Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679

Last updated: 4 August 2026

 

1. Data Controller

The Data Controller responsible for the processing of personal data collected through the website www.olekayak.it is:

Olè Kayak di Carlo Coni
VAT number: 04015460928
Registered office: Via Rockfeller 35, 09126 Cagliari, Italy
Email: info@olekayak.com
Telephone: +39 347 828 1145

The Data Controller determines the purposes and methods of the personal data processing carried out through the website.

 

2. Categories of Personal Data Processed

The following categories of personal data may be processed through the website.

2.1 Browsing Data

The IT systems and software procedures used to operate the website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

This data may include:

• IP address;

• browser and device type;

• operating system;

• date and time of the request;

• pages visited;

• referring page address;

• technical information relating to website navigation;

• logs relating to the operation and security of the website.

This information is normally processed in aggregate form or, in any event, is not used by the Data Controller to directly identify users, unless this is necessary to establish liability in the event of cybercrime, fraud or attacks against the website.

2.2 Data Provided Through Forms

When users submit a contact form, information request or booking form, the following personal data may be collected:

• first name and surname;

• email address;

• telephone number;

• nationality or preferred language of communication;

• requested date or period of the excursion;

• number and characteristics of participants;

• kayaking experience level;

• tour or service of interest;

• content of the request;

• any additional information voluntarily provided by the user.

Fields marked as mandatory are necessary to allow the Data Controller to respond to the request or manage the booking.

Users are requested not to enter irrelevant personal data or health-related information in free-text fields unless such information is strictly necessary for the safety of the activity and has been expressly requested by the Data Controller.

2.3 Data Communicated by Email, Telephone or WhatsApp

When users contact Olè Kayak by email, telephone or WhatsApp, the following data may be processed:

• identification data;

• contact details;

• any visible profile image;

• content of messages;

• attached files, photographs or documents;

• date and time of communications;

• information required to respond to the request or provide the service.

Communications made through WhatsApp are also subject to the terms and privacy policy of the relevant service provider.

2.4 Data Collected Through Cookies and Tracking Technologies

The website may use technical cookies and, subject to the user’s consent, statistical tools or external services such as Google Analytics, Google Maps and YouTube.

Further information is available in the website’s Cookie Policy and in the cookie preference management panel.

 

3. Purposes and Legal Bases of Processing

Personal data may be processed for the following purposes.

3.1 Website Operation and Security

Browsing data and technical logs are processed in order to:

• enable the website to operate correctly;

• ensure system security;

• prevent unauthorised access, cyberattacks, fraud and spam;

• identify and resolve technical issues;

• protect the rights of the Data Controller and website users.

The legal basis for this processing is the Data Controller’s legitimate interest in ensuring the operation and security of the website, pursuant to Article 6(1)(f) of the GDPR.

3.2 Responding to Contact Requests

Data provided by users is processed to respond to requests for information concerning excursions, courses, events and other services offered by Olè Kayak.

The legal basis is the performance of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR.

3.3 Managing Bookings and Services

Personal data is processed in order to:

• verify availability;

• organise excursions;

• manage bookings;

• provide information relating to meeting arrangements;

• manage changes, cancellations or special requests;

• fulfil obligations arising from the contractual relationship;

• manage payments, invoicing and administrative documentation.

The legal basis is the performance of a contract or pre-contractual measures, pursuant to Article 6(1)(b) of the GDPR.

3.4 Administrative, Tax and Legal Obligations

Personal data may be processed to comply with obligations arising from applicable laws, regulations, tax and accounting legislation or instructions issued by competent authorities.

The legal basis is compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) of the GDPR.

3.5 Establishment, Exercise or Defence of Legal Claims

Personal data may be used to establish, exercise or defend the Data Controller’s rights in judicial or out-of-court proceedings and to manage disputes, compensation claims or legal proceedings.

The legal basis is the Data Controller’s legitimate interest in protecting its rights, pursuant to Article 6(1)(f) of the GDPR.

3.6 Website Analytics

Subject to the user’s consent, the website may use Google Analytics or similar tools to collect statistical information concerning the use of the website, including pages visited, session duration, approximate origin of visits, device type and interactions with content.

