Privacy Policy

Privacy notice — processing of personal data

Gullo Tours srls

Via Gabbiano 4, Assisi (PG), Italy

Office hours: Monday – Friday, 9:00am – 5:00pm, Rome time

Email: privacy@gullotours.com

At Gullo Tours we are committed to protecting the privacy and personal information of our travellers and of visitors to our website. We do not sell your personal information. This notice applies only to the Gullo Tours website and not to any separate website we may link to; those sites have their own privacy notices, and we encourage you to read them before giving them any personal information.

Please read this notice carefully, and keep a copy of it and of future versions for your records.

Who we are, and how to contact us

The data controller is Gullo Tours srls, Via Gabbiano 4, Assisi (PG), Italy. You can contact us about anything in this notice at privacy@gullotours.com. We process your personal data under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003.

How we collect or obtain information about you

Cookies

This website uses a small number of cookies. A cookie is a small data file a website writes to your browser when you visit it.

We use only strictly necessary cookies — which keep you signed in, protect the site against abuse and record your cookie choices — and functional cookies, which remember preferences such as your language, country and currency. Strictly necessary cookies do not require your consent; functional cookies are set only after you allow them.

Once you have registered, a cookie lets us recognise your browser so that on your next visit from the same browser you can continue to request information or download Detailed Itineraries without entering your login details again. If your browser is not set to accept cookies, if you are browsing from a different device, or if enough time has passed since your last visit, you will be asked to sign in again.

Most browsers let you change your settings to be notified when you receive a cookie, or to refuse cookies entirely. If you refuse our cookies, some features of the site may not work.

We do not currently use analytics, advertising or tracking cookies, and we do not run Google Analytics, Meta Pixel, Google Ads or any similar tool. The complete and current list of the cookies this site sets — with vendor, purpose and duration — is published in our Cookie Policy at /en/cookie-policy, and that list is the authoritative one. If we ever introduce analytics or advertising tools, we will update this notice and the Cookie Policy and ask for your consent before setting those cookies.

We do not sell or share your personal information as those terms are used in California law, and we do not disclose it to third parties for cross-context behavioural advertising.

Personal information you disclose to us

We collect personal information about you when you provide it through an online form or by contacting us directly: requesting our annual Catalog of Adventures, subscribing to our eNewsletter, downloading a Detailed Itinerary, requesting a reservation, or contacting us with questions by email, telephone or in writing.

The information we collect through a form may include:

- your name

- your email address

- your postal address

- your telephone number

- information about your device (for example your IP address and browser type)

- information about how you use our website (for example which pages you have viewed)

If you request a reservation, we will ask you to complete a Trip Application form, which asks for:

- date of birth

- emergency contact details

- passport information

- health conditions

- dietary requirements

- arrival and departure details

- a signed Release of Liability and Assumption of Risk Agreement

Information collected automatically

We collect certain information automatically when you visit or use our website: your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, information about how and when you use the site, and other technical data.

This information does not usually identify you directly, but it is still personal data, and we treat it as such. We need it to keep the site secure and working, and for our internal analysis and reporting.

Information collected from other sources

We may also obtain personal information about you from publicly accessible sources, including online customer databases, business directories, media publications, social media and websites.

What we obtain from those sources is generally your name and contact details, but may include any additional information they provide, including the categories listed above.

Where we obtain personal information about you from a source other than yourself, we are not required to give you certain information contained in this notice if: you already have it; providing it would be impossible or would involve disproportionate effort; we are under an EU or Member State law obligation to obtain or disclose the information, and that law provides appropriate measures to protect your legitimate interests; or we must keep the information confidential because of a professional secrecy obligation under EU or Member State law.

How we use this information

For travellers who book a trip, we share the information with the service providers who look after you during your tour. For visitors to our website, we use it to support and improve your use of the site and its features, including pre-filling forms and keeping track of the trips on your wish list.

We work with a number of companies that provide services necessary to run our business: mail houses, which verify names and addresses, calculate postage and handle shipping; email distributors, which send our eNewsletter and process unsubscribe requests; airlines, to book any internal flights required; and payment processors. We give these companies only the information they need to perform their service, and we work only with reputable providers. Except for airlines, these companies are contractually prohibited from using the information for their own purposes or sharing it with anyone other than Gullo Tours.

If you choose to receive our eNewsletter, we will email you from time to time about new trips, special offers and information we think will interest you. You can unsubscribe at any time using the link at the bottom of any such email, or by writing to info@gullotours.com; we will remove you from the list immediately. You can also change your email preferences to receive no more than one marketing email per month.

