Política de privacidad

Who we are (data controller)

Royal Tours S.R.L. runs private golf-cart tours in Rome and is the data controller for the personal data described here.

Company: Royal Tours S.R.L.

VAT number (P. IVA): 18057581003

Registered office: Via dei Monti della Farnesina 77, 00135 Roma

Companies Register (REA): RM-1758820

Certified email (PEC): royaltours@facilepec.com

Share capital: €10,000.00

Email: info@royaltoursrome.com

Phone and WhatsApp: +39 393 404 2684

We have not appointed a data protection officer, because our processing does not require one under article 37 of the GDPR. For anything about your data, write to info@royaltoursrome.com.

What data we collect

When you book a tour or contact us, we process:

• Your name, email address and phone number, entered on the Stripe payment page
• The tour, the date and time, the number of guests and the language of the tour
• The hotel or pickup address and any notes you write for us (optional)
• Whether someone in your group has limited mobility (optional, see the next section)
• The name of the hotel or partner who recommended us, if you tell us
• The outcome of the payment and the Stripe reference of the transaction (never the card number)
• The messages you send us by WhatsApp, email or phone
• Technical data that our hosting provider records for security: IP address, browser, time of the request

Limited mobility

The booking panel has an optional box to tell us that someone in your group walks with difficulty. This is health-related information (article 9 of the GDPR). We process it only if you tick the box, on the basis of your explicit consent, and only to choose a suitable pickup point, pace and stops. You can withdraw your consent at any time by writing to us; we delete this information after the tour unless you ask us to keep it for future bookings.

Why we use your data

• To confirm, schedule and run your tour: the right cart, guide, pickup point and time
• To contact you about your booking by WhatsApp, email or phone, including delays or weather changes
• To process your payment and refunds and to prevent fraud
• To answer your questions and handle complaints
• To issue receipts and invoices and keep the accounting records the law requires
• To keep the website secure and working

Legal bases (article 6 of the GDPR)

• Performance of the contract with you: everything needed to book and deliver the tour
• Legal obligations: tax, accounting and consumer law
• Our legitimate interest: fraud prevention, the security of the website, answering your messages
• Your explicit consent: the limited-mobility information and any promotional use of photos

Payments

Payments are processed by Stripe Payments Europe Ltd (Ireland), a payment provider certified under PCI DSS. Your card details are entered on a page run by Stripe and are never transmitted to us: we only receive the outcome of the payment, your name, email and phone, and a reference of the transaction. Stripe sends you the payment receipt by email. Stripe processes your data as an independent controller for the purposes of the payment itself (for example fraud prevention): see Stripe’s privacy policy at stripe.com/privacy.

Where your booking is kept

When your payment succeeds, the booking details (name, contact details, pickup point, tour, date, time, number of guests and tour language) reach Royal Tours by email in a Gmail inbox (Google Ireland Limited), and from there an automated script writes them into our Google Calendar, so that the carts and the guides are scheduled without overlaps. Only Royal Tours staff and the driver-guide assigned to your tour can see them. While you pay, a temporary hold with no personal data is written to the calendar through a dedicated technical account and removed automatically. Your notes, the limited-mobility flag and the name of any partner stay in the booking record at Stripe, where only Royal Tours staff can read them.

Address suggestions

When you type your hotel or pickup address in the booking panel, the text you type is sent to Google (Google Places, Google Ireland Limited) to propose complete addresses with their postcode, and the one you pick is checked against our pickup area. Nothing is sent until you type in that field, and the address you choose stays with your booking only. Google processes these requests under its own privacy policy at policies.google.com/privacy. If you prefer, leave the field empty: we meet at Via di Porta Pinciana 1.

WhatsApp, email and phone

Many guests prefer to write to us on WhatsApp. If you do, your messages are also processed by WhatsApp (Meta Platforms Ireland Limited) under its own terms and privacy policy; the choice of channel is yours, and email and phone are always available. We keep the conversation for as long as it is needed to manage your booking and any claim connected to it.

Hosting and server logs

The website and the booking service run on Vercel Inc. (United States). Vercel records technical logs (IP address, browser, pages requested) for a short period, for security and to keep the service working. Vercel processes data for us under a data processing agreement with the European Commission’s standard contractual clauses and is certified under the EU-US Data Privacy Framework.

Cookies

This website uses only technically necessary cookies and browser storage: your language choice and a few settings that make the site work. No profiling, advertising or cross-site analytics. The details are in our cookie policy.

Photos taken by your guide

Your guide takes photos of your group at the main stops and sends them to you: they are yours. We publish a photo on our website or social channels only if you have given us an explicit yes, which your guide will ask for separately, and you can withdraw that yes at any time by writing to us: we will remove the photo from the channels we control.

How long we keep your data

• Receipts, invoices and the data they contain: 10 years, as required by article 2220 of the Italian Civil Code and tax law
• Booking details and the related conversations: 24 months after the tour, so that we can handle any claim, then deleted or anonymised
• Limited-mobility information: deleted after the tour, unless you ask us to keep it
• Server logs: a short period set by our hosting provider
• Consent to use photos: until you withdraw it

Who receives your data

We never sell your data and we do not use it for marketing lists. It reaches only:

• Stripe, for the payment and the receipt
• Resend, which delivers the booking confirmation emails
• Google, which stores our calendar and suggests addresses while you type
• Vercel, which hosts the website and the booking service
• The driver-guide assigned to your tour: name, phone, pickup point, number of guests, notes
• WhatsApp (Meta), only if you choose to write to us there
• Public authorities, only when the law requires it

Transfers outside the European Union

Stripe and Google process your data in the European Economic Area. Vercel, Resend and Meta are based in the United States: transfers to them rest on the European Commission’s standard contractual clauses and on their certification under the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards.

How we protect your data

The website is served over an encrypted connection (HTTPS). Card details never reach our systems. Access to the calendar goes through a dedicated technical account with the minimum permissions needed, and only the staff who run the tours can read the bookings. Temporary holds are deleted automatically. No system is perfectly secure, but we keep these measures under review.

Your rights

Under articles 15 to 22 of the GDPR you can at any time:

• Ask for a copy of the personal data we hold about you
• Have inaccurate or incomplete data corrected
• Have your data deleted, except what the law obliges us to keep
• Ask us to restrict how we use your data
• Receive your data in a structured, machine-readable format
• Object to processing based on our legitimate interest
• Withdraw a consent you gave us, without affecting what was done before

How to exercise them

Write to info@royaltoursrome.com. We answer within one month; for complex requests this can be extended by up to two further months, and we will tell you if that is the case. We may ask you to confirm your identity before acting on a request, to make sure nobody else obtains your data.

Children

Bookings must be made by an adult, who books on behalf of all the guests. We do not knowingly collect personal data about children beyond the number of guests in the cart.

Complaints

If you think we have handled your data wrongly, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it), or with the authority of the country where you live. We would be grateful if you wrote to us first at info@royaltoursrome.com, so we can put things right quickly.

Changes to this policy

We update this page when our practices or the law change. The date at the top tells you when. For changes that matter to a booking you already made, we will also tell you directly.