Privacy policy
Data controller
The controller of the personal data collected through ciaobellasicily.com and in connection with the "Ciao Bella – Sicily Journey" photo and video experiences is:
Dario Vancardo – sole proprietorship
Via Costantino 13/E – 90147 Palermo (PA), Italy
VAT no. IT07160450826
No Data Protection Officer (DPO) has been appointed, as it is not required for this business.
Data we process
Data you provide when booking or contacting us: first and last name, email address, phone number, chosen experience, package, date and time, number of participants, and any requests or notes you decide to share.
Payment data: online payments are handled by Stripe. We do not receive or store your full card details; Stripe only tells us the payment outcome, the amount and the details needed for accounting.
Photos and videos: during the experience we take photos and videos of you and the other participants. These are personal data, which we process to create and deliver the service you purchased.
Communications: if you contact us by phone, WhatsApp or email, we process the data contained in your messages.
Technical browsing data: IP address, date and time of the request, browser type and pages requested, automatically logged by the systems hosting the website for security and operational purposes.
We do not ask for special categories of data (for example health data). If you choose to tell us about specific needs, such as mobility needs, we will use them only to organise the experience.
Purposes and legal bases
Managing your booking, payment and the experience, and creating and delivering your photos and videos: performance of a contract (art. 6(1)(b) GDPR).
Answering your enquiries before booking: pre-contractual steps taken at your request (art. 6(1)(b) GDPR).
Complying with tax and accounting obligations (invoicing, record keeping): legal obligation (art. 6(1)(c) GDPR).
Keeping the website secure, preventing abuse and fraud, and protecting our rights in case of disputes: our legitimate interest (art. 6(1)(f) GDPR).
Publishing photos or videos of you on the website, on social media or in promotional material: only with your explicit, separate and optional consent (art. 6(1)(a) GDPR). Refusing has no effect on your booking and you can withdraw consent at any time; withdrawal does not affect content published before it, but we will remove the content from the channels we control.
Providing the data requested in the booking form is necessary: without it we cannot accept your booking.
Recipients and service providers
Data is processed by the controller and by any authorised collaborators (photographers, videomakers) bound by confidentiality.
Within the limits of their functions, data may also be processed by providers acting as processors or as independent controllers:
- Railway Corporation: hosting of the website and booking database;
- Stripe Payments Europe Ltd: payment processing (independent controller for payment data);
- WhatsApp / Meta Platforms Ireland Ltd: only if you choose to contact us on WhatsApp;
- our accountant and advisers, for tax and accounting obligations;
- file storage and transfer services used to deliver your photos and videos.
Data is not sold or disclosed to the public, except for images you have consented to publish, and may be shared with authorities when required by law.
Transfers outside the EEA
Some providers (in particular Railway and, for certain processing, Stripe and Meta) may process data in the United States. These transfers are based on the EU-U.S. adequacy decision (EU-U.S. Data Privacy Framework), for certified providers, or on the Standard Contractual Clauses approved by the European Commission (art. 46 GDPR). You can ask us about the safeguards in place using the contact details below.
Retention period
Booking and payment data, tax documents: 10 years from the transaction, as required by Italian civil and tax law (art. 2220 of the Italian Civil Code).
Messages and enquiries not followed by a booking: up to 12 months from the last contact.
Original photos and videos: kept for 12 months after delivery, so you can request a new copy, and then deleted. Images published with your consent remain published until you withdraw consent.
Technical browsing data (logs): only as long as needed for security, normally no longer than 90 days, unless needed to investigate unlawful activity.
Your rights
At any time you can ask for access to your data, rectification, erasure, restriction of processing, portability of the data you provided, and object to processing based on legitimate interest (arts. 15-22 GDPR). You can withdraw any consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
We reply within one month of your request. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
We do not carry out automated decision-making or profiling.
Contacts
To exercise your rights or for any privacy question:
Dario Vancardo – Via Costantino 13/E – 90147 Palermo (PA), Italy
Email: [email protected]
Phone: the numbers listed on the website's Contacts page.
Last updated
8 November 2026