BOOK NOW

Privacy Policy

Date of last update: 15 October 2026

Please note that this Privacy Policy may be updated from time to time, including as a result of changes in applicable legislation, the services offered by Italy With Locals or the operation of the website. Users are therefore invited to periodically review the “Privacy & Cookies” section of the website.

With this document, Elena Martinolli, Alessia Angelini and Susanna Viola, acting as Joint Data Controllers of the personal data collected through the website http://www.italywithlocals.com (hereinafter the “Site”), as well as through other communication channels indicated on the Site or otherwise used in connection with the services offered by Italy With Locals (including, for example, e-mail, telephone, messaging services and enquiry or booking forms), provide information regarding the processing and protection of personal data.

This Privacy Policy applies, as relevant, to:

  • visitors and users of the Site;
  • prospective customers and customers;
  • travellers and tour participants;
  • family members, travel companions and other individuals whose personal data are provided in connection with a booking, including minors;
  • persons identified as emergency contacts;
  • suppliers and potential suppliers;
  • tourism professionals and service providers;
  • business partners;
  • collaborators and potential collaborators.

These persons are hereinafter collectively referred to as “data subjects” or “users”, and their personal information as “personal data” or “data”.

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”).

It applies exclusively to the Site and to the activities and services carried out by the Joint Data Controllers in connection with Italy With Locals. It does not apply to data processing carried out independently by third-party websites, booking platforms, travel agencies, accommodation providers, transport companies or other websites that users may access through links contained on the Site. Users are encouraged to review the privacy information provided by the relevant third parties.

Additional privacy information may be provided where appropriate in connection with a particular service, booking, activity or tour.

The Joint Data Controllers are established in Italy and process personal data in accordance with the GDPR and applicable Italian data protection legislation, including Legislative Decree No. 196/2003, as amended (“Privacy Code”).

Where additional mandatory data protection laws apply, the Joint Data Controllers will process personal data in accordance with such laws.

1. Identity and contact details of the Joint Data Controllers

The Joint Data Controllers are:

Elena Martinolli
Fiscal Code: MRTLNE96M44A059N
VAT No.: 01661510295
Via Carducci 19/A, Adria (RO), Italy

Alessia Angelini
Fiscal Code: NGLLSS95P65D548C
VAT No.: 02163840388
Via Provinciale 4/H, Copparo (FE), Italy

Susanna Viola
Fiscal Code: VLISNN90H46H620R
VAT No.: 01661500296
Via Giuseppe Garibaldi 61, Villadose (RO), Italy

Pursuant to Article 26 GDPR, the Joint Data Controllers have determined their respective responsibilities for compliance with data protection obligations through a joint-controllership arrangement. The essential content of this arrangement is made available to data subjects upon request.

For any question concerning the processing of personal data, to exercise rights under the GDPR or other applicable privacy legislation, or to request clarification regarding this Privacy Policy, data subjects may contact any of the Joint Data Controllers at the addresses above or by e-mail at: privacy@fastrackitaliancitizenship.com

2. Purposes and legal bases of processing

Personal data may be processed for the following purposes.

a. Operation and security of the Site

Personal data may be processed to ensure the correct functioning, security and technical administration of the Site, to prevent misuse or unlawful activity and, where applicable, to obtain statistical information regarding use of the Site and improve its functionality and performance.

Legal basis: the legitimate interests of the Joint Data Controllers pursuant to Article 6(1)(f) GDPR in ensuring the proper, secure and efficient functioning of the Site.

b. Responding to enquiries and requests

Personal data may be processed to respond to enquiries submitted through the Site or through other communication channels, including requests concerning destinations, itineraries, organised tours, availability, pricing, quotations, travel arrangements and other Italy With Locals services.

Data may also be processed in connection with preliminary discussions and measures requested by a prospective customer before entering into a contract.

