Privacy policy | Xploring Rome

Who we are

The data controller is Xploring Rome S.r.l., Via Galvani 52, 00153 Roma, Italy, VAT IT 17739891004, REA RM-1738620 (the "Company", "we"). This policy explains what we do with the personal data of the people who visit this website, book a tour or contact us.

What data we collect

When you book: first and last name, email address, phone number, the name of your hotel or pick-up address, the number and age category of the guests, the tour, date and time chosen, the amount paid. Payment card details are entered on the payment provider's secure pages and never reach us.
When you write to us: what you send us on WhatsApp, by phone or by email, and your number or address.
When you use the "Ask us" assistant: the questions you type. They are sent to an automated language model to produce the answer; we do not ask you to enter personal data there and we recommend you do not.
When you browse: technical data such as IP address, browser and pages viewed, through server logs and, only with your consent, analytics and advertising cookies (see the cookie policy).

Why and on what basis

To take your booking, pick you up at the right place, run the tour and send you the confirmation and the receipt: performance of the contract with you.
To answer your questions before and after the tour: our legitimate interest in replying to people who contact us, or steps taken at your request before a contract.
To keep accounting and tax records: legal obligation.
To measure how the website is used and how our ads perform: your consent, which you can withdraw at any time from the cookie banner.
To send you news and offers by email: only if you tick the box when booking, and you can unsubscribe at any time.

Services we use

To run the website and the bookings we rely on a few providers, who process data on our behalf or as independent controllers under their own policies:

Bókun (TripAdvisor LLC): the booking system and calendar embedded in the tour pages.
Stripe: card payments and deposits. Stripe processes your card data as an independent controller.
WhatsApp (Meta): when you choose to write to us there.
Cloudflare: hosting of the website and of the "Ask us" assistant.
Anthropic: the language model behind the "Ask us" assistant, which receives the text of your questions.
OpenStreetMap contributors (map tiles) and a geocoding service for the hotel search on the pick-up page: the hotel name you type is sent to look up the address.
Google (Analytics and Ads): only after your consent.

Some of these providers are based outside the European Union. Where that is the case, transfers rely on the European Commission's adequacy decisions or on standard contractual clauses.

How long we keep it

Booking data: for the time needed to run the tour and handle any claim, and then for ten years as required by Italian accounting and tax law.
Messages: until your request is handled and for a reasonable time afterwards, so we can reply if you write again.
Assistant questions: they are not stored by us beyond the time needed to produce the answer.
Analytics data: for the periods set in the cookie policy.

Your rights

Under the GDPR you can ask us to access, correct, delete or restrict the use of your data, to receive it in a portable format, and you can object to processing based on our legitimate interest. You can withdraw consent at any time without affecting what was done before. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Contact

To exercise your rights or ask anything about this policy, write to Xploring Rome S.r.l., Via Galvani 52, 00153 Roma, by email at adrianovelagolf@gmail.com, or on WhatsApp at +39 328 077 9299.