Introduction
This Privacy Notice describes how personal data is processed in connection with the VIMAN EXPERIENCE website, information requests and the management of the experiences presented on the website.
VIMAN EXPERIENCE is the name used to present the project and the experiences. It is not a legal entity separate from the controller identified below.
Data controller
The data controller is Mariangela Lo Piccolo, a natural person who determines the purposes and means of the processing connected with the website and the experiences presented under the name VIMAN EXPERIENCE.
Email for privacy matters and the exercise of rights: vimanexperience@gmail.com. Municipality of reference: 90047 Partinico (PA), Italy.
Vincenzo Di Giorgio may operationally handle messages and enquiries on behalf of Mariangela Lo Piccolo, under her authority and instructions, as a person authorised to process personal data.
Scope of this Notice
This Notice covers browsing the public pages of www.vimanexperience.com, requests sent by email, telephone or WhatsApp Business, data received in connection with GetYourGuide bookings, and technical data processed to host, deliver, protect and measure the general use of the website.
It does not govern processing carried out independently by external websites and services after a user leaves VIMAN EXPERIENCE. Those services apply their own terms and privacy notices.
Personal data that may be processed
Depending on the channel used, information needed to handle the request, manage the experience and operate the website may be processed.
- name and surname, email address and telephone number where provided;
- experience of interest, preferred date, number of participants and preferred language;
- message content and other information voluntarily provided by the user;
- booking data received through GetYourGuide;
- technical connection and security data, such as IP address, date and time, requested URL, browser, request headers and signals needed to protect the website;
- general statistical data concerning page use and website performance.
How personal data is collected
Personal data may be provided directly by email, telephone or WhatsApp Business, received from GetYourGuide in connection with a booking, processed automatically by Cloudflare when a page is requested or processed for statistical purposes through Cloudflare Web Analytics and the aggregated interaction counters described below.
The Contact form does not transmit data to a VIMAN backend or store it on the website. Information entered in the form is used in the browser to prepare a message through a mailto link. The message is transmitted only when the user chooses to send it through the user’s own email application or provider.
Purposes and legal bases
Data concerning experiences and bookings is used to answer requests, provide organisational information and manage necessary communications before, during or after an experience. The legal basis is Article 6(1)(b) GDPR: taking pre-contractual steps at the data subject’s request or performing the requested relationship.
General enquiries are processed on the basis of the controller’s legitimate interest in responding to communications voluntarily received, under Article 6(1)(f) GDPR.
Technical data is processed to deliver pages, prevent abuse and attacks, protect website availability, integrity and security and diagnose malfunctions, based on the controller’s legitimate interest in maintaining a secure and functioning website.
Cloudflare Web Analytics is used for aggregated statistics on visits, pages viewed, referrers and performance. The legal basis is the controller’s legitimate interest in understanding general website use and improving content and performance, taking account of the absence of cookies and persistent identifiers.
Aggregated interaction and referral counters are used to understand whether the website’s essential links and invitations supplied by accommodation partners are useful and to improve content and contact paths. This processing is based on the controller’s legitimate interest, with data limited to predefined categories and without creating profiles or reconstructing a visitor’s behaviour.
Data may also be processed to comply with legal obligations, respond to privacy rights requests, cooperate with competent authorities or establish, exercise and defend legal claims under Article 6(1)(c) or (f) GDPR, as applicable.
Contact form and Gmail
The website does not retain information entered in the form, send it automatically or use a VIMAN backend. The browser prepares an email through a mailto link, and the message is sent only through the service selected by the user.
When an email is actually sent to vimanexperience@gmail.com, the message is received and stored through Gmail. Mariangela Lo Piccolo is the controller for the use of received correspondence; Google Ireland Limited processes Gmail service data under its own privacy notice.
As no Google Workspace account and specific data processing agreement have been documented, this Notice does not describe Google as a processor acting on Mariangela’s behalf.
