Legal information
Privacy policy
How Gira Vicenza di Daniela Zarpellon handles the personal data of people who visit the website, ask for a quote or join a guided tour.
In brief
How does GiraVicenza.it handle personal data?
GiraVicenza.it processes personal data only to answer enquiries, organise guided tours and comply with legal obligations. The data controller is Daniela Zarpellon, a licensed tourist guide. The website uses no analytics, profiling or advertising tools, keeps only proof that you have read this policy and does not store the text of your enquiry once it has been sent. You can exercise your rights by writing to info@giravicenza.it.
This translation is provided for convenience; in case of discrepancy the Italian version prevails.
Who processes your data
Data controller and contact details
The controller of the personal data collected through the GiraVicenza.it website and in the course of the guiding service is Daniela Zarpellon, owner of the sole proprietorship Gira Vicenza di Daniela Zarpellon, a tourist guide entered in the Elenco nazionale delle guide turistiche (National Register of Tourist Guides) under no. 05000058.
- VAT number (Partita IVA): 03934120241
- Registered address: [TO BE COMPLETED: full address of the registered office or professional domicile], Vicenza
- Email: info@giravicenza.it
- Telephone and WhatsApp: +39 338 4103735
- PEC (certified email): [TO BE COMPLETED: PEC address, if any]
For any request concerning your personal data, please write to the email address above. Gira Vicenza is a one-person business: requests are read and handled by Daniela herself.
Scope
Who this policy applies to
This policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Codice privacy, the Italian Personal Data Protection Code), and applies to:
- anyone who visits the GiraVicenza.it website;
- anyone who sends an enquiry through the website form, by email, by telephone or on WhatsApp;
- anyone who receives a quote and takes part in a guided tour, including members of the group, families with children, teachers and school classes;
- anyone who reports a problem, makes a complaint or exercises their privacy rights.
The website has no private areas for visitors, does not sell services online, does not send newsletters and uses no profiling, analytics or advertising tools. Should anything change, we will update this page first.
What data
What personal data we process and where it comes from
We process only the data needed to reply to you and organise the tour:
- Browsing data: IP address, date and time of the request, page visited, browser and device type, recorded automatically by the server hosting the website.
- Contact and enquiry data: name, email, telephone or WhatsApp number (optional), dates, number of participants, tour of interest, language and the text of your message.
- Accessibility needs, only if you choose to tell us (optional field).
- Data for the quote and the tour: lead contact name, contact details, group composition, meeting point and any bookings to be made with third-party venues and services.
- Administrative and tax data: the data needed to issue the tax document and record payments.
- Images, only in the cases described in the section on photographs.
As a rule, the data comes directly from you. It may also come from third parties when: one person books on behalf of a group or family; a school organises a visit for a class; or you book through a third-party platform, which passes on to us the data needed for the service. Anyone who provides data about other people must have informed them and should give us only what is necessary.
Please do not enter unnecessary data in the free-text fields: no diagnoses, identity documents, payment details or information about other people that is not needed to organise the tour.
Why and on what basis
Purposes, legal bases and retention periods
For each processing activity we set out its purpose, the legal basis under Article 6 GDPR and how long we keep the data. Each case is described in more detail in the sections that follow.
| Processing | Purpose | Legal basis | Retention |
|---|---|---|---|
| Browsing the website | Operation, security, prevention of abuse | Legitimate interest (Art. 6(1)(f)) | Server logs: [TO BE COMPLETED: period set by the hosting provider]. Spam check: 30 minutes at most |
| Cookie preferences | Remembering and documenting the choices made in the panel | Legitimate interest in demonstrating lawful processing (Art. 6(1)(f), Art. 5(2)) | 12 months |
| Enquiry form | Replying and preparing a proposal | Pre-contractual steps at your request (Art. 6(1)(b)) | Proof of acknowledgement: 24 months. Enquiry emails with no follow-up: [TO BE COMPLETED: period, for example 24 months from last contact] |
| Email, telephone, WhatsApp | Replying, agreeing the quote and details | Pre-contractual steps and contract (Art. 6(1)(b)) | As for enquiries; if the tour takes place, as for contractual documents |
| Quote and delivery of the tour | Providing the agreed guiding service | Contract (Art. 6(1)(b)) | 10 years from completion of the service |
| Tax and accounting obligations | Tax documents, bookkeeping, statutory filings | Legal obligation (Art. 6(1)(c)) | 10 years, in accordance with civil and tax law |
| Accessibility needs | Adapting the route and arrangements | Pre-contractual steps and contract; for any health data, explicit consent (Art. 9(2)(a)) | Until the tour has taken place, then deleted from organisational notes |
| Reviews on third-party platforms | Presenting the reputation of the service fairly | Legitimate interest (Art. 6(1)(f)) | For as long as the content is published on the website |
| Photographs for promotional purposes | Showing what the tours are like on the website or Gira Vicenza's channels | Consent (Art. 6(1)(a)) | Until consent is withdrawn |
| Complaints and privacy requests | Handling and documenting the response | Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f)) | Until closed; if linked to a service, 10 years |
| Protection of rights | Defending or asserting a right in the event of a dispute | Legitimate interest (Art. 6(1)(f)) | For the duration of the dispute and the applicable limitation periods |
Website
Browsing the website, browser storage and spam protection
When you visit the website, the server automatically records certain technical data (IP address, date and time, page requested, browser) needed to display the pages and for security. This data is not used to identify you, nor is it combined with other data.
