Information on the processing of personal data under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 27 September 2026.
1. Data controller
The data controller is CLIFF S.A.S. di Stefano Filauro, trading as Yak & Yeti, Tour4You and Abruzzo Incoming.
- Registered office: Via Calvario 19, 67028 San Demetrio ne’ Vestini (AQ), Italy
- Operational office: Corso Federico II 16, 67100 L’Aquila, Italy
- VAT number and tax code: 01525860662 – REA AQ-100486
- Email: booking@abruzzoincoming.it – Certified email (PEC): cliffsas@pec.it – Phone: +39 0862 406000
The controller has not appointed a Data Protection Officer (DPO), as it is not required to. For any request concerning personal data you can write to the addresses above.
2. Who this policy applies to
This policy covers the personal data processed through the website abruzzoincoming.com (“the website”): visitors, people who book a tour, a stay or another service, people who create an account, send an enquiry or subscribe to the newsletter. It also covers the people travelling with the person who books, whose data the customer provides at the time of booking.
3. What data we process, why and on which legal basis
3.1 Bookings and purchases
When you book a tour, a stay or a service we collect: first and last name, email address, phone number, billing address, the booked service with dates and number of participants, the chosen payment method and, if you buy as a business, company name and VAT number.
For each traveller we also ask for their full name, date of birth and identity document number. These are needed for the legal obligations of accommodation providers (reporting of guests to the public security authorities, Article 109 of the Italian Public Security Act), for the insurance cover linked to the trip and for organising the booked services. Whoever enters the data of other travellers confirms that they have informed them of this policy.
Legal basis: performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations, in particular tax and public security rules (Art. 6(1)(c) GDPR).
3.2 Payments
Payments by card, Klarna, Amazon Pay and Link are handled by Stripe: card details are entered in a Stripe form and never pass through or are stored on our systems. We only receive from Stripe the outcome of the payment and a transaction identifier. Stripe processes the data as an independent controller for fraud prevention; its policy is available at stripe.com/privacy. If you choose a bank transfer, we receive the data shown in the payment order.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legal obligations (Art. 6(1)(c) GDPR).
3.3 User account
You can create an account to manage your bookings and avoid re-entering your details at every purchase. We keep your username, email, password (encrypted), billing details and order history. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
3.4 Enquiries and contact form
The enquiry forms on tours and hotels and the contact form collect your name, email, phone number if provided and the text of your message. Enquiries about services are saved in the website’s management system; contact form messages reach us by email. Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).
3.5 Newsletter
When you subscribe we collect your email address, the date and time of the subscription and the consent given, in order to send you news about our travel offers. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us or using the link in every message.
3.6 Browsing the website
The systems that run the website automatically record some technical data: IP address, date and time of the request, page requested, browser type and operating system. They are used to deliver the service, keep it secure and detect abuse, and are not used to identify you. Legal basis: legitimate interest in the security and proper functioning of the website (Art. 6(1)(f) GDPR).
The website does not use analytics tools or advertising pixels. For cookies and similar technologies see the Cookie Policy, where you can also change your consent choices.
3.7 Maps
On the contact page and on hotel pages we use Google Maps: the map loads only after you consent to marketing cookies and, from that moment, Google receives your IP address and may set its own cookies (Google’s privacy policy). Maps on tour pages use OpenStreetMap: your browser requests the map images from the servers of the OpenStreetMap Foundation, which receives your IP address (OSMF privacy policy). Legal basis: consent for Google Maps (Art. 6(1)(a) GDPR); legitimate interest in showing tour locations for OpenStreetMap (Art. 6(1)(f) GDPR).
4. Is providing data mandatory?
The data marked as required in the forms are necessary to provide the requested service: without them we cannot confirm a booking or reply. Consent to the newsletter and to non-essential cookies is optional and does not affect the other services.
5. Recipients of the data
To carry out bookings we share the necessary data with:
- the accommodation providers, guides and suppliers of the services included in your booking (transport, catering, activities), limited to the data needed to deliver the service;
- insurance companies, for the cover linked to the trip;
- the public security authorities, through the accommodation providers, for the mandatory reporting of guests;
- the firm that handles our accounting and tax obligations, banks, and the authorities when required by law.
We also rely on providers that process data on our behalf as processors (Art. 28 GDPR):
- OVH (OVH SAS, France): website hosting and data storage on servers in the European Union;
- Stripe (Stripe Payments Europe Ltd, Ireland): payment processing, acting as an independent controller for its own obligations;
- Google (Google Ireland Ltd): the email service through which we handle communications and enquiries received from the website.
We do not sell or pass on your data to third parties for marketing purposes.
6. Transfers outside the European Union
Data is stored in the European Union. Some providers (Google, Stripe, OpenStreetMap Foundation) may transfer data to countries outside the EU, in particular the United States and the United Kingdom, on the basis of the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework and the decision on the United Kingdom) and of standard contractual clauses.
7. How long we keep the data
- Bookings, orders and tax documents: 10 years from the conclusion of the contract, as required by Italian civil and tax law.
- Traveller data (date of birth and identity document): for as long as needed for the obligations they were collected for, and in any case no longer than the booking they relate to.
- Enquiries not followed by a booking: 24 months from the enquiry.
- User accounts: until you delete them; accounts with no orders and no logins for 24 months are removed.
- Newsletter: until you withdraw your consent.
- Technical browsing data: for the time strictly needed for the security of the service, according to the hosting provider’s settings.
8. Your rights
At any time you can ask us for access to your data, its rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. You can withdraw any consent given without affecting the lawfulness of processing already carried out. To exercise your rights write to booking@abruzzoincoming.it or cliffsas@pec.it: we reply within one month.
If you believe the processing infringes the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live.
9. Security
The website is served over an encrypted connection (HTTPS). Data is stored on servers in the European Union with access limited to authorised staff; account passwords are stored encrypted and payment card details are never kept on our systems.
10. Minors
The website’s services are intended for adults. The data of minors taking part in a trip is entered by the parent or the person responsible for them at the time of booking.
11. Changes
This policy may be updated to reflect changes to the website or to the law. The version in force is always the one published on this page, with the date of the last update shown at the top.