A message or information request does not constitute a confirmed booking.
Telephone and WhatsApp Business
Using telephone or WhatsApp Business is optional; email and telephone are alternative channels. Telephone and WhatsApp calls are not recorded.
The WhatsApp link does not send message content before it is clicked. After clicking, the user leaves the website and uses an external service provided in the European Region by WhatsApp Ireland Limited, which processes the service under its own privacy notice.
Mariangela separately processes the conversation she receives and the information needed to answer or organise an experience. WhatsApp is not described as a processor acting on Mariangela’s behalf.
GetYourGuide
The website contains external links to GetYourGuide. Prices, availability, customer accounts, booking and payment are managed on that platform; the VIMAN website does not directly collect payment data.
Mariangela may receive the data needed to organise and provide the experience, such as the customer’s name, booking details, date, number of participants, telephone number, encrypted or relay email address, language and any answers supplied through the platform.
GetYourGuide Deutschland GmbH and Mariangela act as separate controllers within their respective areas of responsibility. GetYourGuide is not described as a processor acting on Mariangela’s behalf.
Cloudflare Pages, CDN and security
The website is hosted through Cloudflare Pages and uses the Cloudflare CDN and infrastructure for content delivery, technical functions, HTTPS, performance, security and protection against abuse.
When a page is requested, Cloudflare may process technical information such as IP address, date and time, requested URL, network information, browser headers and security signals needed to deliver and protect the website.
Cloudflare Web Analytics
The website uses Cloudflare Web Analytics to obtain aggregated statistics on visits, pages viewed, referrers and performance.
Cloudflare states that Web Analytics does not use cookies or localStorage to collect metrics and does not create individual fingerprints using IP addresses, user agents or other data for the purpose of displaying statistics.
The statistics are not used to identify individual visitors, follow a person over time, link visits to messages received, provide personalised advertising, carry out remarketing or create commercial profiles.
Aggregated interaction and referral counters
To measure the practical usefulness of key links, the website increments monthly aggregated counters when a user selects links to GetYourGuide, WhatsApp, telephone, email or the Guest Journal. Counts may be broken down only by event type, source experience, language and, for GetYourGuide and WhatsApp, a predefined button position.
When a visitor uses a referral QR code or URL supplied by an accommodation partner, the website also increments hourly UTC aggregate counters. These counters contain only the partner slug, event type, selected VIMAN destination and total for that hour; the visitor’s or guest’s name is neither requested nor recorded.
The requests are processed by first-party functions on the VIMAN domain and update a separate Cloudflare D1 database configured with EU jurisdiction. The database does not contain rows for individual visitors, exact times of individual clicks, complete URLs, referrers, form content, contact details, booking data or messages.
The application code does not read or record IP addresses, user agents, cookies or session identifiers in the counters and does not use localStorage, sessionStorage, fingerprinting or persistent identifiers. Cloudflare nevertheless processes the technical data needed to receive and protect the request within its infrastructure, as described in the preceding section.
These counts are not linked to Cloudflare Web Analytics, messages received or bookings and are not used to identify individuals, follow them over time or create profiles.
Cloudflare Access
Cloudflare Access does not protect and is not required to visit the ordinary public pages of www.vimanexperience.com.
Access may be used only for previews, technical environments, non-public areas or protected technical domains and subdomains. Any technical authorisation cookies apply only to environments that are actually protected and not to ordinary public browsing.
Locally hosted fonts
Cormorant Garamond and Manrope are hosted locally. Loading the pages does not require automatic connections to Google Fonts servers or other external font providers.
Recipients and providers
To the extent necessary, data may be processed or received by the following categories of recipients:
- Mariangela Lo Piccolo, as controller;
- Vincenzo Di Giorgio, a person authorised under the controller’s authority;
- Cloudflare, for hosting, CDN, security, performance, Web Analytics, Pages Functions and the D1 database used for aggregated counters;
- Google Ireland Limited and other Google companies involved in providing Gmail;
- WhatsApp Ireland Limited and companies involved in the WhatsApp service where the user selects that channel;
- GetYourGuide Deutschland GmbH for processing carried out on its platform;
- technical providers, advisers or authorities where necessary for security, applicable obligations or the protection of legal rights.
