Privacy Policy of www.lucatourboat.com

This Application collects some Personal Data from its Users.

This document includes a dedicated section for Users located in the United States and their privacy rights. It can be printed for reference using the print function available in any browser.

Owner and Data Controller

Luca Zoppo
VAT / Tax code: 09458741213
Salita Moiariello 66/A, 80131 Napoli, Italy
Phone: +39 338 6431 374
Email: info@lucatourboat.com

Types of Data collected

This Application collects, directly or through third parties, the following types of Personal Data: Trackers; Usage Data; first name; last name; email address; phone number; data communicated while using the service; content of messages sent through messaging platforms; date and time of the messages; sender of the messages.

Full details on each category are given in the dedicated sections below or through explanatory notices shown before the data is collected.

Personal Data may be provided voluntarily by the User or, in the case of Usage Data, collected automatically during use of this Application.

Unless otherwise indicated, all Data requested by this Application is required. Failure to provide it may make it impossible for the Service to be delivered. Where the Application indicates that certain Data is optional, Users may choose not to provide it without any consequence for the availability or functioning of the Service.

Users unsure about which Data is mandatory are invited to contact the Owner.

Cookies and other tracking technologies used by this Application, or by the third-party services it relies on, serve to deliver the Service requested by the User and any further purposes described in this document and in the Cookie Policy.

Users remain responsible for any third-party Personal Data they obtain, publish or share through this Application.

Booking and service-specific data

Where the User submits a quote request or an enquiry regarding boat tours, charters or transfers, the Owner collects the data required to handle the request: name, contact details, requested service, preferred itinerary or destination, number of guests, port of departure, preferred duration, preferred dates and date flexibility, together with any further information the User chooses to provide about the group or specific needs.

Mode and place of processing

Methods of processing

The Owner adopts appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of the Data. Processing is carried out using computers and IT tools, following organisational procedures strictly related to the stated purposes. Besides the Owner, Data may in some cases be accessible to categories of persons involved in the operation of this Application (administration, sales, marketing, legal, system administration) or to external parties such as technical service providers, mail carriers, hosting providers, IT companies and communication agencies, appointed where necessary as Data Processors. An updated list of these parties can be requested from the Owner at any time.

Place

Data is processed at the Owner’s operating offices and at any other place where the parties involved in the processing are located. Depending on the User’s location, transfers may involve moving the Data to a country other than the User’s own. Further detail on the place of processing is available in the sections dedicated to each service.

Retention

Unless otherwise stated, Personal Data is processed and stored for as long as necessary for the purpose it was collected for, and may be kept longer where a legal obligation applies or where the User has consented.

Purposes of processing

Data is collected so that the Owner can provide the Service, comply with legal obligations, respond to enforcement requests, protect its rights and interests or those of Users and third parties, detect malicious or fraudulent activity, and for the following purposes: Analytics, Spam and bot protection, Contacting the User, Interaction with external messaging platforms, Displaying content from external platforms, and Managing consent preferences.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes, using the following services:

Analytics

The services in this section allow the Owner to monitor and analyse web traffic and can be used to keep track of User behaviour.

Google Analytics (Google Ireland Limited)
Google Analytics is a web analysis service provided by Google Ireland Limited. Google uses the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualise and personalise the ads of its own advertising network.
Personal Data processed: Trackers; Usage Data.
Place of processing: Ireland. Privacy Policy – Opt out.

Spam and bot protection

This type of service analyses the traffic of this Application, potentially containing Users’ Personal Data, in order to filter it from traffic, messages and content recognised as spam or generated by automated systems.

Cloudflare Turnstile (Cloudflare, Inc.)
Turnstile is a bot protection service used to verify that form submissions on this Application originate from a human User rather than an automated system. It runs on the pages containing forms.
Personal Data processed: Trackers; Usage Data.
Place of processing: United States. Privacy Policy.

Contacting the User

Quote request and contact forms (this Application)
Users submitting a quote request or an enquiry through the forms on this Application provide the Data listed in the form, which is used solely to reply to the request and to prepare the requested quote. The Data is stored on this Application and forwarded by email to the Owner. It is not transferred to any third-party marketing platform.
Personal Data processed: first name; last name; email address; phone number; requested service; preferred itinerary or destination; number of guests; port of departure; preferred duration; preferred dates and date flexibility; any additional notes provided by the User.
Place of processing: Italy.

Newsletter subscription (this Application)
Users subscribing to the newsletter provide their email address, which is used to send periodic updates about the Service. Users may unsubscribe at any time by contacting the Owner or by using the link included in each message.
Personal Data processed: email address.

