Privacy Policy
Last updated: September 1, 2026
This policy explains what personal data Varriale Experiences collects when you visit this website or book a tour, why, and what rights you have over it.
Who we are (data controller)
Giovanni Varriale (VAT / P.IVA 10732211213), via Antonio Mancini 30, 80127 Naples (NA), Italy is the data controller for the personal data described in this policy.
For any question about this policy or your data, contact us at info@varrialeexperiences.com or +39 351 726 7407.
What data we collect
When you book a tour:full name, email address, phone number, party size, and — if you opt into hotel pickup — the pickup street and your hotel/B&B name. Payment card details are entered directly into Stripe's secure checkout and never reach our own servers.
If you create an account: your email address and an encrypted password, plus the booking history tied to that account.
If you contact us: whatever you include in your message — typically your name, email, and the content of your enquiry.
Automatically, while browsing:the pages you visit, an anonymous session identifier, and the page that referred you — but only once you've accepted analytics cookies (see Cookies). We do not use this to identify you personally.
Why we use it, and on what legal basis
- To process and manage your booking (name, email, phone, party size, pickup details) — necessary to perform the contract with you.
- To process payment via Stripe — necessary to perform the contract.
- To send booking confirmations and tour-related updates by email — necessary to perform the contract.
- To respond to enquiries sent through the contact form — necessary to take steps you requested before entering a contract, or our legitimate interest in answering you.
- To understand site usage (pages viewed, tours viewed) — only with your consent via the cookie banner.
Who we share it with
We don't sell your data or share it with advertisers. We do share it with the service providers that make the site work, each acting as our data processor:
- Stripe — payment processing. Stripe receives your payment details directly; we only receive confirmation that payment succeeded and the amount paid.
- Supabase — database hosting and account authentication for the booking and account data listed above.
- Resend — delivery of booking confirmation and enquiry-response emails.
- Cloudinary — hosting of tour photos shown on the site (does not process your personal data).
Some of these providers may process data on servers outside the EU/EEA; where that happens, they do so under Standard Contractual Clauses or an equivalent safeguard recognized under GDPR.
How long we keep it
Booking records are kept for as long as needed to handle your booking, resolve any dispute, and meet our tax/accounting obligations under Italian law (generally up to 10 years for accounting records). Account data is kept until you delete your account. Analytics session identifiers are anonymous and are not linked back to a booking or account.
Your rights
Under the GDPR, you can ask us at any time to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data, where we're not required to keep it (e.g. for accounting)
- Restrict or object to certain processing
- Receive your data in a portable format
Send these requests to info@varrialeexperiences.com. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).
Children
This site is not directed at children, and we don't knowingly collect personal data from anyone under 16.
Changes to this policy
We may update this policy as the site or our providers change. Material changes will be reflected by updating the date at the top of this page.
More information
See also our Terms & Conditions and Cancellation Policy.