PRIVACY NOTICE PURSUANT TO ARTS. 13–14 OF EU REGULATION 2016/679 FOR THE PROCESSING OF PERSONAL DATA
Data Controller
ULIVINI S.N.C. DI MARE' ALESSANDRO E C.
VAT 07455150487 - REA FI-704336
Registered Office: Via dell’Erta Canina 29 (50125) Florence
Email: info@tuscanytravelandtour.com
Subject of Data Processing
The data for which consent to processing is requested collected when filling out the “Contacts” form on the website (fields marked with an asterisk), or later during service preparation are the following:
- Personal details of the service requester: first name, last name;
- Contact details: email address, telephone number, home address;
- Personal details of service users (passengers): first name and last name;
- Data contained in identity documents and tax code, strictly for travel outside Italy: personal details (first name, last name, place and date of birth, citizenship), contact details (home address), marital status, occupation, photograph, signature;
- Payment data;
- General data relating to any physical disability, where applicable and strictly necessary for service provision.
- Special Categories of Data
Except for birthplace and citizenship data that may reveal racial or ethnic origin, and general data relating to physical disability processed only with the data subject’s consent ULIVINI S.N.C. DI MARE' ALESSANDRO E C. does not process any further special categories of data such as political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for uniquely identifying a person, or data regarding a person's sexual life or orientation.
Methods of Processing
The Controller adopts appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of Personal Data. Processing is carried out using IT and/or telematic tools, with organizational methods strictly related to the intended purposes. In addition to the Controller, other subjects involved in the organization of this Website (administrative, marketing, legal, tax staff) or external parties (third-party technical service providers, travel agencies, hosting providers, IT companies, communication agencies) may access the Data. When necessary, they may be appointed Data Processors. The updated list of Processors may be requested from the Controller at any time.
Location
Data are processed at the operational offices of the Controller and any other place where the parties involved are located. The Controller is based in the European Union; thus, the processing is governed by GDPR. Should data be transferred outside the EU to countries with an adequacy decision by the European Commission, the transfer remains legally compliant. Currently, no data transfer outside the EEA occurs; if it does, it will be protected by Standard Contractual Clauses.
Retention Period
Unless otherwise stated, Personal Data are processed and stored for the time necessary for the purposes for which they were collected, or to ensure proper service delivery. They may be stored longer due to legal obligations or based on user consent for marketing purposes.
Purpose of Data Processing
Personal Data are collected to enable the Controller to:
- provide its services, including managing participation and creating promotional materials;
- fulfil legal obligations; • respond to requests or legal actions;
- protect its rights and interests (or those of users or third parties);
- detect fraudulent or malicious activity.
Processing may also occur to: contact the user by email or phone to perform the requested or contractually defined chauffeur service; comply with legal obligations and orders from authorities—for example, the driver’s obligation to complete and maintain a service logbook (L. n. 21, 15/01/92 as amended by D.L. n. 35, 14/12/2018); ascertain, exercise, or defend a legal right as part of the Controller’s legitimate interest. Providing the data is mandatory for using the service; refusal may prevent service execution.
Legal Basis
Processing is based on Art. 6(1) GDPR: (a) consent; (b) pre-contractual and contractual obligations; (c) legal obligations; (f) legitimate interest.
Further Information on Retention Time
Unless otherwise stated:
- Personal Data collected for contract performance are retained until the contract is completed;
- Personal Data collected under the Controller’s legitimate interest are retained until that interest is fulfilled.
Users may request further details from the Controller. When processing is based on user consent, data may be retained until consent is withdrawn. Data may also be retained longer due to legal obligations or orders by authorities. After the retention period, the Personal Data will be deleted.
User Rights under GDPR
Users may exercise specific rights over their Data. In particular, they may:
- withdraw consent at any time;
- object to processing;
- access their Data and obtain information on processing;
- verify and request rectification;
- request restriction of processing;
- request deletion of their Data;
- receive their Data in a structured, commonly used, machine-readable format and request its transfer to another controller;
- lodge a complaint with the competent Data Protection Authority.
Details on the Right to Object
Users may send a registered letter or certified email (PEC) to:
ULIVINI S.N.C. DI MARE' ALESSANDRO E C.
Via dell’Erta Canina 29 (50125) Florence
PEC: ulivinisnc@cgn.legalmail.it
Requests are free of charge and will be processed as quickly as possible, within one month. Any rectification, deletion, or restriction will be communicated to third-party recipients unless impossible or disproportionate. Users may request a list of such recipients. Users also have the right to lodge a complaint with the supervisory authority in case of presumed or actual violation of their rights and legitimate interests (Art. 77 GDPR).
Last Updated: 18/11/2025