Interaction with external messaging platforms

WhatsApp chat button (WhatsApp Ireland Limited)
This Application displays a button that allows Users to start a conversation with the Owner through WhatsApp. The button itself does not send any Personal Data before the User clicks it. Once the conversation is started, the exchange takes place within WhatsApp and is governed by the privacy policy of that platform. The Owner receives the User’s WhatsApp profile name, phone number and the content of the messages sent.
Personal Data processed: phone number; profile name; content of the messages; date and time of the messages.
Place of processing: as specified in the WhatsApp privacy policy. Privacy Policy.

Displaying content from external platforms

Google Fonts (Google Ireland Limited)
Google Fonts is a typeface visualisation service that allows this Application to incorporate content of this kind on its pages. When a page is loaded, the User’s browser connects to Google servers, which receive the User’s IP address.
Personal Data processed: Usage Data; Trackers.
Place of processing: Ireland. Privacy Policy.

Managing consent preferences

Consent management (this Application)
This Application uses a consent management tool that records the choices expressed by the User in relation to Trackers. The consent record is stored locally in the User’s browser and on this Application, so that the preferences can be honoured on subsequent visits and demonstrated if required.
Personal Data processed: Trackers; consent status; date of consent.
Place of processing: Italy.

Cookie Policy

This Application uses Trackers. For details, Users may consult the Cookie Policy.

Legal basis of processing

The Owner may process Personal Data relating to Users where one of the following applies:

• the User has given consent for one or more specific purposes;
• processing is necessary to perform an agreement with the User or to fulfil pre-contractual obligations;
• processing is necessary to comply with a legal obligation binding on the Owner;
• processing relates to a task carried out in the public interest or in the exercise of official authority vested in the Owner;
• processing is necessary for the legitimate interests pursued by the Owner or by a third party.

The Owner will clarify on request which specific legal basis applies, and in particular whether providing Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Further information about retention time

Unless otherwise stated in this document, Personal Data is processed and stored for as long as required by the purpose it was collected for, and may be kept longer where a legal obligation applies or where the User has consented. Accordingly:

• Data collected in connection with the performance of a contract between Owner and User is retained until that contract has been fully performed;
• Data collected for the Owner’s legitimate interests is retained as long as needed for those purposes. Users can find details of those interests in the relevant sections of this document or by contacting the Owner;
• the Owner may retain Data for a longer period where the User has consented, for as long as that consent is not withdrawn, or where required by a legal obligation or an order from an authority.

Once the retention period expires, Personal Data is deleted. The rights of access, erasure, rectification and portability can therefore no longer be exercised after that point.

Rights of Users under the GDPR

Users may exercise the following rights in relation to Data processed by the Owner, to the extent permitted by law:

• withdraw consent at any time, where consent was previously given;
• object to processing carried out on a legal basis other than consent;
• access their Data, learn whether it is being processed, obtain information about the processing and receive a copy;
• verify accuracy and request rectification or updating;
• restrict processing, in which case the Owner will only store the Data;
• obtain erasure of their Data;
• receive their Data in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller without hindrance;
• lodge a complaint with the competent data protection authority. In Italy this is the Garante per la protezione dei dati personali.

Users are also entitled to be informed about the legal basis for any transfer of Data abroad, including to international organisations governed by public international law or created by two or more countries, and about the safeguards adopted by the Owner.

Details about the right to object

Where Personal Data is processed in the public interest, in the exercise of official authority, or for the legitimate interests of the Owner, Users may object by stating a ground related to their particular situation.

Where Personal Data is processed for direct marketing purposes, Users may object at any time, free of charge and without giving reasons. Once an objection is raised, the Data will no longer be processed for those purposes.

How to exercise these rights

Requests may be sent to the Owner using the contact details given in this document. Requests are free of charge and will be answered as soon as possible, and in any case within one month. Any rectification, erasure or restriction will be communicated by the Owner to each recipient to whom the Data has been disclosed, unless this proves impossible or would require disproportionate effort. On request, the Owner will inform the User about those recipients.

Further information for Users in the United States

This section supplements the rest of the privacy policy and is provided by the business operating this Application and, where applicable, its parent, subsidiaries and affiliates (referred to here as “we”, “us”, “our”).

It applies to Users resident in the following states: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Montana. For those Users, this section prevails over any conflicting provision elsewhere in this policy.

This section uses the term Personal Information, and Sensitive Personal Information where relevant.

Notice at collection

The following notice sets out the categories of Personal Information collected or disclosed in the past twelve months, so that you can exercise meaningful control over how we use it. The categorisation is based mainly on California privacy law, but gives any User a general idea of what is collected:

• Internet or other electronic network activity information
• Inferences drawn from other personal information
• Identifiers

Definitions of these categories are set out in the “Definitions and legal references” section of this policy. For more detail on collection, see “Detailed information on the processing of Personal Data”.

