Privacy Policy

Last updated: (February 2026)

1. Data Controller

The data controller is Davide Blasio, Italian citizen, who operates the website naplesboatexperience.com to receive booking requests for boat tours carried out under the regime of occasional charter (maximum 42 trips per year, each communicated to the Harbour Master’s Office and the Italian Revenue Agency).

Controller’s contact details:

• Certified email (PEC): davideblasio@pec.it

• Phone: +39 331 312 8426

• Website: **https://www.naplesboatexperience.com**​

2. Types of data processed

2.1 Data provided voluntarily by the user

When filling in booking or contact forms on the website, the following personal data may be collected, depending on the case:

• First name and last name

• Email address

• Phone number

• Requested tour date, preferred time, number of people on board

• Any additional information entered in the message field (special requests, notes, etc.)

These data are used to:

• handle the booking request

• verify the actual availability of the requested tour

• prepare the occasional charter contract to be signed on board

• communicate with the user by email or phone for confirmation, changes or cancellation.

No payment is made through the website. The final confirmation of the booking and the payment are handled afterwards, directly on board (cash or bank transfer), or otherwise outside the online platform.

2.2 Browsing data

During normal operation, the IT systems and software procedures that run this website acquire some personal data whose transmission is implicit in the use of Internet communication protocols (e.g. IP address, type of browser, time of the request, pages visited).​

These data are used in aggregated and anonymised form to:

• obtain anonymous statistical information on the use of the website

• check that the website is working properly

• improve content and user experience.

2.3 Cookies and tracking technologies

The website uses:

• technical cookies, which are necessary for the functioning of the website and the Vacation Labs platform

• analytics cookies from third parties through Google Analytics 4, which are activated only after the user has given consent via the cookie banner

• technical/service cookies associated with the review widget provided by embedsocial.com and with the WhatsApp contact button.

For more details on the types of cookies, storage periods and how to manage consent, please refer to the separate Cookie Policy.

3. Purposes and legal bases of processing

Personal data collected via the website are processed for the following purposes:

1. Handling booking and contact requests

   • Responding to enquiries submitted via contact or booking forms, or by email

   • Checking the availability of tours and communicating with the user

   • Preparing and managing the occasional charter contract
     Legal basis: performance of pre‑contractual and contractual measures at the request of the data subject (Art. 6.1.b GDPR).​

2. Compliance with legal obligations

   • Compliance with tax obligations and communications to the Harbour Master’s Office and the Italian Revenue Agency relating to the trips carried out
     Legal basis: compliance with legal obligations to which the controller is subject (Art. 6.1.c GDPR).​

3. Website security and prevention of abuse

   • Analysis of technical logs and browsing data for security, maintenance and prevention of fraudulent or improper use of the website
     Legal basis: legitimate interest of the controller in ensuring network and information security (Art. 6.1.f GDPR).​

4. Statistical analysis of traffic (Google Analytics 4)

   • Gathering aggregated statistics on website usage to improve services

   • Google Analytics is configured according to the controller’s choices and cookies are activated only after consent is given via the cookie banner
     Legal basis: consent of the data subject, expressed through the cookie banner (Art. 6.1.a GDPR).

5. Operational and informational communications

   • Sending emails from the Vacation Labs system for confirmations, reminders and updates related to an existing booking or enquiry
     Legal basis: performance of a contract and legitimate interest of the controller in keeping the customer informed about their booking (Art. 6.1.b and 6.1.f GDPR).​

No regular marketing newsletter is currently operated. If promotional communications unrelated to a specific booking are introduced in the future, a separate and specific consent will be requested.

4. Methods and retention of data

Data are processed:

• using electronic and telematic tools (Vacation Labs platform, PEC email, other digital systems)

• in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation laid down by the GDPR.​

Data relating to bookings and occasional charter contracts may be stored for the time necessary to:

• properly manage the relationship before and after the tour

• comply with tax, civil and accounting obligations (e.g. retention of documents for 10 years or other statutory periods)

• establish, exercise or defend legal claims.

Data processed for statistical purposes via Google Analytics are managed by Google in accordance with the retention period configured in the tool (e.g. 14 or 26 months, or other settings).

Data processed on the basis of consent (e.g. analytics cookies) are retained until the user withdraws consent, which can be done via browser settings or through the cookie banner.

5. Data recipients and transfers to third countries

For the functioning of the website and the management of bookings, personal data may be disclosed to:

• Vacation Labs, as provider of the booking engine and website platform (acting as data processor)

• Google LLC, as provider of Google Analytics (acting as data processor for analytics services)

• service providers in charge of technical maintenance, hosting and IT support

• the provider of the review widget embedsocial.com and the WhatsApp contact button, for their respective features.

Some of these entities are located in countries outside the EU/EEA (such as the United States and others). In such cases, data transfers take place:

• on the basis of adequacy decisions issued by the European Commission, where applicable, or

• through the adoption of Standard Contractual Clauses or other appropriate safeguards pursuant to Articles 44 et seq. GDPR.

These providers are contractually bound to process personal data solely for the purposes indicated by the controller and in compliance with the applicable data-protection legislation.

6. Rights of the data subject

At any time, and within the limits and conditions set out in the GDPR, the user may exercise the following rights:

• right of access to personal data (Art. 15)

• right to rectification of inaccurate or incomplete data (Art. 16)

• right to erasure (“right to be forgotten”) in the cases provided for (Art. 17)

• right to restriction of processing (Art. 18)

• right to data portability (Art. 20)

• right to object to processing based on legitimate interest (Art. 21)

• right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7).​

To exercise these rights, the user can contact the controller using the contact details provided in Section 1.

The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of their habitual residence, place of work or place of the alleged infringement.

7. Nature of data provision

• Providing the data requested in booking/contact forms is necessary in order to handle the request and prepare the occasional charter contract; failure to provide such data makes it impossible to provide the service.

• Providing data for analytics cookies is optional and based on the user’s consent via the cookie banner. Refusal to give consent does not affect the ability to browse the website, but limits the collection of anonymous usage statistics.

8. Third‑party websites and services

The website may contain links to third‑party websites or services (e.g. WhatsApp, social networks, review platforms).

The use of such services entails the processing of personal data by the respective providers, in accordance with their own privacy policies, which users are invited to consult.

9. Processing of minors’ data

The website and the services offered are intended for adult users.

Any requests or bookings involving minors on board must be made by an adult acting as parent or legal guardian. The controller does not knowingly collect personal data from children under 16; if he becomes aware of any unintentional processing of such data, he will promptly delete them.

10. Changes to this Privacy Policy

The controller reserves the right to amend this Privacy Policy at any time, in line with applicable legislation. Any changes will be published on this page and, where appropriate, notified to users via the available contact details.

Users are therefore invited to consult this page regularly to check for updates.