Privacy policy

Who processes your data

The data controller is My Rapallo Servizi SRLS, registered office Via Ettore Romagnoli 6, 20146 Milano (MI), Italy, VAT no. IT12804800964, certified email myrapalloservizi@pec.it. MY Como is one of its brands.

For any question about your data, or to exercise your rights, write to info@my-como.it. We have not appointed a data protection officer (DPO).

When you browse the website

The servers hosting the website automatically log the technical data of each request: IP address, browser, page requested, date and time. We use them to run the website, protect it from abuse (for example by limiting repeated requests from the same address) and fix faults. Legal basis: our legitimate interest in the security and operation of the website (Art. 6(1)(f) GDPR).

Analytics and Google and Meta ad measurement start only with your consent in the banner (below and in the cookie policy).

When you arrive from an ad or a campaign

If you open the website from a link carrying campaign codes (Google's gclid, gbraid, wbraid, Meta's fbclid, utm_ parameters), we record a "visit": the location, the campaign codes and a six-character code, with no name or contact details. The code stays in your browser until you close the tab (sessionStorage "mr_visita") or, with your cookie consent, for 30 days and, if you then book or write to us through the form, we link it to the booking or the request. The same code comes from the QR codes at our bases. It tells us which campaign or partner (for example the hotel that gave you the QR code) brought you to us, also so that we can pay the partner its commission. Legal basis: our legitimate interest in measuring our campaigns and managing our partners (Art. 6(1)(f) GDPR); the code is not used to profile you and we do not give it to third parties.

Without your consent this data stays in our systems; with consent the rules in the next section also apply.

Ad measurement (only with consent)

If you accept measurement and advertising cookies in the banner, the website loads Google Tag Manager with Google Ads, Google Analytics 4 and the Meta Pixel. Google and Meta receive the pages you visit, their cookie identifiers and the website events (payment started, booking or voucher paid with their value and code, form request, clicks on phone, email and WhatsApp); for bookings, vouchers and requests also your email and phone, made unreadable (hashed) before sending, to match the conversion. They tell us which ads bring customers and let us show you our ads. With consent we also send the Google and Meta identifiers together with the booking, to record the conversion from our systems. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the "Cookie preferences" link at the bottom of every page. For their own purposes Google and Meta are independent controllers: policies.google.com/privacy, facebook.com/privacy/policy.

When you write to us

Through the Contact form we collect first and last name, email and/or phone, the date you are interested in, the type of service, your message and the visit code, if any. The request reaches our office and we use it to reply and prepare a quote. The same applies to emails and WhatsApp messages you send us. Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).

To protect the form from automated programs we use Cloudflare Turnstile: to tell whether a person is writing, Cloudflare receives your IP address and some browser data.

WhatsApp is a Meta service: when you write to us there, messages pass through Meta and, for some numbers, through a technical provider connected to WhatsApp Business (Dualhook).

When you book a tour

For a booking we collect first and last name, email, phone, language, any notes, the tour, boat, date, time, number of guests, boarding and landing points and any discount codes or gift vouchers. We use them to manage the booking, send you the confirmation and messages about the trip, collect the deposit and balance, and keep our accounts. Legal basis: the contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR).

Online payment goes through Stripe: you enter your card details in Stripe's fields and we never see or store them. Stripe tells us the outcome of the payment.

When you buy a gift voucher

We collect the buyer's first and last name, email and phone (optional) and, if you provide them, the recipient's name and email, the message and the delivery date. We use them to issue the voucher, email it to you or to the recipient on the chosen day, and manage its use. Legal basis: the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR). If you give us someone else's details, make sure they agree. Payment goes through Stripe, as for bookings.

Required data

Fields marked as required are needed to reply, book or issue the voucher: without them we cannot do so. The others are optional.

Marketing

The website does not ask for your consent to newsletters or promotional messages, and we do not use your data for that (Google and Meta ads follow only your choice in the banner, section above). If we ever do, we will ask you separately, with a free choice you can withdraw.

Who we share data with

Data is processed by the people in our office and staff who need it for their work, and by these providers, who process it on our behalf as processors (Art. 28 GDPR):

• Microsoft: the servers for the website and database (Azure, Italy North region) and email, including confirmation and voucher emails;
• Stripe: online payments;
• Cloudflare: the anti-bot check on the Contact form;
• Meta and Dualhook: WhatsApp messages;
• Google and Meta: ad measurement, only with consent (section above);
• our accountant, for tax obligations.

We do not sell data or give it to third parties for their own purposes, except for requests from authorities as required by law.

Data outside the European Union

Some of these providers (Stripe, Cloudflare, Meta, Google) belong to groups based in the United States and may process data outside the European Union. In that case the transfer takes place with the safeguards set by the GDPR (adequacy decision or the European Commission's standard contractual clauses).

How long we keep data

• Visit code in the browser: until the tab is closed; 30 days with cookie consent.
• Record of cookie banner choices: 13 months.
• Booking and customer data, tax and accounting records: 10 years, for tax obligations (Art. 2220 of the Italian Civil Code).
• Requests and messages that do not become a booking: 12 months.
• Website visits (campaign and QR codes): 12 months.
• Technical server logs: 12 months.

Your rights

At any time you can ask us to access, correct or erase your data, restrict its processing, receive it in a readable format (portability) and object to processing based on our legitimate interest; if you have given consent, you can withdraw it without affecting what was done before. Write to info@my-como.it: we reply within one month.

If you believe the processing breaks the law, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Changes

If we change this notice, the new version is on this page with its date.