International data transfers
The use of global services may involve processing outside the European Economic Area. Cloudflare, Google and WhatsApp state that they use, depending on the transfer, adequacy decisions, the EU-U.S. Data Privacy Framework, standard contractual clauses or other safeguards available under applicable law.
GetYourGuide applies its own Privacy Policy to processing carried out on its platform. Mariangela remains responsible for information she receives and subsequently processes to provide an experience.
Further information on applicable safeguards may be requested at vimanexperience@gmail.com.
Retention periods
Personal data is deleted or anonymised when it is no longer necessary. The following periods apply:
- general or pre-contractual enquiries not followed by a booking: deleted when no longer necessary and, as a rule, within 12 months of the last useful contact;
- communications connected with a booked, completed or cancelled experience: deleted when no longer necessary and, as a rule, within 24 months of the experience date or cancellation, unless applicable obligations, disputes or the protection of legal rights require otherwise;
- WhatsApp messages: the same period as the request or experience to which they relate;
- information extracted or noted from GetYourGuide: as a rule, within 24 months, unless applicable obligations, disputes or the protection of legal rights require otherwise;
- data protection rights requests: essential evidence of the request and response may be retained for up to 5 years after closure where needed to demonstrate that the request was handled correctly;
- information needed for a dispute: for the duration of the dispute and the specifically applicable limitation period;
- Cloudflare technical logs and Web Analytics metrics: according to the settings, plan and periods applied by the provider, within the limits needed for the technical and statistical purposes described;
- monthly aggregated interaction counters: they may be retained for historical statistical comparisons; they do not contain individual click records or visitor identifiers.
Whether providing data is mandatory
Public browsing does not require users to provide their name, email address or telephone number directly. Providing data by email, telephone or WhatsApp Business is optional, but without the necessary information it may not be possible to answer or organise an experience correctly.
For a booking on GetYourGuide, information required by the platform is governed by GetYourGuide’s own terms and privacy notice.
Children
The website and contact form are intended for adults. Requests concerning a child’s participation must be made by a parent, guardian or another responsible adult.
The website does not intentionally collect personal data directly from children. Information concerning children must be limited to what is necessary to organise and manage the experience correctly.
Data subject rights
Where provided by the GDPR, data subjects may request:
- confirmation of processing and access to their data;
- rectification or completion;
- erasure;
- restriction of processing;
- data portability, where applicable;
- objection to processing based on legitimate interests;
- withdrawal of consent where processing is actually based on consent;
- information on safeguards applying to international transfers.
Complaint to a supervisory authority
Data subjects may lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali. Contacting Mariangela first is possible but not required.
Automated decision-making and profiling
No decisions are made solely on automated processing that produces legal or similarly significant effects. No individual profiling is carried out for advertising or commercial purposes.
Security
Technical and organisational measures proportionate to the nature and volume of the data are used, including HTTPS, Cloudflare infrastructure, a predominantly static website, no contact-form database, restricted account access, data minimisation and periodic deletion of information that is no longer needed. No information system can be regarded as risk-free.
Changes to this Notice
This Notice may be updated when services, channels, technical tools, providers, purposes, legal bases or regulatory guidance change. The latest update date will be stated at the beginning of the page. Where a change requires consent, the new processing will not be activated before valid consent has been obtained.
Privacy contacts
Controller: Mariangela Lo Piccolo. Email: vimanexperience@gmail.com. Municipality of reference: 90047 Partinico (PA), Italy.
No data protection officer (DPO) has been appointed because, based on the current activities, there is no large-scale processing that would require such an appointment. The need will be reassessed if the activities change significantly.