We send print mailings only where we believe they will interest you. You can opt out of print mailings entirely by writing to info@gullotours.com.

We are not responsible for personal information you choose to post on our blog or in any other publicly accessible area of the site, including where you use a social feature — such as Facebook, Instagram or Pinterest — to like or share content elsewhere.

We may disclose information to the competent authorities where we reasonably believe this is necessary to comply with the law, to protect the property or safety of Gullo Tours or of its staff, agents or users, or to protect the integrity of our site and data.

We do not sell your personal data. If our business, or part of it, is transferred to another company — through a merger, a sale of assets, financing, an acquisition, or in the unlikely event of insolvency or bankruptcy proceedings — your personal data may transfer with it as part of that business. In that case the recipient will remain bound by this notice, or will give you a new one before processing your data differently, and we will tell you before the transfer takes effect wherever the law allows us to.

Health and medical information

Because we operate trips in remote, high-altitude and wilderness environments where access to emergency medical care may be limited, we collect certain health information from participants who book a trip with us. This information is essential for your safety and for running the trip responsibly.

What we collect

- existing medical conditions, diagnoses or chronic illnesses

- physical limitations or disabilities that may affect participation

- current prescription medication

- allergies (food, environmental or medication)

- recent surgery, hospitalization or medical procedures

- mental health considerations relevant to travel in remote areas

- any other health information you give us on the Trip Application or the Medical Form

Why we collect it

- to assess whether a particular trip is appropriate for your health and fitness

- to plan emergency response and evacuation logistics

- to enable trip leaders and staff to respond appropriately in a medical emergency

- to pass relevant safety information to qualified medical personnel on the trip

- to meet the insurance requirements that apply to high-risk or expedition travel

We do not use health information for marketing, for profiling, or for any commercial purpose.

The legal basis for health information

Health data is a special category of personal data under art. 9 of the GDPR, and needs its own legal basis.

We process it on the basis of your explicit consent (art. 9(2)(a) GDPR), which you give separately, on the Medical Form — not by booking, and not by accepting this notice. You may withdraw that consent at any time by writing to dpa@gullotours.com. Withdrawal does not affect processing carried out before it, but it may mean we can no longer carry you safely on a trip that depends on that information; in that case we will discuss the options with you, and our booking conditions will apply.

In an emergency, where you are physically or legally incapable of giving consent, we may process health information to protect your vital interests or those of another person (art. 9(2)(c) GDPR).

This information is required for participation

Completing the Medical Form is a condition of participation. This is not a penalty: without it we cannot assess whether a trip is safe for you, or plan an emergency response.

If you do not provide accurate and complete health information, we may be unable to accept or maintain your booking — in which case our standard cancellation terms apply — and incomplete information may increase the risk of harm to you or to other participants.

Who we share it with

Health information is shared strictly on a need-to-know basis and only for safety and operational purposes. Depending on your trip, we may share relevant health information with:

- Gullo Tours trip leaders and operational staff

- local guides and in-country ground operators, where necessary for your safety

- licensed medical professionals and other health providers

- emergency evacuation services and medical facilities, in an emergency

- travel insurance providers, where necessary for a claim or an evacuation

We do not sell health information. We contractually require third parties who receive it to use it only for the purposes for which it was shared.

Reviewing and updating your personal information

If you wish to see your information, we will make good-faith efforts to give you access to it and to correct it if it is inaccurate, or to delete it at your request, unless we are required to keep it by law or for legitimate business purposes. We may need certain information to verify the identity of the person making the request. Write to us at privacy@gullotours.com.

Legal basis for processing

Performance of a contract — processing necessary to fulfill your booking and provide the travel services you have requested, including sharing information with trip leaders, local operators and service providers.

Legitimate interests — processing necessary for our legitimate business interests, such as improving our services, communicating with you about your trip, keeping the site secure and maintaining safety standards, where those interests are not overridden by your rights. You may object to this processing at any time.

Legal obligation — processing necessary to comply with the law, such as keeping accounting and tax records or co-operating with the authorities.

Consent — where we rely on your consent, for example for marketing communications, for functional cookies, and for health information. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Vital interests — in an emergency, to protect your vital interests or those of another person.

Automated decision-making

We do not make decisions about you based solely on automated processing, and we do not profile you in a way that produces legal effects or similarly significantly affects you.

