Last updated: 01/11/2025
This Privacy Policy applies to citizens and legal permanent residents of the European Economic Area (EEA) and Switzerland.
In this Privacy Policy, we explain how we process personal data collected via https://monterosabooking.com/ (the “Website”). We recommend reading it carefully.
We process personal data in compliance with applicable laws, including Regulation (EU) 2016/679 (“GDPR”) and other relevant data protection rules. In particular, we:
clearly indicate the purposes for which we process personal data;
collect only the data necessary for legitimate purposes;
request consent when required;
adopt appropriate security measures;
respect the data subject’s rights (access, rectification, erasure, restriction, objection, portability).
For any questions or requests regarding your personal data, you can contact us using the details provided in section 12.
1. Data Controller
The Data Controller is:
Monte Rosa Booking – Anna Gualdi
Via dei Walser 6, Alagna Valsesia (VC), Italy
Email: info@monterosabooking.com
PEC: annagualdi@pec.it
Phone: +39 0163 1900925
Website: https://monterosabooking.com/
2. Purposes of processing, legal basis, data processed and retention periods
We may collect and process personal data for the following purposes.
2.1 Orders, payments and booking management (WooCommerce)
Purpose: managing orders/bookings, payments, confirmations, customer support and related operational activities.
Data processed: first name and last name, email address, phone number, billing address (and if necessary shipping address), order/booking details and data required to manage payments.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR).
Retention: up to 10 years to comply with Italian tax and accounting obligations.
2.2 Delivery of tourism services and mountain activities (mountain guides, huts, logistics)
Purpose: organising and delivering the purchased services (for example guided mountain activities, hut/facility bookings, operational communications related to the programme, management of essential logistics needs).
Data processed: first name and last name, contact details, order/booking information and data strictly necessary for the operational management of the service.
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention: for the time necessary to deliver the service and thereafter according to applicable administrative/accounting obligations and/or for protection in case of disputes.
2.3 Contact requests (email, phone, WhatsApp, forms)
Purpose: replying to enquiries, providing information, support and/or quotations.
Data processed: name, email, phone number, message content and information provided by the user.
Legal basis: taking steps prior to entering into a contract (Art. 6(1)(b) GDPR) and/or legitimate interests (Art. 6(1)(f) GDPR).
Retention: generally up to 24 months, unless longer retention is required due to a contract, legal obligations or the protection of our rights in case of disputes.
2.4 Newsletter (Brevo)
Purpose: sending newsletters, updates and informational communications about activities and services.
Data processed: email address and, if provided, name and preferences (e.g. language).
Legal basis: consent (Art. 6(1)(a) GDPR).
Retention: until consent is withdrawn or the user unsubscribes. You can unsubscribe at any time using the link at the bottom of each email.
Note: we may use delivery statistics (for example delivery, opens and clicks) to improve the quality of our communications.
2.5 Dietary preferences shared by the user (e.g. vegetarian/vegan)
Purpose: organisational management of the service (for example meals in huts) when the user communicates dietary preferences.
Data processed: dietary preferences voluntarily communicated by the user (e.g. vegetarian/vegan).
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Retention: for the time necessary for operational management of the service and in any case no longer than useful for delivery.
2.6 Legal obligations and accounting (invoicing)
Purpose: issuing invoices and fulfilling tax/accounting obligations.
Data processed: invoicing data (first name/last name or business name, address, VAT number if applicable, email, order details).
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
Retention: 10 years.
2.7 Website statistics and improvement (Google Analytics)
Purpose: statistical analysis and improvement of Website performance and user experience.
Data processed: technical and usage data collected through analytics tools (Google Analytics), depending on the active settings and the preferences expressed through the cookie banner.
Legal basis: consent (Art. 6(1)(a) GDPR), when required by cookie settings.
Retention: according to the settings of the tool used and as described in the Cookie Policy.
3. Nature of providing data (mandatory or optional)
Providing personal data is:
necessary to complete orders/bookings, manage payments and deliver the purchased services. If such data is not provided, it will not be possible to provide the requested service;
optional for subscribing to the newsletter. Consent can be withdrawn at any time.
