1. Data controller
The data controller is the operator of alltours.rome.it, trading as AllTours Rome, established in the European Union. Contact for privacy matters: support@alltours.rome.it. We have not appointed a data protection officer; the scale of processing does not require one.
This policy follows the GDPR (Regulation (EU) 2016/679) and the Italian Privacy Code.
2. What we collect and why
Server logs
When you open a page, our hosting provider records the request in a standard server log: your IP address, the date and time, the page requested, the referring address and your browser string. This is needed to deliver the page, keep the site secure and diagnose failures. We do not combine logs with other data or build profiles. The provider acts as our processor; its name and location will be stated here once the hosting contract is final.
If you write to support@alltours.rome.it we receive your address, your name if you give it, and what you write. We use it to reply, to fix the page you reported and to assess partnership requests. We add nobody to a list.
Nothing else
No accounts, no newsletter, no contact form, no comments, no logged search. We collect no payment details, because nothing is sold here, and we buy no data about readers.
3. Cookies
Cookies set by us: none
Our pages are static files. They set no cookies and store nothing in your browser, so there is no consent banner.
Third-party widgets and embeds
Some pages embed a GetYourGuide or Tiqets booking widget in an iframe so you can check dates and prices on the page. The widget loads from the partner’s servers: the partner receives your IP address and request data and may set its own cookies inside the iframe under its own privacy policy, published on getyourguide.com and on tiqets.com. We do not receive or read those cookies. Other embedded content works the same way. If you prefer not to load third-party content, block third-party cookies or iframes in your browser.
Analytics
At launch the site runs no analytics script. If we add one, it will be a privacy-friendly service that works without cookies and without identifying readers, and this section will name it before it goes live.
4. Affiliate links and tracking parameters
Partner links point to /go/<key>/ on our own domain. When you click one, our server redirects you to the partner’s booking page and adds our partner identifier to the address, for example a partner_id parameter, so that GetYourGuide or Tiqets can attribute a commission if you book. The redirect records nothing beyond the standard log entry. What the partner does after you arrive, including any cookie that remembers the referral, is governed by its own privacy policy. The commercial side is explained on the affiliate disclosure page.
5. Legal bases
- Server logs: our legitimate interest in delivering, securing and maintaining the site (article 6(1)(f) GDPR).
- Email: our legitimate interest in answering messages and correcting published content (article 6(1)(f)); for partnership discussions, steps taken at your request before an agreement (article 6(1)(b)).
- Partner widgets and cookies: the partner is the controller for that processing and states its own legal basis.
- Legal obligations: where the law requires us to keep or disclose data (article 6(1)(c)).
We rely on consent for nothing at launch.
6. Retention
- Server logs: kept by the hosting provider for a limited period, then deleted. The period will be stated here with the provider’s name.
- Email: kept for up to 24 months after the last exchange, then deleted, unless needed longer for a claim or a legal obligation. Correction reports may be kept in anonymised form as a record of what changed on a page.
7. Sharing and international transfers
We share data only with the hosting provider, which stores it in the European Union or under safeguards recognised by the GDPR, and with authorities when the law requires it. We do not sell or rent data. Partners receive data from you directly when you use their widgets or booking pages; we never send them your email.
8. Your rights
Under the GDPR you can ask us to access the personal data we hold about you, rectify it, erase it, restrict processing while a question about it is resolved, object to processing based on legitimate interest, and port data you gave us where the basis is contract or consent. Send the request to support@alltours.rome.it. We reply within one month and may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Italy that is the Garante per la protezione dei dati personali, www.garanteprivacy.it. In another EU country, complain to your own authority.
9. Children
The site is written for adults planning a trip. It has no accounts or forms and does not knowingly collect data from anyone under 16. If you believe a child has emailed us, tell us and we will delete the message.
10. Changes to this policy
We update this page when our practices change, for example if we add analytics or switch hosting provider. The updated date at the bottom identifies the current version.
11. Contact
Questions, requests and complaints about personal data: support@alltours.rome.it. How the site may be used is set out in the terms of use.