Last updated: 4 August 2026
This Privacy Policy describes how the personal data of users who visit the website or contact Giulia Bacci Tirinnanzi to request information or arrange a guided tour are processed.
This Privacy Policy is provided pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679, hereinafter referred to as the “GDPR”, and the applicable Italian data protection legislation.
1. Data Controller
The Data Controller is:
Giulia Bacci Tirinnanzi
Licensed tourist guide and art historian
VAT number: 06815060485
Registered under no. 09000518 in the Italian National Register of Tourist Guides held by the Ministry of Tourism
Email: info@guidaturisticaperfirenze.com
Telephone: +39 338 170 5461
For any request concerning the processing of personal data or the exercise of rights under the GDPR, users may contact the Data Controller using the email address indicated above.
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed through the website and during subsequent communications with users via:
- contact forms;
- email;
- telephone;
- WhatsApp;
- other channels used by users to request information or arrange a guided tour.
This Privacy Policy does not apply to external websites, platforms or services that may be accessed through links published on the website.
3. Types of personal data processed
3.1 Data voluntarily provided by users
When users complete a form, send an email, make a telephone call or contact the Data Controller through WhatsApp, the following data may be collected:
- first name and surname;
- email address;
- telephone number;
- nationality or preferred language;
- requested date or period of the visit;
- number and composition of participants;
- information about requested itineraries, museums or places;
- organisational requirements communicated by the user;
- content of the request and correspondence;
- information required to prepare quotations, confirmations, receipts or invoices;
- any other information voluntarily provided by the user.
Users are requested not to provide unnecessary personal data and, in particular, information concerning health, religious beliefs or other special categories of personal data, unless strictly necessary for the organisation of the requested service.
3.2 Browsing data
During normal browsing, the IT systems and services used by the website may automatically collect certain information, including:
- IP address;
- device type;
- browser type and version;
- operating system;
- pages visited;
- date and time of the visit;
- time spent on individual pages;
- approximate geographical location;
- referring website or page;
- interactions with the website;
- technical, error and security data.
These data are processed to ensure the operation and security of the website, prevent misuse, obtain aggregated statistics and improve the content and services offered.
3.3 Cookies and tracking technologies
The website uses technical cookies and, subject to the user’s consent, may use cookies or similar technologies for statistical and advertising purposes.
Detailed information about the cookies used, their duration and the methods available to change or withdraw consent is provided in the website’s Cookie Policy and in the cookie preferences panel.
4. Purposes and legal bases of processing
4.1 Operation and security of the website
Browsing data and technical logs are processed to:
- display the website correctly;
- ensure its security;
- prevent unauthorised access, spam and fraudulent activity;
- identify technical problems;
- ensure continuity of service.
The legal basis is the Data Controller’s legitimate interest in ensuring the security, proper management and operation of the website, pursuant to Article 6(1)(f) of the GDPR.
4.2 Responding to requests for information
Data submitted through the contact form, by email, telephone or WhatsApp are processed to:
- answer users’ questions;
- check availability;
- provide information about guided tours;
- propose itineraries or services;
- prepare a quotation;
- contact the user in relation to the request.
The legal basis is the performance of pre-contractual measures taken at the user’s request, pursuant to Article 6(1)(b) of the GDPR.
Specific consent is not required for these purposes, as the processing is necessary to respond to the user’s request.
4.3 Organisation and provision of guided tours
When a user confirms a guided tour or another service, personal data are processed to:
- organise the requested service;
- agree on the date, time, meeting point and itinerary;
- manage communications with museums, cultural institutions or other parties involved;
- provide information about admission tickets;
- communicate organisational changes;
- provide the agreed service;
- manage subsequent requests, complaints or disputes.
The legal basis is the performance of a contract or pre-contractual measures requested by the user, pursuant to Article 6(1)(b) of the GDPR.
4.4 Administrative, accounting and tax obligations
Personal data may be processed to:
- issue receipts or invoices;
- maintain accounting records;
- manage payments;
- comply with tax requirements;
- fulfil legal obligations;
- respond to requests from competent authorities.
The legal basis is compliance with legal obligations to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR.