4. Data sharing with third parties (Processors and recipients)
We share personal data only when necessary and consistent with the purposes described in this Privacy Policy.
4.1 Data Processors (service providers)
We use selected service providers acting as Data Processors, for example for:
Website hosting and technical management;
newsletter delivery and email marketing;
analytics and performance tools;
payment services;
e-invoicing and administrative/accounting services.
Where required, we enter into Data Processing Agreements (DPA) with our providers.
4.2 List of main providers (where applicable)
Below is a list of the main providers used:
Artera (Switzerland – CH)
Purpose: Website hosting and technical infrastructure management.Brevo
Purpose: newsletter delivery and email marketing management.NUMIA S.p.A. (Italy)
Purpose: payment services (where applicable).NetsGroup – IGFS Gateway
Purpose: payment gateway and transaction processing (where applicable).Aruba (Italy)
Purpose: e-invoicing and administrative/accounting services (where applicable).Google Ireland Limited (Ireland)
Purpose: analytics and Website performance tools (Google Analytics, where active).
5. Data sharing for service delivery (mountain guides and huts)
To manage and correctly deliver the purchased service, some data may be shared with:
UIAGM mountain guides involved in the activity;
huts and facilities necessary for booking and organisation (e.g. overnight stays and half board arrangements).
Shared data is limited to what is strictly necessary for operational management.
6. Transfers of data outside the EEA
Some providers may process personal data outside the EEA.
Switzerland is recognised as a country ensuring an adequate level of protection under EU law.
Where transfers occur to countries that are not recognised as “adequate”, we implement appropriate safeguards (e.g. Standard Contractual Clauses – SCCs) or other mechanisms permitted under the GDPR.
7. Cookies
The Website uses cookies and similar technologies. For more information about the cookies used and how to manage preferences, please refer to the Cookie Policy.
8. Mandatory disclosures
We may disclose personal data if required by law, by an authority order, or in response to lawful requests from competent authorities, within the limits permitted by applicable law.
In the event of a merger, acquisition, sale or transfer of the business, data may be shared with advisers and potential buyers, in compliance with the law.
9. Security
We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse or unlawful disclosure.
Access to data is restricted to authorised persons only and security measures are reviewed periodically.
10. Third-party websites
This Privacy Policy does not apply to third-party websites linked from the Website. We cannot guarantee how such third parties process personal data. We recommend reviewing their privacy policies before using those websites.
11. Data subject rights
You have the right to:
obtain information about the processing of your data;
access your personal data;
request rectification of inaccurate or incomplete data;
request erasure of your data, where applicable;
request restriction of processing, where applicable;
receive your data in a portable format and/or transmit it to another controller (data portability);
object to processing, where applicable;
withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
To exercise your rights, you can contact us using the details provided in section 12.
We may request additional information to verify your identity and protect your data from unauthorised access.
12. Complaints, contact details and data requests
If you believe that the processing of your data is carried out in violation of applicable law, you have the right to lodge a complaint with the competent supervisory authority.
For Italy: Garante per la Protezione dei Dati Personali.
To exercise your rights under the GDPR (access, rectification, erasure where applicable and data portability), you can contact us via email at info@monterosabooking.com or via PEC at annagualdi@pec.it.
We will reply within the time limits set by applicable law.
Data Controller contact details:
Monte Rosa Booking – Anna Gualdi
Via dei Walser 6, Alagna Valsesia (VC), Italy
Email: info@monterosabooking.com
PEC: annagualdi@pec.it
Phone: +39 0163 1900925
Website: https://monterosabooking.com/
Annex – WordPress and WooCommerce plugins
WPML
WPML uses cookies to identify the visitor’s current language, the last visited language, and the language of logged-in users.
WPML may exchange technical information with the Website through the Installer component. No visitor personal data is shared for that purpose.
WooCommerce
While browsing and purchasing on the Website, WooCommerce processes the data necessary to manage the cart, the order and related administrative activities, including:
cart contents (via cookies);
identification and contact details;
billing data;
order details and data necessary to manage payments.