Legal basis: depending on the circumstances:

  • taking steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR; or
  • the legitimate interests of the Joint Data Controllers pursuant to Article 6(1)(f) GDPR in responding to non-contractual enquiries and communications.

c. Organisation, booking and management of tours and travel services

Where a customer requests or purchases an Italy With Locals tour or travel service, personal data may be processed to organise and administer the relevant arrangements.

This may include, for example:

  • preparing and managing bookings;
  • identifying travellers and tour participants;
  • creating and coordinating itineraries;
  • arranging accommodation;
  • arranging transfers and other transportation;
  • coordinating activities, excursions and experiences;
  • arranging services provided by guides, tour leaders and other local professionals;
  • managing requests or changes relating to a booking;
  • communicating practical information before and during a tour;
  • providing assistance in relation to the booked services;
  • managing payments, invoices and accounting;
  • managing cancellations, refunds and other contractual matters;
  • fulfilling administrative, tax and legal obligations.

Italy With Locals organises its tours in cooperation with a licensed local travel agency, currently Fulvia Tour, as well as with other tourism service providers where necessary.

Accordingly, certain personal data may be transmitted to the partner travel agency and/or the relevant service providers where necessary to organise or provide the requested travel services.

Legal basis: performance of a contract or steps taken at the data subject’s request prior to entering into a contract pursuant to Article 6(1)(b) GDPR and, where applicable, compliance with legal obligations pursuant to Article 6(1)(c) GDPR.

Where personal data relating to individuals other than the person making the booking are provided, processing may also be based on the legitimate interests of the Joint Data Controllers pursuant to Article 6(1)(f) GDPR in correctly organising and performing the requested travel services.

The person making a booking on behalf of other travellers is responsible for ensuring that those individuals have been informed that their personal data will be provided and processed for the purposes described in this Privacy Policy.

d. Communication of data to the partner travel agency and tourism service providers

Where necessary to organise, book or deliver a tour or travel service, personal data may be communicated to third parties involved in the relevant arrangements.

Depending on the itinerary and services requested, these parties may include:

  • the partner travel agency;
  • hotels and other accommodation providers;
  • transportation companies and private transfer operators;
  • airlines, rail operators or other carriers where applicable;
  • tour leaders and guides;
  • activity and excursion providers;
  • restaurants and catering providers;
  • ticketing or reservation services;
  • insurance providers, where applicable;
  • other suppliers necessary to provide a specific component of the booked trip.

Only personal data reasonably necessary for the relevant service will be communicated.

Legal basis: performance of a contract pursuant to Article 6(1)(b) GDPR and, where appropriate, the legitimate interests of the Joint Data Controllers pursuant to Article 6(1)(f) GDPR in ensuring the proper organisation and delivery of the requested travel arrangements.

Where a third-party supplier independently determines the purposes and means of processing personal data, that supplier will process the data as an autonomous Data Controller and its own privacy policy will apply.

e. Processing information concerning dietary, accessibility or health-related requirements

Travellers may voluntarily inform Italy With Locals of allergies, food intolerances, dietary requirements, reduced mobility, disabilities, health conditions or other circumstances that may need to be taken into account when organising or providing a tour.

Some of this information may constitute special categories of personal data within the meaning of Article 9 GDPR.

Such information will be requested and processed only where reasonably necessary to accommodate the traveller’s requirements, organise appropriate services or protect the traveller’s health and safety.

Where required for these purposes, relevant information may also be communicated to the partner travel agency or the specific service providers that need to know it, such as accommodation providers, restaurants, guides or transportation providers.

Legal basis: where the information constitutes special-category personal data, processing will generally take place on the basis of the data subject’s explicit consent pursuant to Article 9(2)(a) GDPR.

Where the conditions provided by applicable law are satisfied, processing may also take place where necessary to protect the vital interests of the data subject or another person pursuant to Article 9(2)(c) GDPR.