4.5 Protection of the Data Controller’s rights
Personal data may be stored and used where necessary to:
- establish, exercise or defend a legal claim;
- manage disputes;
- prevent fraud or unlawful conduct;
- recover outstanding payments;
- respond to requests from public authorities.
The legal basis is the legitimate interest of the Data Controller in protecting her rights, pursuant to Article 6(1)(f) of the GDPR.
4.6 Website usage statistics
Subject to the consent given through the cookie banner, the website uses statistical tools, including Google Analytics 4, to understand:
- how many people visit the website;
- which pages are viewed;
- how users reach the website;
- which devices and browsers are used;
- how content, navigation and services can be improved.
The legal basis is the user’s consent, pursuant to Article 6(1)(a) of the GDPR.
Consent may be withheld or withdrawn at any time through the cookie preferences panel.
4.7 Measurement of advertising campaigns
Subject to the user’s consent, the website may use Google Ads tools to measure actions carried out after viewing or clicking on an advertisement, such as submitting a contact request.
The legal basis is the user’s consent, pursuant to Article 6(1)(a) of the GDPR.
Refusing advertising cookies does not prevent users from browsing the website or submitting a request.
4.8 Promotional communications
Contact details are not used to send newsletters or recurring promotional communications without the user’s specific consent.
Should a newsletter service be introduced in the future, users will be asked to provide optional, specific and separate consent, which may be withdrawn at any time.
Communications strictly connected with a request or an agreed service are not considered promotional communications.
5. Nature of data provision
Providing the data marked as mandatory in the forms is necessary in order to respond to the user’s request.
Failure to provide a name, email address or essential information about the request may make it impossible to provide an answer or prepare a proposal.
The telephone number should be mandatory only where it is genuinely necessary to manage the requested service. In all other cases, it may be provided voluntarily.
Providing data for statistical or advertising purposes is optional and depends on the preferences expressed through the cookie banner.
6. Methods of processing
Personal data are processed mainly by electronic and digital means.
The Data Controller adopts appropriate technical and organisational measures to protect personal data against:
- unauthorised access;
- loss;
- destruction;
- alteration;
- disclosure;
- unlawful or improper use.
Access to personal data is limited to persons and service providers who genuinely need such access to perform the activities described in this Privacy Policy.
7. Data retention periods
Personal data are retained for different periods depending on the purpose of the processing.
Requests not followed by a booking
Data relating to requests for information that do not result in confirmation of a service are retained for the time necessary to manage the request and, as a general rule, for no longer than 12 months from the last communication.
A longer retention period may apply where necessary to manage disputes or subsequent requests from the user.
Confirmed services and contractual relationships
Data relating to confirmed guided tours and services are retained for the duration of the relationship and subsequently for the period required to protect the Data Controller’s rights.
Tax and accounting documentation
Data contained in receipts, invoices and administrative documents are retained for the period required by tax and accounting legislation, generally 10 years.
Email and WhatsApp communications
Communications are retained for the time necessary to manage the request or service and may be periodically deleted or archived when no longer required.
Browsing data and cookies
The retention periods applicable to technical data, cookies and identifiers used by external services are indicated in the Cookie Policy and cookie preferences panel.
Legal disputes
In the event of a dispute or legal proceeding, personal data may be retained until the proceedings have been concluded and the applicable limitation periods have expired.
8. Recipients of personal data
Personal data may be disclosed, within the limits strictly necessary, to parties acting on behalf of the Data Controller or providing services required to manage the website and professional activity, including:
- hosting and IT infrastructure providers;
- website maintenance and technical support providers;
- email service providers;
- contact form and anti-spam service providers;
- statistical and advertising service providers;
- tax, accounting and legal advisers;
- payment service providers;
- museums, cultural institutions, other tourist guides or collaborators involved in organising the service;
- public authorities, where required by law.
Where required, service providers processing data on behalf of the Data Controller are appointed as processors pursuant to Article 28 of the GDPR.
Personal data are not disseminated or sold to third parties.
