Privacy Policy – Iconic Guided Tours

Privacy Policy – Iconic Guided Tours

Last updated: 21/08/2026

1. Introduction

Your privacy is very important to us. This Privacy Policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and other applicable privacy laws.

2. Data Controller

The Data Controller responsible for processing your personal data is:

Iconic Guided Tours

Email: info@iconicguidedtours.com

For any questions regarding the processing of your personal data or to exercise your privacy rights, please contact us at info@iconicguidedtours.com.

3. Types of Data Collected

We collect several categories of personal data to provide our services, manage bookings, and fulfill legal obligations:

• Identifying Information: First name, last name, date of birth (if required for specific museum entry tickets).

• Contact Information: Email address, phone number / WhatsApp details.

• Booking & Billing Details: Purchased tours, dates, times, special requests, payment status, and invoicing address.

• Technical & Usage Data: IP address, browser type, geographic location, and interaction with our website (via analytics tools).

• Cookies and Similar Technologies: Information collected via essential and non-essential cookies (please refer to our Cookie Policy for details).

4. Purposes and Legal Basis for Data Processing

We process your personal data based on specific legal grounds:

• Contractual Necessity: To manage inquiries, confirm bookings, process payments, deliver guided tours, and provide customer support.

• Legal Obligation: To comply with tax, accounting, and regulatory administrative requirements.

• Consent: To send direct marketing communications, newsletters, or process non-essential analytics/advertising cookies (consent can be withdrawn at any time).

• Legitimate Interest: To maintain website security, prevent fraud, and optimize our tour services and online user experience.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking & Transaction Data: Retained for 10 years to comply with legal, tax, and accounting obligations under Italian law.

• Marketing Data: Retained for up to 24 months from consent, or until you withdraw your consent / unsubscribe.

• Technical & Analytics Data: Retained in accordance with Google Analytics parameters (up to 14 months).

6. Sharing Data with Third Parties

We do not sell your personal data. We may share data with trusted service providers acting as Data Processors solely to run our business:

• Payment Processors: Stripe, PayPal, or credit card processing gateways to execute transaction payments securely.

• Hosting & IT Services: Web hosting providers (e.g., IONOS) and email communication tools.

• Analytics & Marketing Partners: Google Analytics, Meta/Facebook Pixel (subject to your cookie preferences).

• Legal & Public Authorities: When required by law or judicial request.

7. International Data Transfers

Some third-party tools we use (such as Google or Meta) may transfer and store data outside the European Economic Area (EEA). Where this occurs, we ensure adequate safeguards are in place, such as EU Standard Contractual Clauses (SCCs) or reliance on adequacy decisions.

8. User Rights

Under GDPR and CCPA, you have the following rights regarding your data:

• Access & Rectification: Request a copy of your personal data or correct inaccuracies.

• Erasure (Right to be Forgotten): Request deletion of your data, provided there is no legal obligation to retain it.

• Restriction & Objection: Restrict or object to the processing of your data under specific circumstances.

• Data Portability: Receive your data in a structured, commonly used format.

• Opt-Out: Withdraw consent for marketing or personalized ads at any time.

To exercise any of these rights, please email us at info@iconicguidedtours.com.

9. Data Security

We implement appropriate technical and organizational measures (including SSL encryption, secure servers, and access restrictions) to safeguard your personal data against unauthorized access, loss, or alteration.

10. Policy Updates

We reserve the right to update this Privacy Policy. Any significant changes will be published on this page with an updated revision date.