The data subject may withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. However, where the relevant information is objectively necessary for the safe or appropriate provision of a requested travel service, withdrawing consent may make it impossible to provide that service.

f. Emergency contacts and assistance during travel

Travellers may provide the details of another individual to be contacted in case of emergency.

These details will be used exclusively where reasonably necessary in connection with emergencies, accidents, health or safety concerns or other serious circumstances occurring in connection with a tour.

Legal basis: the legitimate interests of the Joint Data Controllers and the travellers concerned pursuant to Article 6(1)(f) GDPR in providing appropriate assistance and, where applicable, protection of the vital interests of the data subject or another natural person pursuant to Article 6(1)(d) GDPR.

Travellers providing another person’s contact details are requested to inform that person that their information has been supplied for this purpose.

g. Processing data relating to minors

Tours may include travellers under the age of 18.

Where necessary for the organisation and provision of the requested travel services, the Joint Data Controllers may process minors’ identification and contact information and other data necessary for their participation in the trip.

Such information should normally be supplied by a parent, legal guardian or other person legally authorised to provide it.

Particular care will be taken when processing personal data relating to minors, and only information necessary for organising and providing the relevant travel services will be processed.

h. Compliance with legal obligations

Personal data may be processed where necessary to comply with legal, regulatory, administrative, tax, accounting, public-security or other obligations applicable to the Joint Data Controllers.

Data may also be supplied to competent public authorities where required by law.

Legal basis: compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.

i. Newsletter and promotional communications

Where a user expressly subscribes to Italy With Locals marketing communications, their contact information may be used to send newsletters and communications regarding tours, destinations, travel inspiration, new itineraries, promotions and other Italy With Locals services.

Legal basis: the data subject’s consent pursuant to Article 6(1)(a) GDPR.

Consent may be withdrawn at any time by contacting the Joint Data Controllers or by using the unsubscribe link included in marketing e-mails.

Withdrawal of consent to marketing will not affect the provision of services already requested or purchased.

j. Establishment, exercise or defence of legal claims

Personal data may be processed where necessary to establish, exercise or defend the rights of the Joint Data Controllers in judicial, administrative or extrajudicial proceedings or in connection with disputes, complaints or claims.

Legal basis: the legitimate interests of the Joint Data Controllers pursuant to Article 6(1)(f) GDPR in protecting and defending their rights.

3. Sources of personal data and nature of provision

As a general rule, personal data are collected directly from the individual concerned.

However, data may also be provided by another person, for example where one traveller makes a booking on behalf of a couple, family or group or provides information regarding a minor child, travel companion or emergency contact.

Data may also be received, where appropriate, from the partner travel agency or another supplier involved in organising the traveller’s requested services.

Providing personal data for enquiries is voluntary. However, failure to provide information necessary to respond to the request may make it impossible to provide the requested information or quotation.

Providing data necessary to create, administer or perform a booking is voluntary but necessary for the provision of the requested travel services. Failure to provide necessary data may therefore make it impossible to conclude or perform the relevant contract or booking.

Providing special-category information such as health, accessibility or dietary information is generally voluntary. However, where particular information is objectively required to safely or appropriately provide a requested service, failure to provide it may prevent or limit participation in that service.

Consent to newsletters and promotional communications is entirely optional and refusal or withdrawal will have no effect on other services.

4. Categories of personal data processed

Depending on the services requested and the circumstances, the Joint Data Controllers may process the following categories of personal data:

  • identification information, such as name, surname, date of birth and nationality;
  • contact information, such as e-mail address, telephone number and residential address;
  • billing and tax information;
  • booking and travel information;
  • information concerning travel dates, itinerary preferences and requested services;
  • accommodation preferences;
  • information relating to travel companions and family groups;
  • information concerning minors participating in the trip;
  • emergency contact information;
  • passport, identity document or similar information where necessary for a particular booking or travel service;
  • payment-related information, where applicable;
  • correspondence and communications exchanged with Italy With Locals;
  • photographs or audiovisual material where separately authorised or otherwise lawfully processed;
  • dietary requirements, allergies or food intolerances;
  • accessibility requirements or information concerning reduced mobility;
  • health-related information voluntarily provided where relevant to the safe organisation of travel activities;
  • other information voluntarily provided by the traveller and reasonably necessary for the organisation or performance of the requested services.

