Privacy Policy
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Italian Privacy Code”), as amended by Legislative Decree 101/2018
Last updated: 10 October 2026
This policy explains how Peonia Tourist Service S.r.l., owner of the “Sulcis Sail Charter” brand, processes the personal data of visitors to the website https://sulcisailcharter.com (including the English-language pages, hereinafter the “Website”), of people who contact us and of customers who book our boat excursion, rental and on-board accommodation services. For information on cookies and tracking tools, please also read our Cookie Policy.
This is an English translation of the Italian original. In the event of any discrepancy, the Italian version shall prevail.
1. Data controller
Peonia Tourist Service S.r.l.
Loc. S’acqua e Sa Canna, snc – 09017 Sant’Antioco (SU), Italy
VAT No. 03934490925 – REA (Business Register) CA-350441
E-mail for privacy requests: info@sulcisailcharter.com
Telephone: +39 347 185 7888 (IT) – +39 347 733 1956 (EN)
2. What data we process
a) Browsing data. In the normal course of operation, the systems that run the Website collect certain data whose transmission is implicit in the use of Internet protocols: IP address, date and time of the request, page requested, referring page (referrer), server response code, browser type and operating system. This data is used for the technical operation and security of the Website and not to identify you.
b) Data you provide via the Website forms (contact and booking request forms): first name and surname, e-mail address, telephone number, service of interest, preferred dates, number of participants (adults and children), the content of your message and any optional consent to receive promotional communications. Fields marked with an asterisk are required in order to reply to your request.
c) Data you send us by e-mail, telephone, WhatsApp or via our social media profiles, when you contact us directly.
d) Customer data needed to confirm and carry out the booking: personal and contact details of the participants, invoicing and payment details and, where required by law, identity document details.
e) Special categories of data. Please do not enter health data or other special categories of data (Art. 9 GDPR) in the forms. If you voluntarily tell us about allergies, food intolerances or health-related needs so that we can provide the service on board safely, we will use this information for that purpose only and on the basis of your explicit consent.
f) Blog comments: name, e-mail address, website (if provided), the text of the comment, IP address and browser user agent.
g) Data collected through cookies and third-party tools: data for statistics, advertising and external content is processed only with your consent, given via the cookie banner; technically necessary tools, including the anti-spam protection of the forms, are used without consent. Details are provided in the Cookie Policy.
Minors. The Website is not intended for children under the age of 14, who must not send us personal data. The data of minors taking part in our services is provided to us by the holders of parental responsibility who accompany them.
3. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Technical operation of the Website; prevention of abuse, cyber-attacks and spam, including protection of the contact and booking forms with Google reCAPTCHA | Legitimate interest of the Controller in the security and proper functioning of the Website (Art. 6(1)(f) GDPR) | Server and security system logs: as a rule no longer than 60 days, unless needed to investigate unlawful activity; Google reCAPTCHA cookies: as indicated in the Cookie Policy |
| Replying to requests for information, quotes and booking requests sent via the forms, e-mail, telephone or WhatsApp | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) | Up to 24 months from the last communication, if the request is not followed by a booking |
| Confirmation, management and performance of the booking (operational communications, any changes due to weather and sea conditions, assistance) | Performance of the contract (Art. 6(1)(b) GDPR) | For the duration of the relationship and thereafter as indicated for legal obligations |
| Compliance with legal obligations: tax and accounting obligations and, where applicable, the communication of guest details to the Public Security Authority for services including an overnight stay (Art. 109 of the Italian Consolidated Law on Public Security – TULPS) and obligations relating to navigation and safety; responding to requests from the authorities | Legal obligation (Art. 6(1)(c) GDPR) | 10 years for accounting and tax records (Art. 2220 of the Italian Civil Code); for other data, the period set by the applicable law |
| Managing allergies, intolerances or health-related needs that you voluntarily disclose to us | Explicit consent (Art. 9(2)(a) GDPR) | Until the end of the booked service |
| Sending newsletters, offers and promotional communications from Sulcis Sail Charter by e-mail | Consent, optional and revocable at any time (Art. 6(1)(a) GDPR; Art. 130 of the Italian Privacy Code) | Until consent is withdrawn and in any case no longer than 24 months from the last contact, unless consent is renewed |
| Website usage statistics (Google Analytics 4, Jetpack Stats) | Consent given via the cookie banner (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code) | As indicated in the Cookie Policy |
| Measuring the effectiveness of ads and personalised advertising on Meta platforms (Meta Pixel) | Consent given via the cookie banner (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code) | As indicated in the Cookie Policy |
| Displaying external content (YouTube and Vimeo videos, Google Maps) | Consent given via the cookie banner (Art. 6(1)(a) GDPR; Art. 122 of the Italian Privacy Code) | As indicated in the Cookie Policy |
| Publishing and moderating blog comments; spam checks on comments | Performance of the service you requested (Art. 6(1)(b) GDPR); legitimate interest in preventing spam (Art. 6(1)(f) GDPR) | For as long as the comment remains published or until you request its deletion |
| Establishing, exercising or defending legal claims, in or out of court | Legitimate interest of the Controller (Art. 6(1)(f) GDPR) | For the duration of the dispute and until the time limits for appeal or limitation periods have expired |
When the periods indicated above expire, the data is deleted or irreversibly anonymised. Backup copies of the systems, kept to ensure service continuity, are overwritten periodically.
