Privacy

Who we are

Data controller: [company name], [registered office], VAT no. [number]. For any privacy question write to us at ciao@lakegardaexperiences.com.

Updated on 28 September 2026.

In short

• We collect only the data needed for your booking and to welcome you on the day.
• Your card details are handled by Stripe: we never see them.
• We never sell or hand over your data and we do not use it for advertising.
• You don't need to create an account or choose a password.
• You can ask us at any time to see, correct or delete your data.

When you book

• Name, surname and email

  Required

  To record the booking and send you the confirmation, the reminder the day before and the link to view or cancel it.

• Phone

  Optional

  Only to reach you on the day of the experience if needed, for example if the time changes because of the weather.

• Country

  Optional

  To know where our guests come from and, if you leave a review, to show it next to your name.

• Special requests

  Optional

  What you write, for example allergies or accessibility needs, is passed only to the people welcoming you, translated into Italian if needed. Only write what is useful for the experience.

• Booking details

  Automatic

  Experience, date and time, number of people and ticket type (for example "child"), amount, any cancellations and refunds.

• Payment

  Through Stripe

  Payment takes place on Stripe. We receive only the outcome, the amount and a payment code, never the card number.

• Connection security code

  Automatic

  To stop anyone from holding many places without paying, we store with the booking an encrypted code derived from the connection's internet address. The address itself is not stored in readable form.

Reviews

The day after the experience we email you to ask for your opinion. If you leave a review we publish it with your first name, your country and the date of the experience, never with your surname or email. The text may be translated automatically into the site's other languages and the people who welcomed you may reply publicly. If you don't want to receive the review request, or want your review removed, write to us.

Waiting list

If you leave your email on the "We're opening soon" page, we use it only to send you one email when we open, then we delete it. You can ask us to delete it earlier at any time.

Gift vouchers

If you give an experience, we need your name and email, the name of the person receiving it, their email if you choose to send it by email, and your message. We use them only to deliver the voucher, for the confirmation and for the two reminders before it expires. When choosing the day, the person receiving it gives us their own details, as in a booking.

Bookings made by your hotel

If your hotel books an experience for you, it gives us your name, your email and, if useful, your phone number and a note for the provider (for example an allergy). The provider uses the phone number only on the day of the experience. We use them only to send you the link to pay and then for the booking, as if you had booked yourself. We do not tell the hotel whether you paid.

If you are a partner

If you run experiences with us we handle the data needed for the contract, invoices and payments: name or company name, tax details, address, operational email and phone. You enter your bank details directly on Stripe to receive payments. To sign in to the panel we use single-use links and codes by email, and we remember which devices you are signed in on (for example "iPhone · Safari") so you can sign them out.

Why we may use your data

• For the booking you asked for (art. 6(1)(b) GDPR): contact details, booking details, payment and service emails such as confirmation and reminder.
• For legal obligations (art. 6(1)(c)): keeping accounting and tax records of payments.
• For our legitimate interest (art. 6(1)(f)): preventing fraud and abuse, protecting the site and asking for a review after the experience.
• With your consent (art. 6(1)(a) and, for any health data in special requests, art. 9(2)(a)): waiting list and special requests. You can withdraw it at any time.

Who we share data with

Only with those we need to provide the service. Our suppliers use the data only for the work they do for us. When data leaves the European Union, the transfer relies on the safeguards provided by the GDPR (EU-US Data Privacy Framework or standard contractual clauses). We do not hand it to anyone else, except where authorities require it by law.

• The people who run the experience

  Italy

  The local partner receives name, phone, email, country, number of people and special requests to welcome you. For running the experience they are an independent controller of the data.

• Stripe

  Ireland and USA

  Payments, refunds and fraud prevention, including hCaptcha. For some activities, such as fraud prevention, Stripe is an independent controller.

• Supabase

  Ireland

  The database where bookings, reviews and the waiting list are stored.

• Netlify

  USA

  Hosts the website.

• Resend

  USA

  Sends the emails: confirmations, reminders, review requests.

• Microsoft (Azure Translator)

  Italy

  Automatically translates reviews and special requests.

• GitHub

  USA

  Keeps the database backups, encrypted: nobody can read them without our key.

For how long

• Bookings and payments

  Up to 10 years, for accounting and tax obligations.

• Reviews

  As long as they are published. You can ask for removal at any time.

• Waiting list

  Until the opening email, then we delete it.

• Partner and administrator access

  Links and codes are valid for 15 minutes. Sessions expire 30 days after last use for partners, 14 days for administrators.

• Backups

  Encrypted, kept for 30 days and then deleted automatically.

Your rights

You can ask us at any time to see your data, correct it, delete it, restrict its use, receive it in a readable format, object to its use for legitimate interest and withdraw any consent you gave. Write to us at ciao@lakegardaexperiences.com: we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

• Italian Data Protection Authority

Children

Bookings are made by an adult. We don't ask for children's names: only how many there are and the ticket type, for the price and to show you suitable experiences.

Security

Always-encrypted connection, password-free access to the panels with single-use codes, confidential data kept separate and protected, encrypted backups, automatic checks at every change to the site.

Cookies

This site uses only technical cookies. You can find the full list on the dedicated page.

Changes

If the way we handle data changes, we update this page and the date at the top. If the change is significant and we have your email, we will tell you.