When using the Site, technical or “navigation data” may also be processed.

The computer systems and software procedures used to operate the Site may automatically acquire certain information whose transmission is inherent in Internet communication protocols, including IP addresses, domain names, URI addresses of requested resources, time of requests, methods used to submit requests, response status codes and information concerning the user’s operating system and technical environment.

Such data are generally used to obtain statistical information concerning use of the Site, ensure its proper functioning and security and, where necessary, investigate unlawful activity or cyber incidents.

Information may also be collected through cookies or similar technologies.

For further information, including information on managing cookie preferences, users are invited to consult the Cookie Policy available in the “Privacy & Cookies” section of the Site.

5. Methods of processing

Personal data will be processed fairly, lawfully and transparently and in accordance with the principle of data minimisation.

Only data that are adequate, relevant and reasonably necessary for the purposes described in this Privacy Policy will be collected and processed.

Data may be processed electronically and/or on paper.

The Joint Data Controllers adopt appropriate technical and organisational measures pursuant to Article 32 GDPR with the aim of protecting personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Personal data processed for the purposes described in this Privacy Policy are not ordinarily subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

6. Categories of recipients

Personal data will not be sold to third parties.

Within the organisation of the Joint Data Controllers, personal data may be accessed only by individuals authorised and instructed to process such information where necessary for their duties.

Personal data may also be communicated, to the extent necessary for the purposes described above, to:

  1. the partner travel agency, including Fulvia Tour, in connection with the organisation, booking and operation of tours and travel services;
  2. tourism and travel service providers, including hotels and accommodation providers, transfer companies, transportation operators, tour guides, tour leaders, activity providers, restaurants, ticketing services and other suppliers involved in a traveller’s itinerary;
  3. technology and administrative service providers, including providers of website hosting, IT systems, e-mail, booking technology, cloud storage, communications, customer management or similar services;
  4. professional advisers, including accountants, legal advisers, insurance professionals and other consultants where necessary;
  5. payment service providers and financial institutions, where necessary for processing payments, refunds or financial transactions;
  6. public authorities, law enforcement bodies, courts or regulatory authorities, where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims;
  7. insurance or emergency assistance providers, where applicable to the requested services.

Where such parties process personal data on behalf of the Joint Data Controllers, they will be appointed as Data Processors pursuant to Article 28 GDPR where required.

Where the recipient independently determines the purposes and means of processing — as may be the case for the partner travel agency and individual tourism suppliers providing their own services — the recipient will act as an autonomous Data Controller.

Information concerning Data Processors appointed by the Joint Data Controllers is available upon request.

7. Transfer of personal data outside the European Economic Area

Organisation of international travel or use of certain technology providers may involve the transfer of personal data to countries outside the European Economic Area (“EEA”).

In particular, where a traveller requests services that require information to be communicated to a provider established outside the EEA, personal data may need to be transferred to that provider in order to arrange or perform the requested travel service.

Where the Joint Data Controllers are responsible for an international transfer, they will ensure that the transfer takes place in accordance with Chapter V of the GDPR.

Depending on the circumstances, this may include:

  • a transfer to a country recognised by the European Commission as providing an adequate level of data protection pursuant to Article 45 GDPR;
  • the use of appropriate safeguards, including Standard Contractual Clauses approved by the European Commission pursuant to Article 46 GDPR; or
  • where applicable, reliance on one of the derogations provided for by Article 49 GDPR, including where a transfer is necessary for the performance of a contract between the data subject and the Joint Data Controllers or for the implementation of pre-contractual measures taken at the data subject’s request.