We will not process your Information for unexpected purposes, or for purposes that are not reasonably necessary to and compatible with the purposes originally disclosed, without your consent.

Sources of the Personal Information we collect

We collect the categories above directly or indirectly from you when you use this Application. You provide Personal Information directly when you submit a request through any form on this Application, and indirectly when you browse the Application, since certain information is observed and collected automatically. We may also collect Personal Information from third parties working with us in connection with the Service or the functioning of this Application.

Your privacy rights under US state laws

To the extent permitted by applicable law, you have:

• the right to know and to access your Personal Information, including the right to have us confirm whether we are processing it;
• the right to have inaccurate Personal Information corrected;
• the right to request deletion of your Personal Information;
• the right to obtain a copy of your Personal Information in a portable and usable format, where technically feasible;
• the right to opt out of the Sale of your Personal Information;
• the right not to be discriminated against for exercising your privacy rights.

Additional rights for Users residing in California

In addition to the rights above, you have the right to opt out of the Sharing of your Personal Information for cross-context behavioural advertising, and the right to request that we limit the use or disclosure of your Sensitive Personal Information to what is necessary to perform the services or provide the goods reasonably expected by an average consumer. Certain statutory exceptions may apply, for example where processing Sensitive Personal Information is necessary to verify or maintain the quality or safety of the service.

Additional rights for Users residing in Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Montana

In addition to the rights above, you have the right to opt out of processing of your personal information for Targeted Advertising or for profiling in furtherance of decisions producing legal or similarly significant effects, and the right to give, refuse or withdraw consent for the processing of your Sensitive Personal Information. Statutory exceptions may apply, for instance where processing is necessary to provide a product or service you specifically requested. In Maryland, Sensitive Personal Information is collected or processed only where strictly necessary to provide or maintain a product or service you requested.

In Minnesota and Maryland, Users also have the right to obtain a list of the specific third parties to which the controller has disclosed their personal data.

In some states, including Minnesota, Users have specific rights connected to profiling:

• the right to question the results of profiling;
• the right to be informed of the reason a profiling decision was reached, where feasible;
• the right to be informed of what actions could have led to a different decision and what actions might lead to a different decision in future;
• the right to review the personal data used in profiling;
• where that data is inaccurate, the right to have it corrected and the decision reassessed.

Additional rights for Users residing in Utah and Iowa

In addition to the rights above, you have the right to opt out of processing of your Personal Information for Targeted Advertising, and the right to opt out of processing of your Sensitive Personal Information, subject to statutory exceptions such as where processing is necessary to provide a product or service you specifically requested.

How to exercise your rights

Submit your request using the contact details in this document. We must be able to identify you before responding, since we cannot confirm that the Personal Information we hold relates to you otherwise. You do not need to create an account to submit a request. Any Personal Information collected in order to verify your request will be used solely for verification, will not be further disclosed, will not be kept longer than necessary for that purpose, and will not be used for unrelated purposes. An adult may submit a request on behalf of a child under their parental authority.

How to exercise your right to opt out

In addition to the above, you can use the privacy choices link available on this Application. If you wish to submit opt-out requests for Sale, Sharing or Targeted Advertising through a user-enabled global privacy control such as the Global Privacy Control (GPC), you are free to do so and we will honour it without friction.

How and when we handle your request

We will respond without undue delay and in all cases within the timeframe set by applicable law. If we need more time, we will explain why and how much longer we need. If we deny your request, we will explain the reasons, and where applicable law provides for it you may then complain to the relevant authority. We do not charge for processing requests unless a request is manifestly unfounded or excessive, or in other cases permitted by law. In those cases we may charge a reasonable fee or decline to act, and we will explain our decision.

Additional information about Data collection and processing

Legal action

Personal Data may be used by the Owner for legal purposes, in court or in the stages leading to possible legal action arising from improper use of this Application or its Services. The User acknowledges that the Owner may be required to disclose personal data at the request of public authorities.

Additional contextual information

Beyond this policy, this Application may provide Users with further contextual information about particular Services or about specific collection and processing activities, on request.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party service may collect files recording interactions with this Application (system logs), or use other Personal Data such as the IP address for the same purpose.

Information not contained in this policy

Further details about collection or processing may be requested from the Owner at any time, using the contact details at the top of this document.

Changes to this privacy policy

The Owner reserves the right to amend this privacy policy at any time by giving notice on this page and, where possible, within the Application, and where technically and legally feasible by sending a notice through any contact details available. Users are encouraged to check this page regularly and to refer to the date of last modification shown at the bottom. Where changes affect processing carried out on the basis of consent, the Owner will collect fresh consent where required.

Last updated: 24 July 2026