The website does not use profiling cookies, analytics tools, external Google Fonts (the fonts are hosted on our own server), or embedded maps or videos. In your browser's local storage it saves only two technical items: your choices in the preferences panel (gv_consent) and the state of the language bar (gv_lb). WordPress cookies are set only for people who log in to the administration area. Full details are in the cookie policy.
When you save your cookie preferences, the website records a random pseudonymous identifier, the date and time, the policy version and the choices made, together with a fingerprint of your IP address produced by a truncated hash function: the IP address itself is not stored in clear. These records are kept for 12 months. How the log works is explained on the consent and preferences log page.
The enquiry form is protected by an in-house anti-spam system: a hidden field, a temporary token and a limit on the number of submissions, calculated on a fingerprint (hash) of the IP address that is kept for no more than 30 minutes. We do not use external anti-spam services or third-party CAPTCHAs.
Enquiries
Enquiry form, email, telephone and WhatsApp
Enquiry form
The form on the contact page asks for your name, email, telephone or WhatsApp number (optional), dates, number of participants, tour of interest, language, message and any accessibility needs (optional). Your name and email are needed to reply; without them we cannot handle the enquiry.
The mandatory tick box is there to confirm that you have read this policy: it is not consent and does not authorise any promotional messages. When you submit the form, the enquiry is sent by email to info@giravicenza.it. The website keeps only the proof of acknowledgement (date and time, policy version, the sender's email and an enquiry identifier) for 24 months. The text of your message and the other fields are not kept on the website once the email has been sent.
Email and telephone
If you write or call directly, we use your contact details and the information you give us to reply, prepare the quote and, if you confirm, organise the tour. We do not use your contact details for promotional communications.
In the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited, a Meta group company, which processes data as an independent controller under its own privacy policy. Using it to contact us is your choice: you can use email or telephone instead. Conversations remain on Daniela's device and in WhatsApp's systems; they may involve transfers of data to the United States, which Meta states it carries out under the EU-U.S. Data Privacy Framework or standard contractual clauses.
Tours
Quotes, the tour itself and tax obligations
To prepare the quote and deliver the tour, we process the lead contact name, contact details, dates, language, number and composition of the group and the meeting point. The quote states the fee, duration, language, number of participants and what is included or excluded, as set out in the terms of the guiding service.
Gira Vicenza sells the guiding service only. When the tour requires admission to museums, theatres or villas, or a car with driver, to be booked, we pass on to the operator only the data needed (usually a name, the number of people, the date and time), at your request. These operators process the data as independent controllers under their own privacy policies.
To issue tax documents, record payments and meet accounting obligations, we process the data required by law. This data is kept for 10 years and may be disclosed to our tax adviser and to the Italian tax authorities.
If you booked through a third-party platform, the platform passes on to us the data needed to deliver the tour and processes your data under its own privacy policy.
Sensitive data
Accessibility needs and health information
The accessibility field is optional. Please describe only the practical need, for example avoiding long flights of stairs, taking breaks or using a wheelchair, without giving any diagnosis or clinical details.
If the information you choose to give us reveals data concerning health, we process it solely to adapt the itinerary and arrangements for the tour, on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you may withdraw at any time without affecting your ability to request a tour. We do not disclose it to third parties, except where we need to ask a venue about access or aids; in that case we describe only the practical need, without identifying details unless they are necessary.
Once the tour has taken place, we delete this information from our organisational notes. If it is contained in an email or chat kept for other reasons, you can ask us to delete it. More information is available on the website and tour accessibility page.