Your rights under the GDPR

• Access — you may ask us for information about how we process your personal data, and for a copy of the data we hold about you.
• Rectification — you may ask us to correct or update inaccurate data.
• Erasure — you may ask us to delete your personal data.
• Portability — you may ask us to give you, or another controller, a copy of your data in a structured, commonly used, machine-readable format.
• Restriction — you may ask us to restrict our processing in certain circumstances.
• Objection — you may object to processing we carry out on the basis of our legitimate interests.
• Withdrawal of consent — you may withdraw any consent you have given, at any time.
• Direct marketing — you may ask us at any time to stop sending you marketing communications, free of charge.
• To exercise any of these rights, write to privacy@gullotours.com.

International data transfers

We are based in Italy, and our servers are located in the European Economic Area.

To provide the travel services you have booked, your personal data — including health information — is transferred to the countries where your trip operates, and to the local guides, ground operators, accommodation providers and emergency services there. Some of those countries are outside the EEA and are not covered by an adequacy decision of the European Commission; their data protection laws may be less protective than European law, and we cannot promise otherwise.

Where such a transfer takes place we rely on:

- Standard Contractual Clauses approved by the European Commission (art. 46(2)(c) GDPR), where we can put them in place with the recipient; or, where we cannot,

- art. 49(1)(b) GDPR — the transfer is necessary to perform the contract you have entered into with us; and

- art. 49(1)(f) GDPR — in an emergency, where the transfer is necessary to protect your vital interests or those of another person.

If you are visiting our website from outside Italy, you are sending information to servers in the European Economic Area, and it will be handled in accordance with this notice wherever it travels.

Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

How long we keep your data

We keep your personal data only as long as we need it, and for different periods depending on why we hold it:

- Enquiries that do not become bookings — [24 months] from your last contact with us.

- Booking and trip data — for the duration of your trip and of the contract.

- Accounting, tax and invoicing records — 10 years, as required by Italian law (art. 2220 of the Civil Code and tax rules).

- Health and medical information — deleted within [30 days] of the end of your trip, unless it is needed for an insurance claim, an incident report or a legal claim, in which case we keep it until that matter is closed. We do not keep health data for ten years.

- Marketing data — until you withdraw your consent or object; we keep a record of the withdrawal itself so that we can honour it.

- Website and server logs — [90 days], for security purposes.

After these periods we delete or anonymize the data, unless the law requires us to keep it longer.

Children's privacy

This website is not directed at people under 18, and we do not knowingly collect personal data from a child through the site. Under Italian law, information society services may be offered directly to a child from the age of 14; below that age, consent must be given or authorised by the holder of parental responsibility (art. 2-quinquies of Legislative Decree 196/2003).

If we learn that we have collected a child's personal data through the site without the consent required, we will delete it promptly.

We do collect information about travellers under 18 — name and contact details, date of birth, passport data, and health and dietary information — but we collect it from the parent or legal guardian, who books the trip and travels with the minor. We use it only to operate that minor's trip.

Parents should be aware that parental control tools are available online to prevent children from submitting information without permission.

Contact and complaints

To exercise your rights or make a complaint, write to privacy@gullotours.com.

We will respond without undue delay and in any event within one month of receiving your request. Where a request is complex, or where you have made several requests, we may extend that period by up to two further months, and we will tell you within the first month if we do (art. 12(3) GDPR).

If you are not satisfied with our response, you have the right to lodge a complaint with the Italian supervisory authority:

Garante per la protezione dei dati personali — Piazza Venezia 11, 00187 Roma, Italy · protocollo@gpdp.it · certified email protocollo@pec.gpdp.it · +39 06 696771 · www.garanteprivacy.it

If you live in another EU or EEA country, you may also complain to the supervisory authority where you live or where the alleged infringement took place.

Changes to this notice

We may need to revise this notice from time to time. When we do, the revised version will be published on our website with its version number and the date it takes effect, and earlier versions remain on record. Please check this page for the most recent information about how we handle personal data.

If you have any questions about this notice, write to privacy@gullotours.com.

Acknowledgment

By proceeding with your booking you confirm that you have read and understood this notice.

Most of the processing described here does not rely on your consent — it is necessary to perform your contract, or required by law — so proceeding with a booking is not, and cannot be, a consent to all of it. Where we do rely on consent, we ask for it separately: on the Medical Form for health information, in the cookie banner for functional cookies, and at sign-up for marketing.