Stefano Gabryel
Legal

Privacy Policy

This page outlines the privacy policy.

Last updated: 17 July 2026.

Data Controller

The Data Controller is the person or company who manages your data. For this website, the Data Controller is:

  • Name: Stefano Gabryel
  • VAT Number: IT02089670471
  • Address: Via Lucchese 312, Uzzano, PT, 51010
  • Email: stefano.gabryel@gmail.com

Data We Collect

This website is designed to be simple and respects your privacy.

Cookies and Analytics

This website does not use cookies and does not run any tracking tools — such as Google Analytics — that profile you or follow you across other websites.

To understand in aggregate how the site is used, we use Cloudflare Web Analytics, a privacy-first, cookieless analytics tool. It sets no cookies, does not use your browser’s local or session storage, does not fingerprint your device, and does not track you across other websites or over time. It records only aggregate, non-identifying information such as the pages requested, the referring website, approximate location (country/region), and browser and device type, together with basic page-performance timings. Your IP address is processed transiently by Cloudflare to derive the approximate country and is not stored by us or used to identify you. Because nothing is stored on or read from your device, no consent banner is required for this. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in understanding and improving how the website is used.

In addition, our own server keeps first-party page-traffic statistics on Cloudflare’s edge (Cloudflare Workers Analytics Engine). For each page view it records only: the page path you requested, the page or website that referred you (external referrers are reduced to the website name only, with any query string removed), your approximate country (derived by Cloudflare from your IP at the edge — the IP itself is not stored), your browser’s primary language, and, when you arrive from one of our marketing links, the campaign labels in that link (such as utm_source, utm_medium and utm_campaign, or simply the fact that the visit came from a Google or Meta advertisement — never the underlying click identifier). It sets no cookie, reads nothing from your device, stores no IP address, no unique identifier and no browser or device details, and does not track you across other websites. We use this only in aggregate, to understand which content leads visitors to our tours. The legal basis is our legitimate interest (Article 6(1)(f) GDPR), and you may object at any time (see Your Rights).

Data You Provide Voluntarily

The only personal data we process is what you voluntarily choose to provide us when you contact us through one of the following channels:

  • Email: When you write us an email.
  • Phone: When you call us.
  • WhatsApp: When you contact us through the messaging app.
  • Instagram: When you interact with our social profile.
  • Contact form: When you send us a message through the contact form on this website. We collect your name, email address, and the message you write.
  • Booking form: When you submit a booking request through the booking form on this website. We collect your name, email address, the experience you are interested in, your preferred date, group size, any add-ons you select, and any optional message.

Submissions from the contact and booking forms are not stored in a database on this website. They are delivered to us as an email so that we can reply to you (see Service Providers below).

Any data you provide in these cases (like your name, phone number, or email address) will only be used to respond to your request.

Data Collected Automatically (Server Logs)

Like virtually every website, when you visit this site our hosting provider automatically processes basic technical information needed to deliver the pages to you and to keep the service secure — including your IP address, browser type, and the date and time of the request. This information is used only to operate the site, prevent abuse, and ensure security. It is not used to identify you or to build a profile, and it is not combined with the data you provide through the forms.

How and Where We Process Data

We handle your data with the utmost care and take security measures to protect it from unauthorized access, disclosure, alteration, or destruction.

Service Providers (Data Processors)

To run this website and reply to your messages, we rely on a small number of trusted providers that process data on our behalf, under appropriate data-processing terms:

  • Cloudflare, Inc. — hosts this website, provides the cookieless Web Analytics and hosts the first-party page-traffic statistics described above, and processes the contact and booking form submissions as well as the technical server logs described above. Some processing may take place on servers outside the European Economic Area; where that happens, the transfer is covered by the European Commission’s Standard Contractual Clauses.
  • Resend (Plus Five Five, Inc.) — delivers the contact and booking form submissions to us by email. Form data is processed through Resend’s EU infrastructure. Where any transfer outside the European Economic Area occurs, it is covered by the European Commission’s Standard Contractual Clauses.

We do not sell your personal data, and we do not share it with any third party other than the providers strictly necessary to operate the website and communicate with you.

Your personal data is processed exclusively to respond to your requests, manage our communication with you, and give you the information you are looking for.

Under Article 6 of the General Data Protection Regulation (GDPR), our legal bases are:

  • Your consent and/or the performance of pre-contractual measures taken at your request — when you contact us or submit a booking request, so that we can reply and, if you wish, arrange an experience.
  • Our legitimate interest — in keeping the website secure and preventing abuse (the technical server logs described above), and in understanding in aggregate how the website is used (the cookieless Web Analytics and the first-party page-traffic statistics described above).

We do not carry out automated decision-making or profiling.

Data Retention Period

We keep your personal data for the time strictly necessary to respond to your request. Once our communication is finished, your data is deleted.

Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Withdraw consent: You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
  • Object to processing: You can object to the processing of your personal data.
  • Access your data: You have the right to request and get a copy of the data you have provided to us.
  • Request rectification or erasure: You can ask us to correct your data or to delete it completely.
  • Restrict processing: You can ask us to limit how we use your data in certain circumstances.
  • Data portability: You can ask to receive the data you provided in a structured, commonly used, machine-readable format.

To exercise any of these rights, please contact the Data Controller at the email address listed in this policy.

You also have the right to lodge a complaint with a supervisory authority. In Italy this is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Additional Information

External Links: This site contains links to external platforms such as Instagram and WhatsApp (both operated by Meta Platforms, Inc.). Please remember that once you leave our site and access these services, the processing of your data is handled by those platforms, not by us. We encourage you to read their respective privacy policies.

Children: This website and our services are not directed at children. We do not knowingly collect personal data from minors. If a minor wishes to take part in an experience, the booking and any related communication must be made by a parent or legal guardian.

YouTube Privacy Policy Section: YouTube Videos (Google Ireland Limited) This website uses the “YouTube Privacy-Enhanced Mode” to embed video content. This ensures that YouTube does not store information about visitors on this website unless they actively play the video. Once you click the “Play” button, YouTube may install cookies to collect usage statistics, prevent fraud, and improve the user experience in accordance with Google’s Privacy Policy. We do not use “Autoplay” features to ensure no data transfer occurs without user interaction.