PRIVACY POLICY
Effective date: October 06, 2026
Last updated: October 06, 2026
This Privacy Policy explains how EiS S.S. processes the personal data of users who visit www.eventinsicily.com, submit a contact or availability request, or communicate with EiS by email, telephone or WhatsApp, in accordance with Regulation EU 2016 679 GDPR and applicable Italian law.
1 Data Controller
| Controller | EiS S.S. |
| Registered address | Via Fabio 74, Acireale CT, Italy |
| VAT and tax number | 05871540877 |
| reservation@eventinsicily.com | |
| Certified email PEC | suspirannu@pec.it |
No Data Protection Officer DPO has been appointed because the legal requirements for a mandatory appointment do not currently apply.
2 Personal data processed
The website may process the following categories of personal data.
• Technical and browsing data, including IP address, date and time of the request, pages visited, device and browser type, logs and information necessary for the operation and security of the website.
• Identity and contact data, including name, email address and telephone number.
• Request details, including the requested service, location, number of participants, event date, arrival and departure dates and message content.
• Information provided voluntarily in subsequent communications, including any information concerning dietary, accessibility or organisational needs. Users should not provide special category data unless it is necessary.
3 Purposes and legal bases
• Information and availability requests: answering messages, preparing quotations and arranging services and experiences. Legal basis: steps taken at the user’s request before entering into a contract, Article 6 1 b GDPR.
• Performance of services and contract management: bookings, operational communications, assistance and related activities. Legal basis: performance of a contract, Article 6 1 b GDPR.
• Administrative, accounting, tax and legal obligations. Legal basis: legal obligation, Article 6 1 c GDPR.
• Security, fraud prevention and legal protection: log management, prevention of unlawful conduct and the establishment, exercise or defence of legal claims. Legal basis: the Controller’s legitimate interests, Article 6 1 f GDPR.
• Marketing communications: sent only where permitted by law and, where required, on the basis of specific, freely given and withdrawable consent, Article 6 1 a GDPR.
4 Required and optional information
Fields marked as required are necessary to handle a request. If they are not completed, EiS may be unable to respond or arrange the requested service. All other information is optional.
5 Processing methods and security
Data is processed using electronic systems and, where necessary, paper records, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation. Appropriate technical and organisational safeguards are applied. Requests submitted through the forms are handled through WordPress and Forminator and may be stored in the website database and forwarded to authorised email addresses of the Controller.
6 Recipients and processors
Data may be processed by authorised personnel and by providers supporting the website, hosting, email, IT maintenance, booking management, payments, accounting and delivery of the requested services. Depending on their role, such parties act as processors under Article 28 GDPR or as independent controllers. Data may also be disclosed to public authorities where required by law.
Personal data is not sold or made publicly available.
7 Third party links and services
The website contains links to external services, including WhatsApp, Google and other websites. When a user opens such a link, the resulting processing is governed by the relevant provider’s privacy policy. If the user contacts EiS through WhatsApp, the data will also be processed by WhatsApp or Meta under its own terms and policies.
8 International data transfers
Certain external providers may process data outside the European Economic Area. Where applicable, transfers are made in compliance with Articles 44 et seq. GDPR, on the basis of adequacy decisions, Standard Contractual Clauses or other lawful safeguards. The voluntary use of third party services remains subject to the relevant provider’s policy.
9 Retention periods
• Information or availability requests that do not lead to a contract: up to 24 months after the request is closed, unless longer retention is needed to protect legal rights.
• Contracts, payments and administrative or accounting documents: for the period required by law, generally 10 years.
• Marketing data: until consent is withdrawn or the user objects, subject to periodic relevance reviews.
• Technical and security logs: for the period strictly necessary to protect the website and investigate abuse, unless legal obligations or disputes require longer retention.
10 Data subject rights
Data subjects may exercise the rights provided by Articles 15 to 22 GDPR, including access, rectification, erasure, restriction, portability, objection and withdrawal of consent without affecting the lawfulness of earlier processing. Requests may be sent to reservation@eventinsicily.com or by certified email to suspirannu@pec.it.
Data subjects may also lodge a complaint with the Italian Data Protection Authority at www.garanteprivacy.it or seek judicial relief.
11 Children
The services are not directed at children. Information concerning minors that is necessary to arrange a service must be provided by a person exercising parental responsibility or otherwise authorised to do so.
12 Cookies
Please see the website’s Cookie Policy for information on cookies and technical tools.
13 Changes to this Policy
The Controller may update this Policy to reflect legal or technical changes. The version displayed on the website, together with its update date, is the current version.