9. Main services used by the website
SiteGround
The website is hosted on SiteGround infrastructure. The provider may process technical data, logs, IP addresses and data stored on the website in order to provide hosting, security and backup services.
WordPress and Gravity Forms
The website is built using WordPress. Data submitted through contact forms may be stored in the website database and sent to the Data Controller by email.
Google reCAPTCHA
The forms may be protected using Google reCAPTCHA, which is used to distinguish human requests from automated requests and to prevent spam and abuse.
The service may collect technical information about the user’s device, browser and interactions.
Google Analytics 4
Subject to the user’s consent, Google Analytics 4 is used to produce statistics concerning use of the website.
Google Tag Manager
Google Tag Manager is used to manage the activation of statistical and advertising tools. Its use must comply with the preferences expressed by users through the cookie banner.
Google Ads
Subject to consent, Google Ads may be used to measure conversions and assess the effectiveness of advertising campaigns.
When users follow the WhatsApp link or send a message, their data are also processed through services provided by WhatsApp and Meta.
WhatsApp and Meta process personal data in accordance with their respective privacy policies and may act as independent data controllers for processing activities falling within their responsibility.
Social networks and external platforms
The website contains links to pages or profiles on external platforms, including Facebook and Instagram.
When users open one of these links, they access an external service governed by the terms and privacy policy of the relevant provider.
Reviews and external content
The website may display reviews or other content originating from external platforms.
Where such content is loaded directly from the platform’s servers, it must be activated in accordance with the cookie preferences expressed by the user.
10. Transfers outside the European Economic Area
Some IT, statistical, advertising or communication service providers may process personal data in countries outside the European Economic Area.
In such cases, data transfers are carried out in accordance with Chapter V of the GDPR and on the basis of one of the safeguards provided by applicable legislation, including:
- adequacy decisions adopted by the European Commission;
- Standard Contractual Clauses;
- other safeguards permitted under applicable data protection legislation.
Users may request further information by contacting the Data Controller.
11. Automated decision-making
Personal data collected through the website are not used to make decisions based solely on automated processing that produce legal effects or similarly significantly affect the user.
Statistical and advertising tools may create aggregated segments or assessments relating to browsing behaviour, but the Data Controller does not use this information to make automated decisions concerning individual users.
12. Rights of data subjects
Users may exercise the rights provided for by Articles 15 to 22 of the GDPR and, in particular, may request:
- confirmation as to whether their personal data are being processed;
- access to their personal data;
- rectification of inaccurate data;
- completion of incomplete data;
- erasure of data, where the applicable requirements are met;
- restriction of processing;
- data portability, where applicable;
- objection to processing based on legitimate interests;
- withdrawal of consent previously given;
- information about the recipients to whom personal data have been disclosed.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Requests may be sent to:
info@guidaturisticaperfirenze.com
The Data Controller will respond within the periods established by applicable legislation, subject to any permitted extension in the case of particularly complex or numerous requests.
13. Right to lodge a complaint
Users who believe that their personal data are being processed in breach of applicable legislation may lodge a complaint with the:
Italian Data Protection Authority — Garante per la protezione dei dati personali
This is without prejudice to the user’s right to seek a judicial remedy before the competent courts.
14. Children’s data
The website and professional services are primarily intended for adults requesting information or arranging guided tours for themselves, their family or a group.
Information concerning children or young participants must be provided exclusively by a person exercising parental responsibility or by an authorised adult and only to the extent necessary to organise the service.
15. Links to external websites
The website may contain links to museums, institutions, accommodation providers, restaurants, social networks and other external websites.
The Data Controller does not control how these third parties process personal data. Users are therefore encouraged to read the relevant privacy policies before using their services.
16. Changes to this Privacy Policy
This Privacy Policy may be amended to:
- comply with changes in legislation;
- update the services used by the website;
- change the methods of processing;
- introduce new features.
The updated version will be published on this page together with the date of the latest update.
In the event of significant changes, a specific notice may be displayed on the website.
17. Contact details
For information concerning the processing of personal data or to exercise data protection rights:
Giulia Bacci Tirinnanzi
Email: info@guidaturisticaperfirenze.com
Telephone: +39 338 170 5461