Privacy notice

This notice explains which personal data we collect through Quando Vieni, why we collect it and how long we keep it, under Regulation (EU) 2016/679 (GDPR).

Who handles your data

Data controller for the platform (accounts and subscriptions): <ragione sociale> , <indirizzo completo> , VAT no. <partita IVA> . For any request, write to <email per le richieste privacy> .

Each business is an independent data controller for the bookings and orders of its own customers: the platform processes that data on its behalf and makes it available to it, but decisions about the booking, the order and, for rentals, about checking documents are the business's.

What we collect

If you book, order or sign up as a customer

• name, email address, phone number (some services can be booked without an account, by leaving just these details);
• booking details: date, time, party size, table or beach umbrella, vehicle or service rented, amounts and status;
• for menu orders: the items ordered, the table or beach umbrella and, for home delivery, the delivery address and phone number;
• the notes you write, for example allergies or special requests;
• the reviews you leave;
• your consent to promotional messages, if you give it, with the date you gave or withdrew it, and the date you accepted this notice;
• rentals only: the documents you upload (typically an identity document and a driving licence), if required by the business you chose, and your deposit choice.

If you register a business

• name, email and phone of the account holder and of staff accounts;
• billing details: company name, tax code or VAT number, SDI code, certified email (PEC), address;
• the business profile you publish on the business's public page;
• the technical credentials of your PayPal account, to which your customers' payments go directly;
• your subscription and payment history.

In any case

The web server records IP address, date and requested page in its technical logs, for security and troubleshooting.

Why we process it

• Performance of a contract (art. 6.1.b GDPR): managing your account, your booking or order, delivery and payment; for rentals, allowing the business to check that you are entitled to ride or drive the vehicle you are renting.
• Consent (art. 6.1.a): promotional messages, only if you accepted them; you can withdraw your consent at any time.
• Legal obligations (art. 6.1.c): accounting and invoicing.
• Legitimate interest (art. 6.1.f): keeping the service secure and preventing abuse.

Who can see it

• the business you booked or ordered from, and its staff, limited to that booking or order;
• PayPal, to process the payment, under its own privacy notice;
• our server and email providers, as data processors.

We do not sell your data and we do not use it for advertising profiling.

How long we keep it

• Identity documents and driving licences (rentals only): deleted automatically 12 months after the rented vehicle is returned. The booking stays on record, the files do not.
• Unpaid online bookings expire within a few dozen minutes and are deleted together with any attached documents.
• Booking, order and accounting data: for as long as tax obligations require.
• Account data: for as long as the account exists.

How we protect it

• the whole site runs over an encrypted connection (HTTPS);
• documents uploaded for rentals are not reachable from any public address: they are delivered only after a permission check, to you, to the business concerned and to the platform administrator;
• passwords are stored as hashes and payment credentials are encrypted;
• each business only sees the data of its own bookings and orders.

Cookies

We only use technical cookies: the session cookie that keeps you logged in, and the one that protects forms against forgery (CSRF). We use no profiling cookies and no third-party analytics, so we do not ask you for any consent.

Visit statistics

We count how many times the public pages are opened, to understand what people are interested in and to show each business how many visits its public page receives. We do this without cookies and without third-party tools: no data leaves our server.

For each visit we keep the page opened, the date, the site you came from, whether you are using a phone or a computer, and the language. So as not to count you twice on the same day we compute a code from your IP address, your browser and a random key that changes every day: it cannot be traced back to you, it does not follow you from one day to the next, and it is deleted the following day anyway. The IP address is never stored. Since the data is anonymous, we do not ask for your consent.

Your rights

You may request access, rectification, erasure, restriction and portability of your data, and object to its processing. Write to <email per le richieste privacy> . You also have the right to lodge a complaint with the Italian data protection authority (garanteprivacy.it).