The legal basis is the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR.

Consent may be withdrawn at any time through the “Cookie Preferences” panel, without affecting the lawfulness of processing carried out before the withdrawal.

3.7 Displaying External Content

Subject to the user’s consent, the website may activate content provided by third parties, including:

• Google Maps;

• embedded YouTube videos;

• content or widgets provided by social networks.

Activating such content may result in technical data, including the user’s IP address, device information and details of the page visited, being communicated to third parties.

The legal basis is the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR.

3.8 Form Protection Through reCAPTCHA

The website may use Google reCAPTCHA to distinguish genuine users from automated systems and to protect forms against spam, misuse and fraudulent submissions.

Processing that is strictly necessary to protect the website is based on the Data Controller’s legitimate interest, pursuant to Article 6(1)(f) of the GDPR.

Where the configuration used involves cookies or tracking technologies that are not strictly necessary, such components are activated only after obtaining the user’s consent.

 

4. Nature of the Provision of Personal Data

Providing data marked as mandatory in the forms is necessary to allow the Data Controller to respond to the user’s request or manage a booking.

Failure to provide mandatory data may make it impossible to provide the requested service.

Providing data for statistical purposes or for the activation of external content is optional. Refusal to provide consent does not prevent normal website browsing, although the user may be unable to view or use the specific third-party content or service.

 

5. Processing Methods and Security Measures

Personal data is processed using electronic, telematic and, where necessary, paper-based tools.

The Data Controller adopts technical and organisational measures appropriate to the level of risk in order to:

• prevent unauthorised access;

• prevent unlawful loss, destruction or alteration of data;

• protect communications and IT systems;

• restrict access to personal data to authorised persons only;

• ensure the confidentiality, integrity and availability of personal data.

Despite the adoption of appropriate measures, no IT system or Internet transmission can be considered entirely free from risk.

 

6. Recipients of Personal Data

Personal data may be disclosed, where strictly necessary, to the following categories of recipients:

• personnel and collaborators authorised by the Data Controller;

• the website hosting provider;

• parties responsible for website administration and maintenance;

• email and communication service providers;

• contact or booking form providers;

• tax, administrative, legal or insurance advisers;

• payment service providers, where online payments are activated;

• Google and other providers of statistical, technical or multimedia services;

• WhatsApp and social network operators when users access the relevant links or services;

• public authorities, law enforcement agencies or other parties where disclosure is required by law.

Service providers processing personal data on behalf of the Data Controller are appointed, where required, as data processors pursuant to Article 28 of the GDPR.

Certain providers may process personal data as independent data controllers in accordance with their own privacy policies.

Personal data is not publicly disclosed or sold to third parties.

 

7. Transfers Outside the European Economic Area

The use of services provided by Google, WhatsApp, Meta or other international providers may involve the transfer of or access to personal data from countries outside the European Economic Area.

Depending on the provider and the country concerned, transfers may take place on the basis of:

• an adequacy decision adopted by the European Commission;

• the recipient’s participation in the EU–US Data Privacy Framework, where applicable;

• standard contractual clauses approved by the European Commission;

• additional safeguards provided for under Articles 46 and following of the GDPR.

Users may request further information concerning the safeguards adopted by contacting info@olekayak.com.

 

8. Retention Periods

Personal data is retained according to the following criteria:

• browsing data and technical logs: for the period required for the operation and security of the website, generally no longer than 90 days, unless longer retention is necessary to investigate unlawful conduct or security incidents;

• information requests not followed by a booking: for a maximum period of 24 months after the request has been completed;

• booking and contractual data: for the duration of the relationship and subsequently for the period required under civil, tax and accounting legislation, normally 10 years;

• email and WhatsApp communications: for the period required to manage the request or relationship and subsequently in accordance with the retention periods applicable to contractual documentation;

• data processed on the basis of consent: until consent is withdrawn or until the retention period established for the relevant tool expires;

• statistical data: according to the retention settings of the service used and in compliance with the principle of data minimisation;

• data required for legal claims: until the dispute has been concluded and the relevant limitation periods have expired.