4. Whether providing data is mandatory
Providing the data marked as mandatory in the forms is necessary in order to reply to your request or manage your booking: without it we will not be able to proceed. Providing the data required to comply with legal obligations is mandatory. Consent to promotional communications and to non-technical cookies is optional: if you do not give it, you can still use the Website and request our services.
5. How data is processed
Data is processed using IT tools and, where necessary, paper records, by authorised and trained personnel, with appropriate technical and organisational measures: encrypted HTTPS connection, web application firewall, restricted and protected access, regular updates and backups. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Advertising measurement and personalisation take place only with your consent.
6. Recipients of the data
For the purposes indicated above only, data may be disclosed to:
- persons authorised by the Controller (staff and collaborators, for example the skipper and crew), who are bound by confidentiality;
- suppliers processing data on our behalf as data processors (Art. 28 GDPR), including:
- Lo Spot Digitale di Davide Salvagnolu (Italy): development, maintenance and technical support of the Website, management of the server and of the CCM19 consent management platform; receives a copy of the requests sent via the forms in order to check that they work properly;
- Contabo GmbH (Germany): server infrastructure hosting the Website and the @sulcisailcharter.com e-mail service;
- Google Ireland Limited: e-mail service (the Gmail mailbox used to handle requests), Google reCAPTCHA to protect the forms and, subject to consent, Google Analytics 4;
- Automattic Inc. (USA): Jetpack services (CDN for the Website’s static files, Jetpack Stats subject to consent, monitoring), Akismet (comment spam filtering) and Gravatar (authors’ profile pictures);
- Defiant Inc. (USA): Wordfence firewall and security services;
- third parties acting as independent controllers or joint controllers, when you use the related features:
- Meta Platforms Ireland Limited: Meta Pixel (with your consent; for the collection and transmission of data via the Pixel, the Controller and Meta are joint controllers pursuant to Art. 26 GDPR), WhatsApp (if you write to us using the WhatsApp button), Facebook and Instagram;
- Google Ireland Limited for YouTube and Google Maps, and Vimeo.com, Inc. for Vimeo videos, only if you accept external content;
- advisers and professionals (accountant, legal advisers), banks and payment institutions and insurance companies, to the extent necessary to manage the service;
- public authorities (for example the Police Headquarters (Questura), the Harbour Master’s Office (Capitaneria di Porto), the Italian Revenue Agency and the judicial authorities), where required by law.
Data is not disseminated or sold. The up-to-date list of data processors is available on request.
7. Transfers of data outside the European Union
Some suppliers (Google LLC, Meta Platforms Inc., Automattic Inc., Vimeo.com Inc., Defiant Inc.) are based in, or may process data in, the United States. Such transfers take place on the basis of the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified suppliers, and/or the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR). You can obtain information on the safeguards in place by writing to info@sulcisailcharter.com.
8. Your rights
You may at any time exercise the rights provided for in Articles 15–22 GDPR:
- access to your data and to obtain a copy of it;
- rectification of inaccurate data or completion of incomplete data;
- erasure (“right to be forgotten”) in the cases provided for by law;
- restriction of processing;
- portability of the data you have provided to us, for processing based on consent or contract and carried out by automated means;
- objection, on grounds relating to your particular situation, to processing based on legitimate interest, and objection at any time to processing for marketing purposes;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. You can withdraw your consent to cookies using the cookie settings icon on the Website.
To exercise your rights, write to info@sulcisailcharter.com. We will reply without undue delay and in any case within one month of receiving your request (a period that may be extended by two further months for more complex requests, as provided for in Art. 12 GDPR). Exercising your rights is free of charge.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome, Italy – www.garanteprivacy.it) or with the supervisory authority of the EU Member State in which you habitually reside, work, or where the alleged infringement took place.
9. Social networks and external links
The Website contains links to our profiles on Facebook, Instagram, TikTok and YouTube and to other websites. When you visit these platforms, their respective privacy policies apply. For the statistics of our Facebook and Instagram pages (“Insights”), the Controller and Meta Platforms Ireland Limited act as joint controllers, in accordance with the agreement made available by Meta. The Controller is not responsible for the processing carried out by external websites that can be reached via links.
10. Changes to this policy
This policy may be updated, for example following changes in the law or in the services used by the Website. The version in force is always published on this page, together with the date of the last update.