Privacy Policy

This Privacy Policy describes how personal data of users who consult and interact with the website of Rban Tours® are collected, used and protected, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”).

1. Data Controller

The Data Controller is:

Rban Tours – di Sarah Zarrillo
Registered office: Via Lanzone 11, 20123 Milan, Italy
VAT number: IT01846550331
Certified email (PEC): sarah.zarrillo@pec.it

The Data Controller determines the purposes and means of the processing of personal data.

2. Types of Data Collected

Rban Tours may collect the following personal data:

Identification data (name, surname)
Contact data (email address, phone number)
Booking and service-related information
Messages sent through contact forms or email
Technical and usage data (IP address, browser type, operating system, pages visited, cookies)

The website does not intentionally collect special categories of personal data (health data, religious beliefs, political opinions, etc.).

3. Purpose of Processing

Personal data are processed for the following purposes:

To respond to information requests
To manage bookings and provide tourist services and experiences
To fulfill contractual and pre-contractual obligations
To comply with legal, tax and accounting obligations
To send organizational and service-related communications
To send promotional or marketing communications, only with the user’s explicit consent
To improve the performance, functionality and security of the website

4. Legal Basis of Processing

The processing of personal data is based on one or more of the following legal grounds:

Performance of a contract or pre-contractual measures
Compliance with legal obligations
Consent of the data subject
Legitimate interest of the Data Controller related to the proper functioning, security and improvement of services

5. Processing Methods

Personal data are processed using electronic and telematic tools, in compliance with the principles of lawfulness, fairness, transparency, minimization and data protection. Appropriate technical and organizational security measures are adopted to prevent unauthorized access, disclosure, loss or misuse of data.

6. Data Retention

Personal data are retained only for the time necessary to achieve the purposes for which they were collected, including legal, accounting and tax obligations. Data collected for marketing purposes will be stored until consent is withdrawn.

7. Communication of Data to Third Parties

Personal data may be communicated to third parties exclusively for purposes related to the correct functioning of services, such as:

Accountants, legal and tax consultants
IT service providers and website hosting services
Booking, payment or email marketing platforms
Public authorities, when required by law

Personal data will never be sold or unlawfully disclosed.

8. Transfer of Data Outside the European Union

Where necessary, personal data may be transferred to non-EU countries through service providers that ensure adequate levels of protection in accordance with Articles 44–49 of the GDPR.

9. Rights of the Data Subject

Users may exercise the following rights at any time:

Right of access to personal data
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object to processing
Right to withdraw consent at any time

Requests must be sent to: sarah.zarrillo@pec.it

10. Right to Lodge a Complaint

Users who believe that their personal data have been processed unlawfully have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) or with the competent authority of their country of residence.

11. Cookies

This website uses technical, analytical and possibly third-party cookies. For detailed information, users are invited to consult the Cookie Policy.

12. Changes to This Privacy Policy

Rban Tours reserves the right to modify this Privacy Policy at any time. Changes will be published on this page and will be effective upon posting.