At the end of the applicable retention periods, personal data is erased, anonymised or made no longer directly identifiable.

 

9. Google Analytics

The website may use Google Analytics 4, a web analytics service provided by Google, to obtain statistics concerning the use of the website.

Google Analytics may collect information concerning:

• pages visited;

• frequency and duration of visits;

• interactions with the website;

• browser and device type;

• operating system;

• approximate geographical area;

• online identifiers and statistical cookies.

The service is activated only after the user has provided consent, unless a configuration is adopted that fully complies with the requirements applicable to statistical tools treated as equivalent to technical cookies.

The Data Controller does not intentionally use Google Analytics to collect directly identifiable data entered into contact or booking forms.

Users may refuse or withdraw consent through the cookie management panel.

 

10. Google Maps

Certain pages may contain maps embedded through Google Maps to display meeting points or other locations connected with the excursions.

Before the map is activated, Google may receive technical information concerning the user only if the relevant service is loaded.

The map should therefore remain blocked until consent is obtained and should be replaced by a notice or static element.

Once activated, Google may collect information concerning the user’s device, IP address and interaction with the map, in accordance with Google’s terms and privacy policy.

 

11. YouTube

The website may embed videos hosted on YouTube.

Videos should be blocked before the user provides consent or, where possible, configured using YouTube’s privacy-enhanced mode.

When users authorise the display of or interact with a video, Google and YouTube may receive information relating to the device, IP address, page visited and interaction with the content.

Where users are signed in to their Google account, the activity may be associated with their profile in accordance with their account settings and Google’s privacy policy.

 

12. WhatsApp and Social Network Links

The website may contain buttons or links to WhatsApp, Facebook, Instagram, YouTube or other social networks.

Where these are simple links, no data is communicated to the relevant platform until the user selects the button.

After clicking the link, the user is redirected to an external service, which processes personal data in accordance with its own terms and privacy policies.

Where widgets, feeds, interactive buttons or other embedded content are used, such elements must be blocked before consent is obtained where they may result in user tracking.

 

13. Children’s Personal Data

The website’s booking services are intended for adults.

Bookings involving minors must be made by a parent, legal guardian or another authorised adult.

The Data Controller does not intend to directly collect personal data relating to children under the age of 14 through the website without the involvement or authorisation of a person holding parental responsibility.

Where the Data Controller becomes aware that a child’s personal data has been collected without authorisation, it will take appropriate measures to erase it.

 

14. Automated Decision-Making

The Data Controller does not use personal data collected through the website to make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

 

15. Data Subject Rights

Where provided for under the GDPR, data subjects may exercise the following rights:

• obtain confirmation as to whether or not their personal data is being processed;

• obtain access to their personal data;

• request the rectification of inaccurate data or completion of incomplete data;

• request the erasure of personal data;

• request the restriction of processing;

• object to processing based on legitimate interests;

• receive personal data in a structured, commonly used and machine-readable format, where applicable;

• request the transmission of personal data to another controller, where technically feasible;

• withdraw consent at any time;

• obtain information concerning safeguards applied to international transfers;

• lodge a complaint with a supervisory authority.

Requests may be sent to:

info@olekayak.com

The Data Controller will respond within the time limits established by applicable legislation.

 

16. Complaints to the Supervisory Authority

Data subjects who believe that their personal data is being processed in breach of applicable legislation may lodge a complaint with:

The Italian Data Protection Authority — Garante per la protezione dei dati personali

The right to bring proceedings before the competent courts remains unaffected.

 

17. Links to External Websites

The website may contain links to websites or platforms managed by third parties.

The Data Controller does not control how such third parties process personal data and is not responsible for the content, security or privacy policies of external websites.

Users are encouraged to review the privacy policies of the relevant providers before using their services.

 

18. Changes to This Privacy Policy

The Data Controller may amend or update this Privacy Policy to reflect changes in legislation, technology or organisational arrangements.

The updated version will be published on the website together with the date of the latest update.

Where significant changes are made, the Data Controller may provide a specific notice through the website.