Privacy Policy

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), this Privacy Policy describes how personal data of users visiting www.guidedolomiti.com or interacting with the services offered through the website are processed.

1. Data controller

The Data Controller is Enrico Maioni, domiciled at Località Crignes 47, 32043 Cortina d’Ampezzo (BL), Italy.

Email: e@guidedolomiti.com

2. Categories of personal data processed

The following categories of personal data may be processed:

  • Browsing data: IP addresses, technical device data, browser type, access logs.
  • Voice search data: the text resulting from voice transcription when the user voluntarily uses the microphone to perform an internal search. The website does not activate the microphone without an explicit user action.
  • Data provided through the activity request form: first name, last name, email address, phone number, number of participants, requested period, type of experience, activity goals, and any information useful for planning and safety purposes.
  • Any health-related information voluntarily provided by the data subject for the purpose of ensuring safety during the activity.
  • Payment data: information necessary for managing deposits through PayPal.
  • Newsletter data: email address.
  • Comments on blog articles: name, email address, comment content and IP address.
  • Management of requests submitted through the contact form and organization of activities: processing is necessary for the performance of pre-contractual or contractual measures requested by the data subject (Art. 6(1)(b) GDPR).
  • Safety management during activities: any health-related information voluntarily provided is processed on the basis of the explicit consent of the data subject (Art. 9(2)(a) GDPR) and for the purpose of safeguarding the individual’s physical integrity.
  • Payment management: processing is necessary for the performance of a contract (Art. 6(1)(b) GDPR).
  • Newsletter subscription: processing is based on the data subject’s consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
  • Statistical analysis via Google Analytics 4: processing is based on consent provided through the cookie banner (Art. 6(1)(a) GDPR).
  • Technical operation and website security: processing is based on the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).
  • Internal voice search: this feature converts the user’s spoken request into text and uses it to perform a search on the website. Processing takes place following the user’s voluntary action and is based on the user’s consent, expressed by selecting the microphone icon (Art. 6(1)(a) GDPR). Depending on the browser and device used, voice data may be processed locally or transmitted to an external speech-recognition service.
  • Management of blog comments: processing is necessary for handling the user’s voluntary request to publish a comment (Art. 6(1)(b) GDPR) and based on the legitimate interest of the Data Controller in moderating content (Art. 6(1)(f) GDPR).

4. Processing methods

Personal data are processed using electronic and telematic tools, adopting appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of data.

5. Data retention

  • Browsing data: up to 6 months, unless required for the investigation of criminal offenses.
  • Text of searches carried out using voice search: may be retained for the period necessary for the operation, security and analysis of the internal search service, in accordance with the applicable retention periods for search data.
  • Data submitted through forms: up to 12 months from the last communication, unless a contractual relationship is established.
  • Data related to tax and administrative obligations: up to 10 years, in accordance with applicable laws.
  • Newsletter data: until consent is withdrawn.
  • Health-related information: only for the time strictly necessary to manage the activity safely.

6. Recipients of personal data

Personal data may be processed by service providers strictly related to the management of the website and activities, appointed where necessary as Data Processors pursuant to Article 28 GDPR, including:

  • SiteGround (hosting and email/newsletter services)
  • PayPal (payment management)
  • Google LLC (Google Analytics, Google Maps, YouTube)
  • Vimeo LLC (embedded video content)
  • Speech-recognition service providers used by the user’s browser, such as Google, Apple or other providers, where the browser does not process the voice directly on the device. Such providers process the data in accordance with their respective privacy policies.

7. Transfer of data outside the European Union

Some service providers may transfer data to countries outside the European Union, in particular the United States. Such transfers are carried out in compliance with the European Commission’s adequacy decisions (EU–US Data Privacy Framework) or through appropriate safeguards provided under the GDPR.

8. Nature of data provision

The provision of personal data is voluntary; however, failure to provide data necessary for managing requests or activities may result in the inability to provide the requested service.

9. Data subject rights

The data subject has the right to obtain access to personal data, rectification, erasure, restriction of processing, data portability, and to object to processing in the cases provided for by Articles 15–22 of the GDPR.

Where processing is based on consent, the data subject has the right to withdraw such consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

The data subject also has the right to lodge a complaint with the competent Data Protection Authority.

10. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time. Users are therefore invited to review this page periodically.

Last updated: 27 September 2026