Privacy Policy

1. Data Controller

The data controller responsible for the processing of personal data collected through this website is:

The business owner Via Vincenzo Viviani 1 50053 Empoli (FI) Italy VAT number: 07559560482

For any request concerning the protection or processing of personal data, users may contact the data controller at:

info@italyspotlight.com

The business owner is responsible for handling privacy-related requests.

2. Personal Data We Collect

The website may collect personal data provided directly by users, including:

• email address;
• password and account information;
• information entered into the user profile;
• information relating to orders, bookings and vouchers;
• information required to verify or process payments;
• information included in messages sent to the website owner;
• information relating to the use of the website, including data collected through cookies and analytics tools.

Users are responsible for ensuring that the personal data they provide is accurate and up to date.

3. How We Use Personal Data

Personal data may be processed for the following purposes:

• creating and managing user accounts;
• providing the services requested by users;
• managing orders, bookings and vouchers;
• sending account-related and service-related communications;
• sending order status notifications;
• providing voucher links or related information;
• enabling password recovery or password resets;
• verifying or processing payments, where necessary;
• contacting users in connection with requested services;
• notifying users of circumstances that may affect their visit or stay in Italy;
• requesting feedback about the services provided;
• sending newsletters and promotional communications where the user has provided the required consent;
• complying with legal obligations;
• analysing the use of the website and improving its functionality and usability.

4. Service-Related Communications

The email address provided by a user may be used to send communications necessary to manage the user’s account and provide the requested services.

These communications may include:

• order confirmations and updates;
• information relating to vouchers;
• account-related notifications;
• password recovery instructions;
• important information concerning purchased services or a planned visit to Italy.

Service-related communications that are necessary to provide the requested service may be sent without separate marketing consent, where permitted by applicable law.

5. Newsletters and Promotional Communications

The website may send:

• informational newsletters;
• promotional or marketing communications;
• requests for feedback about services used by the user.

Newsletters and promotional communications will be sent only where the user has provided the required consent or where another lawful basis applies under applicable data protection law.

Users may withdraw their consent or unsubscribe at any time by using the unsubscribe link included in the relevant communication or by contacting:

info@italyspotlight.com

Withdrawing consent to promotional communications will not affect the sending of communications that are strictly necessary to manage the user’s account or provide services already requested.

6. Disclosure of Personal Data to Third Parties

In addition to providers needed to deliver requested services, the optional analytics providers described below may process browsing information when you enable them.

With your consent, Google Analytics, provided by Google, measures visits and page usage. Advertising storage, Google Signals and advertising personalisation are disabled in this site's integration.

With your separate consent, Microsoft Clarity, provided by Microsoft, creates session replays and heatmaps showing interactions such as clicks, scrolling and navigation. This is a reconstruction of activity within this website, not a webcam recording or a recording of other applications.

Form contents are explicitly masked for Clarity. Internal pages, checkout and payment-confirmation routes, unknown routes and URLs identified as containing personal details or payment identifiers are excluded from both tools. No names, email addresses, booking details or payment information are intentionally sent as analytics identifiers.

These providers may process technical device and connection information, including information needed to handle network requests, under their own terms and privacy practices. Provider processing may involve transfers outside the European Economic Area. Google's privacy policy is available at https://policies.google.com/privacy and Microsoft's at https://privacy.microsoft.com/privacystatement.

Access to personal data should be limited to information that is necessary for the relevant purpose.

7. Data Retention

Personal data will generally be retained for a maximum period of 12 months.

Personal data may be retained for a longer period where this is necessary to:

• comply with a legal obligation;
• establish, exercise or defend a legal claim;
• resolve a dispute;
• complete a service requested by the user;
• fulfil accounting, tax or other statutory obligations.

Deleting personal data may result in the loss of access to the user’s account, vouchers and information necessary to receive communications relating to the requested services or a planned visit to Italy.

8. Users’ Rights

Under applicable data protection law, users may request:

• access to their personal data;
• a copy of the personal data held about them;
• correction of inaccurate or incomplete data;
• deletion of their personal data;
• restriction of processing;
• data portability, where applicable;
• information about the purposes and methods of processing;
• withdrawal of consent previously provided.

Requests may be submitted by email to:

info@italyspotlight.com

Users also have the right to lodge a complaint with the competent data protection supervisory authority, in particular the Italian Data Protection Authority — Garante per la protezione dei dati personali, if they believe that their personal data has been processed unlawfully.

9. Cookies

The website uses technical cookies and other storage technologies that may be necessary for the operation of the website and its services.

Optional audience analytics (Google Analytics) and session recordings and heatmaps (Microsoft Clarity) are controlled separately through the cookie banner. Neither service is loaded before you give consent to that service. Rejecting optional cookies does not prevent you from browsing or sending an enquiry.

If you enable a service, it may use first-party cookies to distinguish browsers or sessions. This integration does not grant advertising consent.

Your Cookie Choices

Use Accept optional, Reject optional or Choose settings in the banner. In settings you can enable audience analytics and session recordings independently; both are off by default.

You can reopen Cookie settings in the footer to change your choice or withdraw consent at any time. Withdrawal stops the relevant service and clears the analytics cookies accessible to this website. A page reload may be needed to unload a previously active service. Withdrawal does not undo processing that occurred before it.

Your choice is stored locally in this browser under italyspotlight.cookie-consent for up to 180 days, after which you are asked again. Clearing site storage or using another browser or device may require a new choice.

This gives you the ability to:

• accept or reject non-essential cookies;
• change their cookie preferences;
• withdraw consent at any time;
• obtain information about the cookies used and their purposes.

Google Analytics uses _ga and _ga_* cookies, configured here for up to 180 days without extending their lifetime on each visit. Clarity typically uses _clck (up to one year) and _clsk (one day). Cookie names and provider lifetimes may change; our consent choice expires after 180 days even if a provider cookie has a longer lifetime.

Clarity session recordings are generally retained by Microsoft for 30 days, with some saved or favourited recordings potentially kept longer under the project's settings. Analytics retention also depends on the provider and project configuration. Withdrawing consent prevents future optional tracking; contact info@italyspotlight.com about data-rights requests.

10. Data Security

The data controller takes reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of electronic transmission or storage can be considered completely secure. Users should therefore be aware that the transmission of information over the internet always involves a certain degree of risk.

11. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in legislation, technology or the services provided through the website.

The updated version will be published on this page together with the relevant update date.

12. Contact

For questions, requests or concerns relating to this Privacy Policy or the processing of personal data, please contact:

The business owner Email: info@italyspotlight.com Address: Via Vincenzo Viviani 1, 50053 Empoli (FI), Italy