Privacy notice
Notice provided pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (“Privacy Code”), to visitors of the website www.oravatravel.com and to anyone contacting us via the enquiry form, email, telephone or WhatsApp.
1. Data controller
ORAVA TRAVEL di Kenneth Mazza & C. S.a.s.
Via Torino 30, 15076 Ovada (AL) – Italy
VAT No. 00518850060
Telephone: +39 0143 81014 – Email: info@oravatravel.com
Certified email (PEC): oravatravel@pec.it
Data Protection Officer (DPO): not appointed, as it is not mandatory for the activity carried out.
2. What data we process
- Browsing data: during normal use, the systems that run the website acquire certain technical data such as IP address, browser and device type, date and time of the request and pages visited. These are used for the operation and security of the website and for aggregate statistics on page usage.
- Data voluntarily provided via the enquiry form: first and last name or contact person, company/organisation/association, telephone, email, area of interest, destination or location and indicative period, notes and details of the request.
- Data provided by contacting us in other ways: the data you share with us by email (including via the “Request Programme / Seats” buttons), by telephone or on WhatsApp.
- Messages to the virtual assistant: the text you type in the “Virtual Assistant” chat on the website.
Please do not enter special categories of data (for example health-related data) in the form, in emails or in the chat unless strictly necessary for your request, for example for an assistance need during travel.
3. Purposes and legal bases of processing
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to your requests for information, programmes, availability and quotes (travel, day trips, groups, business travel, MICE events, drone services) | Performance of pre-contractual measures taken at your request – Art. 6(1)(b) |
| Managing the booking and the travel or service contract, if you decide to proceed | Performance of the contract – Art. 6(1)(b) |
| Complying with legal, accounting and tax obligations | Legal obligation – Art. 6(1)(c) |
| Ensuring the operation and security of the website and preventing abuse and spam | Legitimate interest of the controller – Art. 6(1)(f) |
| Aggregate statistics on website visits | Legitimate interest of the controller – Art. 6(1)(f) (data collected in anonymous, aggregate form) |
| Protecting the controller’s rights in the event of disputes | Legitimate interest of the controller – Art. 6(1)(f) |
Data collected through the website is not used to send newsletters or promotional communications without your specific, separate consent.
4. Nature of data provision
Providing the data in the form is optional. Without a name, telephone number and email, however, we cannot respond to your request. The other fields (company, area of interest, destination, notes) are optional and help us give you a more accurate answer.
5. How data is processed
Data is processed using electronic and, where necessary, paper-based tools, by authorised and trained staff, with technical and organisational measures appropriate to protect it against unauthorised access, loss or disclosure. Requests sent via the form reach the relevant office by email (info@oravatravel.com; for MICE events and drone services eventi@oravatravel.com). They are also recorded in an internal archive of the website, accessible only to authorised staff. We do not carry out automated decision-making or profiling. The virtual assistant only provides informational answers and does not take decisions that concern you.
6. Recipients of the data
Data is not disseminated. It may be disclosed, solely for the purposes stated:
- to suppliers who support us in managing the website and services, appointed as Data Processors under Art. 28 GDPR. These include: Netsons (provider of website hosting and email service, with servers in the European Union), Automattic Inc. (Jetpack/WordPress.com services, including website statistics), Google (Gemini artificial intelligence service used by the virtual assistant, Google Ireland Ltd / Google LLC);
- if you proceed with a booking, to the parties necessary to perform the requested service, such as tour operators, airlines and carriers, accommodation providers, insurance companies and ground service providers, which act as independent controllers;
- to consultants and professionals (for example our accountant) and to public authorities, where required by law.
External services connected to the website. To display certain content, the website loads resources from third-party services. In doing so, your browser communicates your IP address to those services: Google Fonts (typefaces, Google Ireland Ltd / Google LLC) and Unsplash (images). The WhatsApp, Facebook and Google Maps buttons are simple links: data is processed by Meta or Google only if you choose to use them, in accordance with their own privacy notices.
7. Transfer of data outside the European Union
Some of the suppliers mentioned (Automattic, Google – including for the Gemini virtual assistant – and Unsplash) may process data in the United States or other non-EU countries. In such cases the transfer takes place on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework, for participating suppliers, or the Standard Contractual Clauses approved by the Commission (Art. 46 GDPR).
8. How long we keep data
- Requests for information and quotes not followed by a booking: 24 months from the request, then deleted.
- Data relating to contracts and bookings: for the duration of the relationship and, thereafter, for 10 years to meet civil and tax law obligations (Art. 2220 of the Italian Civil Code).
- Browsing data: for the technical time needed for the operation and security of the website, unless required to investigate unlawful acts.
9. Your rights
At any time you may exercise the rights provided for in Arts. 15-22 GDPR:
- access to your data and a copy of it;
- rectification of inaccurate data or completion of incomplete data;
- erasure, in the cases provided for;
- restriction of processing;
- data portability;
- objection to processing based on legitimate interest;
- withdrawal of consent, if given, at any time and without affecting the lawfulness of prior processing.
To exercise them, write to info@oravatravel.com or to our office address. We will reply within one month of your request. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work.
10. Cookies
The website uses:
- technical cookies, necessary for the website to work and to remember your choice on the cookie banner. Consent is not required for these cookies;
- statistics tools (Jetpack Stats by Automattic), used solely to know, in anonymous and aggregate form, the number of visits and the most viewed pages. As they are anonymous and used only for statistics, they are treated as technical cookies and do not require consent.
The website does not use profiling cookies for advertising purposes. You can also manage or delete cookies from your browser settings. Disabling technical cookies may prevent some parts of the website from working properly. For more information, see the Italian Data Protection Authority’s Cookie Guidelines (provision of 10 June 2021).
11. Changes to this notice
This notice may be updated, for example in the event of new services or regulatory changes. The current version is always published on this page.
Last updated: 6 November 2026
