1. Data Controller
The data controller is Caldoglaciale Tour Operator, a brand of Sunlux Viaggi, with registered office at Corso Angelo Rizzoli, 32 — 80076 Lacco Ameno (NA) and operating office at Via G. Cacchioli, 2 — 43043 Borgo Val di Taro (PR). For any request regarding your data you can write to caldoglaciale@sunluxviaggi.com.
2. What data we collect
We collect the data you voluntarily provide by filling in the forms on the website:
- Information request form: first name, last name, email address, phone number and, optionally, municipality of interest, preferred location, departure date, number of people and free-text message.
- Newsletter sign-up: first name, last name, email address and type (private individual or agency/company).
We also automatically collect some technical data — IP address, browser type, pages visited, referring page — necessary for the operation and security of the site and, subject to your consent, for statistical and marketing purposes.
3. Purposes and legal basis for processing
- Responding to your requests and providing you with quotes and stay proposals (legal basis: performance of pre-contractual measures at your request — art. 6(1)(b) GDPR).
- Sending you the newsletter with offers and news about Ischia (legal basis: consent given at the time of sign-up — art. 6(1)(a) GDPR, revocable at any time).
- Statistical analysis via Google Analytics 4 (legal basis: consent given via the cookie banner — art. 6(1)(a) GDPR).
- Marketing and advertising via Meta Pixel (legal basis: consent given via the cookie banner — art. 6(1)(a) GDPR).
- Site security and prevention of abuse, spam and unauthorised access (legal basis: legitimate interest of the controller — art. 6(1)(f) GDPR).
4. Hosting and data storage
The website is hosted on servers of Aruba S.p.A. (Via San Clemente, 53 — 24036 Ponte San Pietro, BG — Italy), an ISO 27001 certified provider with data centres in Italy and the EU. Data from contact forms and newsletter sign-ups is stored in local databases (SQLite) within the Aruba hosting environment, not on third-party servers.
Server access logs (IP address, date/time, page visited) are managed by Aruba in accordance with Italian law and are retained for the period required by law, typically no more than 12 months.
5. Cookies and tracking tools
The website uses technical cookies, necessary for its operation, and — only with your consent — third-party analytics and marketing cookies. No tracking cookie is activated before your explicit consent.
Technical cookies (always active)
- Session and security (PHPSESSID, csrf_token) — necessary for the website to function, do not collect personal data for marketing purposes. Duration: session.
- Cookie preferences (cg_consent, cg_a, cg_m) — store your choice on the cookie banner. Duration: 12 months.
Analytics cookies (only with your consent)
- Google Analytics 4 via Google Tag Manager — we measure visits and user behaviour to improve the website. Data is pseudonymised. Provider: Google LLC, USA. Transfer: EU Standard Contractual Clauses. Cookies: _ga, _ga_*, _gid. Duration: up to 2 years.
Marketing cookies (only with your consent)
- Meta Pixel (Facebook/Instagram) — we measure the effectiveness of advertising campaigns and show relevant ads to users. Provider: Meta Platforms Inc., USA. Transfer: EU Standard Contractual Clauses. Cookies: _fbp, _fbc, fr. Duration: up to 3 months.
You can change or withdraw your preferences at any time by clicking "Manage cookies" in the website footer.
6. Data Processors
We rely on the following providers who process data on our behalf:
- Aruba S.p.A. — hosting and server infrastructure (Italy/EU)
- Google LLC — Google Analytics 4 and Google Tag Manager (USA — EU SCC)
- Meta Platforms Inc. — Meta Pixel for advertising (USA — EU SCC)
All providers are bound by specific data processing agreements (DPAs) compliant with the GDPR.
7. Data retention
- Information requests: retained for the time necessary to handle the request and, in the event of a business relationship, for the period required by tax and contractual legal obligations (generally 10 years).
- Newsletter: retained until you unsubscribe from the list, which you can do at any time by writing to caldoglaciale@sunluxviaggi.com.
- Security logs: retained for the time strictly necessary for website security, generally no more than 12 months.
- Analytics and marketing cookies: duration indicated in section 5.
8. Your rights
At any time you can exercise the rights provided for in articles 15–22 of the GDPR:
- Access — know what data we process about you
- Rectification — correct inaccurate data
- Erasure — obtain the deletion of your data ("right to be forgotten")
- Restriction — limit processing in certain circumstances
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdrawal of consent — withdraw at any time the consent previously given, without affecting the lawfulness of processing carried out before its withdrawal
To exercise these rights, write to caldoglaciale@sunluxviaggi.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — www.garanteprivacy.it).
9. Changes to this notice
We reserve the right to update this notice in the event of regulatory changes or changes to the services used. Changes will be published on this page with the date of last update.