will not affect the Traveler’s ability to purchase the package.

6. Sharing of Personal Data

Veditalia may share personal data with trusted third parties strictly involved in the operation of the Website and delivery of services, including:

guides and tour leaders
drivers and transportation providers
local experience providers
accommodation providers
insurance providers
attraction and ticketing providers
booking management platforms and plugins
payment providers such as Stripe and PayPal
IT service providers
hosting providers
analytics and advertising providers
legal, accounting or administrative consultants
public authorities where required by law

Personal data will never be sold to third parties.

7. Cookies, Analytics and Advertising Tools

The Website uses cookies and similar technologies to ensure proper functionality and improve user experience.

Third-party tools may include:

Cloudflare Web Analytics — aggregate traffic measurement that sets no cookies and stores nothing on your device
Google Analytics 4 — statistical analysis of how the Website is used, loaded only with your consent
Microsoft Clarity — heatmaps and session recordings used to improve usability, loaded only with your consent
Charla — the live chat service, loaded only with your consent
CARTO — supplies the map images (tiles) shown on the itinerary map
Leaflet, delivered through the unpkg content delivery network — the software library that draws the itinerary map in your browser
Trustindex — displays the guest review widgets shown on the home page and the About us page

The map and the review widgets are part of the content of the pages on which they appear and are loaded together with those pages: connecting to those providers makes your IP address and browser information visible to them.

Users can manage cookie preferences through the cookie banner available on the Website and through browser settings.

8. Geolocation

The Website’s live chat and support systems may use approximate geolocation data in order to improve customer assistance and provide more relevant support.

Geolocation data are not used for automated decision-making or profiling activities.

9. Data Retention

Personal data will be retained only for the period necessary to fulfill the purposes described in this Privacy Policy.

booking and accounting data: up to 10 years where required by law
marketing data: until consent is withdrawn
customer support communications: retained for operational and legal purposes for a reasonable period of time

10. International Data Transfers

Some third-party service providers used by Veditalia may process personal data outside the European Economic Area.

Where required, Veditalia adopts appropriate safeguards to protect personal data, including Standard Contractual Clauses approved by the European Commission.

Further information regarding the safeguards applicable to international data transfers may be obtained by contacting Veditalia using the contact details set out in this Privacy Policy.

11. Automated Decision-Making and Profiling

Veditalia does not use personal data to make decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect users.

12. User Rights

Under GDPR, users have the right to:

access their personal data
request correction of inaccurate data
request deletion of personal data
restrict processing
object to processing
request data portability
withdraw consent at any time

Users also have the right to lodge a complaint with the competent data protection authority.

13. Data Security

Veditalia adopts appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, disclosure or alteration.

14. Changes to This Privacy Policy

Veditalia reserves the right to update or modify this Privacy Policy at any time.

Users are encouraged to review this page periodically.