Once Italy / Privacy Policy

PRIVACY

Privacy Policy

How Once Italy SRL collects and uses your personal data when you visit onceitaly.com, send us an enquiry or travel with us.

1. Who we are

The data controller for this website and for the services we provide is:

Once Italy SRL
Piazza Signorelli 7, 52044 Cortona (AR), Italy
VAT number (P.IVA): 02538060514
Email: info@onceitaly.com · Phone: +39 0575 912894

We are a destination management company and licensed tour operator. We have not appointed a Data Protection Officer; for any privacy question, write to info@onceitaly.com.

2. What data we collect

Data you give us

  • When you send an enquiry or use a contact form: name, email address, phone number (if given), travel dates, number of guests, the stay, package or service you are interested in, your preferred language, whether you are a traveller, travel agency or event planner, and your message.
  • When you book with us: the names of the travellers, ages of children where needed, arrival details, special requests and, where Italian law requires it, identity document details for guest registration.
  • Dietary needs, allergies or accessibility needs, only if you choose to tell us so that we can organise your trip.
  • If you are a property owner working with us: your contact details, details of the property and the bank details needed to pay you.

Data collected automatically

  • Technical data such as IP address, browser type, pages visited and time of visit, recorded in server logs for security and to keep the website working.
  • Technical cookies, described in section 8.

We do not collect payment card details through this website.

3. Why we use your data and on what legal basis

  • To answer your enquiry and prepare a quote – steps taken at your request before a contract (Art. 6(1)(b) GDPR).
  • To organise and deliver the services you book – stays, transfers, guides, experiences, tours, weddings and events, property management (Art. 6(1)(b) GDPR, performance of a contract).
  • To meet our legal obligations – accounting and tax records, tourism regulations, registration of guests with the Police (Art. 109 TULPS) and tourist tax (Art. 6(1)(c) GDPR).
  • To run our business relationships with travel agencies, planners and suppliers, and to keep the website secure – our legitimate interest (Art. 6(1)(f) GDPR).
  • Health-related information such as allergies or accessibility needs – only with your explicit consent (Art. 9(2)(a) GDPR), and only to organise your trip.
  • Marketing – we do not send newsletters or promotional emails unless you have given your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Giving us your data is voluntary, but without the data marked as required in our forms we cannot answer your enquiry or provide the service.

4. Who we share your data with

We only share what is needed, with:

  • the suppliers who deliver your trip: villa and apartment owners, hotels and agriturismi, drivers, guides, restaurants, wineries, wedding and event suppliers;
  • the travel agency or planner who booked on your behalf, if you came to us through one;
  • booking platforms such as Airbnb, Booking.com and Vrbo, for properties we manage;
  • our accountant, legal advisers and IT providers (website hosting, email), who act as data processors under Art. 28 GDPR;
  • public authorities, when the law requires it.

We never sell your personal data.

5. Third-party services on this website

  • Google Fonts (Google Ireland Ltd.) – fonts are loaded from Google servers, which receive your IP address.
  • WhatsApp chat button – the button is provided by the Joinchat plugin. If you click it, you leave our website and WhatsApp (Meta Platforms Ireland Ltd.) processes your data under its own privacy policy.
  • Google Maps – where a map is shown on a property page, Google may receive your IP address.

These providers act under their own privacy policies.

6. Transfers outside the European Union

Some providers (for example Google and Meta) may process data outside the European Economic Area. In those cases the transfer is protected by the EU–U.S. Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

7. How long we keep your data

  • Enquiries that do not lead to a booking: up to 24 months, then deleted.
  • Booking, contract and invoice data: 10 years, as required by Italian law (Art. 2220 of the Civil Code).
  • Guest registration data: for the period set by Italian law.
  • Marketing consent: until you withdraw it.
  • Server logs: for a short period, normally no longer than 6 months, unless needed to investigate a security incident.

8. Cookies

This website uses only technical cookies, which are needed for the site to work (for example to remember your choices, keep the site secure and speed up page loading). They do not require your consent.

We do not use advertising or profiling cookies. If we ever add analytics or marketing cookies, we will ask for your consent first through a cookie banner.

You can delete or block cookies in your browser settings at any time; some parts of the site may then not work correctly.

9. Your rights

Under the GDPR (Articles 15–22) you can at any time:

  • ask for access to your data and a copy of it;
  • ask us to correct or complete it;
  • ask us to delete it, or to limit how we use it;
  • receive your data in a portable format;
  • object to processing based on our legitimate interest;
  • withdraw your consent, without affecting what was done before.

To exercise your rights, email info@onceitaly.com. We will reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali.

10. Security

We protect your data with appropriate technical and organisational measures: encrypted connection (HTTPS), access limited to the people who need it, and providers bound by confidentiality and data-protection agreements.

11. Children

Our services are booked by adults. We do not knowingly collect data directly from children under 14. Information about children travelling with their family (for example their age) is provided by parents or guardians and used only to organise the trip.

12. Changes to this policy

We may update this policy when our services or the law change. The current version is always on this page.

Last updated: 13 October 2026