Data subjects may contact the Joint Data Controllers for further information concerning applicable safeguards.

8. Retention periods

Personal data will be retained only for as long as reasonably necessary for the purposes for which they were collected, subject to applicable statutory retention requirements.

In particular:

Site operation and technical data: data will be retained for the period necessary to ensure the operation, security and analysis of the Site and, where applicable, in accordance with the Cookie Policy.

Enquiries and quotation requests: data relating to prospective customers who do not subsequently make a booking will generally be retained for no longer than 24 months following the last relevant communication, unless a longer period is reasonably necessary in relation to a continuing request or another applicable legal basis.

Bookings and contracts: data relating to customers and bookings will generally be retained for 10 years following completion or termination of the contractual relationship, where necessary for accounting, tax, contractual or legal purposes.

Traveller operational data: information required solely for the practical organisation of a particular trip will be retained for no longer than necessary for that purpose unless it also forms part of documentation that must be retained for contractual, accounting, insurance or legal purposes.

Special-category data: information concerning health, accessibility, allergies or similar requirements will be retained only for as long as necessary for the relevant trip or service unless a longer retention period is required by law, necessary in connection with a claim, or otherwise permitted under applicable data protection legislation.

Newsletter data: personal data processed for marketing purposes on the basis of consent will be retained for up to 24 months from the collection or renewal of consent, unless consent is withdrawn earlier or a different retention period is established in accordance with applicable law.

Legal claims and disputes: information necessary for the establishment, exercise or defence of legal claims may be retained until the expiry of applicable limitation or appeal periods and, where proceedings have commenced, until their final conclusion.

Once the applicable retention period expires, personal data will be securely deleted or irreversibly anonymised unless further retention is required by law or by a competent authority.

9. Rights of the data subject

Data subjects may exercise their rights under the GDPR and other applicable privacy legislation at any time by contacting the Joint Data Controllers using the contact details specified in Section 1.

Subject to the conditions established by applicable law, these rights include the following.

Right of access

A data subject has the right to obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, to obtain access to such data and the information provided for by Article 15 GDPR.

Right to rectification

A data subject has the right to obtain correction of inaccurate personal data and, taking into account the purposes of processing, completion of incomplete personal data pursuant to Article 16 GDPR.

Right to erasure

Under the circumstances set out in Article 17 GDPR, a data subject has the right to request deletion of personal data concerning them.

This right does not apply where continued processing or retention is required or permitted by applicable law, including where necessary to comply with a legal obligation or establish, exercise or defend legal claims.

Right to restriction of processing

Under the circumstances specified in Article 18 GDPR, a data subject may request restriction of the processing of personal data concerning them.

Where processing has been restricted, the data subject will be informed before the restriction is lifted where required by law.

Right to object

Where personal data are processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, a data subject may object to processing on grounds relating to their particular situation in accordance with Article 21 GDPR.

Where personal data are processed for direct marketing purposes, the data subject has the right to object to such processing at any time.

Right to data portability

Where the conditions set out in Article 20 GDPR are satisfied, a data subject has the right to receive personal data that they have provided in a structured, commonly used and machine-readable format and may have the right to transmit those data to another controller.

Where technically feasible, the data subject may request direct transmission between controllers.

Right to withdraw consent

Where processing is based on consent, the data subject may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where relevant, the Joint Data Controllers will also ensure the exercise of any additional rights granted by applicable data protection legislation.

10. Right to lodge a complaint with a Supervisory Authority

A data subject who believes that the processing of their personal data infringes the GDPR or other applicable data protection legislation has the right to lodge a complaint with a competent Supervisory Authority.

In Italy, the competent authority is:

Garante per la Protezione dei Dati Personali
Rome, Italy

A data subject may also be entitled to lodge a complaint with the data protection authority of the EU or EEA Member State in which they habitually reside, work or where the alleged infringement occurred.