Families and schools
Children, families and school visits
The website is not aimed at children and does not knowingly collect data from children under 14 through the form: enquiries for families with children or teenagers must be sent by an adult.
For family tours we ask, at most, for the number and, where useful for the arrangements or tickets, the approximate age of any participants under 18.
For school visits, the point of contact is the teacher or the school. We ask for pupils' names only when a venue requires them for the booking; in that case the school provides them and we use them solely for that booking. We do not carry out marketing or profiling aimed at children.
Images
Photographs taken during tours
During a tour Daniela may take photographs with your device, at your request: in that case the images remain yours and are not processed by Gira Vicenza.
Taking part in a tour does not imply any consent to the publication of your image. If Daniela wishes to use a photograph in which you can be recognised on the website or other Gira Vicenza channels, she will ask you first, specifically, and will use it only with your consent. For children, consent is required from the person with parental responsibility; for school classes, through the school.
You can withdraw your consent at any time by writing to info@giravicenza.it: we will remove the image from the channels we manage directly as soon as possible. If you do not wish to appear in any image, simply say so before the tour begins.
Reputation
Reviews published on third-party platforms
On the website we show the overall ratings and some quotations taken from the public pages of Gira Vicenza on TripAdvisor and of Daniela on ToursByLocals, giving the author's name as it appears on the platform. We do so on the basis of our legitimate interest in presenting the reputation of the service fairly and verifiably.
Reviews are written and managed on the platforms, which process the data as independent controllers. If you are the author of a quoted review and would prefer it not to appear on the website, write to us and we will remove it. The method we follow is described on the how we display reviews page.
Who receives the data
Recipients of the data
The data is processed by Daniela Zarpellon and is neither sold nor made public. It may be received, only to the extent necessary, by:
- [HOSTING PROVIDER], the website's hosting provider, which processes data on our behalf as a processor (Art. 28 GDPR);
- [TO BE COMPLETED: email service provider for info@giravicenza.it], as a processor;
- [TO BE COMPLETED: any technician or agency responsible for website maintenance], as a processor, limited to technical work;
- our tax adviser or accountant, for statutory obligations;
- operators of museums, theatres, villas and other venues, car-with-driver services and other suppliers you choose to use, as independent controllers;
- WhatsApp Ireland Limited, if you contact us on WhatsApp, as an independent controller;
- booking platforms, if you booked through one of them, as independent controllers;
- banks and payment institutions, for collecting payments;
- public authorities, where required by law.
An up-to-date list of processors is available on request.
Outside the EU
Transfers of data outside the European Economic Area
The website's data is hosted on servers located in [TO BE COMPLETED: country where the hosting provider's servers are located]. Gira Vicenza does not intentionally transfer data outside the European Economic Area.
Some services you choose to use may involve transfers to third countries, in particular the United States: WhatsApp (Meta group) and, where applicable, [TO BE COMPLETED: email provider, if based or with servers outside the EEA]. In these cases the transfer is based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or on standard contractual clauses (Articles 45 and 46 GDPR). You can ask us for information about the safeguards applied.
Protection
How we protect your data
The website uses an encrypted connection (HTTPS). The consent log stores pseudonymous identifiers and IP fingerprints rather than IP addresses in clear, and the website does not keep the text of enquiries once the email has been sent. Access to the administration area is restricted. We do not take decisions based solely on automated processing and we do not carry out profiling.
Your rights
Your rights and complaints to the Garante
At any time you may request access to your data, its rectification or erasure, the restriction of processing and the portability of the data you have provided to us, or object to processing based on legitimate interest (Articles 15-21 GDPR). Where processing is based on consent, you may withdraw it whenever you wish, without affecting processing already carried out.
To exercise your rights, write to info@giravicenza.it. We reply without undue delay and in any event within one month, which may be extended by two further months in complex cases, as provided by Article 12 GDPR. We may ask you for some information to verify your identity.
If you believe that the processing infringes data protection law, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work, or bring proceedings before the courts.
Updates
Changes to this policy
This is version 1.0 of the privacy policy, in force from 11 October 2026. If the processing, tools or suppliers change, we update this page and the date at the top, and keep the previous versions. The version in force is also shown in the consent and preferences log.
Transparency
Other legal and practical information
For questions about this page, write to info@giravicenza.it or visit the contact page. Practical information about tours, quotes and tickets is on the how it works, prices and FAQ page.
