Information about personal data

Data used

• Bookings: participants’ first and last names, ages and phone number, including data about children where they take part; payer billing details where requested.
• Contact messages: name, email address and message. A request may be stored in an internal inbox; email delivery may be pending or fail. A form receipt does not certify email delivery.
• Reviews: chosen name, rating and text. Approved reviews may be displayed publicly.
• Operation and security: IP address and technical request data in logs; technical cookies for language and, for administrators, sign-in.

Purposes

Data are used to answer requests, organise hikes, manage bookings and payments, comply with accounting and tax duties, publish selected reviews and protect the service. A person making a booking may submit another participant’s data.

The actual controller must confirm the legal basis for each purpose before the final notice is published. Data needed for a booking are not handled on the basis of marketing consent; the website currently has no visible newsletter sign-up or advertising profiling system.

Recipients and systems

The platform uses DigitalOcean infrastructure for the application, database and images; Stripe handles payments. On 5 October 2026 the configured email channel was Gmail SMTP; a replacement email channel has not yet been activated or verified. Authorised staff managing hikes and support may access the data needed for their tasks. Administrative AI translation is intended for tour descriptions, not participant data.

Supplier contracts, support access, server locations and possible transfers outside the European Economic Area still need to be mapped. This page does not claim that international transfers do not occur.

Retention

Bookings, tax records, messages, reviews, logs and backups require different retention periods. A category-based schedule and deletion rules are being approved. Expiry of access to an online confirmation does not by itself delete booking data or accounting records. There is no single ten-year period applied to all data.

Your rights

You may request access, correction, erasure, restriction, portability or object where the GDPR provides for these rights. You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali). Use the Contact page to make a request and provide a reply address; do not send identity documents or health information through the form unless specifically requested through a secure channel.

If you book for other people, tell them that their details are sent through this website. The final process for informing participants, especially children, needs to be agreed by the controller.