Privacy Policy
Last update: October 01, 2026
Privacy Policy
Last updated: 1 October 2026
This policy describes how we collect and process the personal data of users who visit brindeasy.it and buy products or services offered by Brindeasy Solutions S.r.l.s..
1. Data Controller
- Brindeasy Solutions S.r.l.s.
- Address: Via Giovanni XXIII 38, 72100 Brindisi (BR), Italy
- VAT no.: 02769020740
- Email: info@brindeasy.it
2. Personal Data Collected
2.1 Data you provide
- First name, last name and tax code
- Email address
- Phone number
- Shipping and billing address
- Payment data (handled by PCI-DSS certified providers: Stripe, PayPal)
- The questions you type into the site chat and, if you want the reply sent there, your email
- If you review a product: the rating, the comment and the name you sign with
2.2 Data collected automatically
- IP address
- Browser and device type
- Operating system
- Pages visited and length of the visit
- Referral source
3. Purposes of Processing
- Order management: processing, confirming and shipping purchases
- Booking management: confirming and organising the experiences you book
- Transactional communications: confirmation emails and order status updates
- Legal obligations: tax and accounting requirements
- Marketing (with consent): newsletter, offers and promotions
- Site chat (with consent): answering your questions, passing the ones the assistant can’t answer to our staff, and understanding what visitors ask so we can improve the site’s content
- Product reviews: a few days after delivery we send you a single email asking what you think of the products you bought; if you reply, we publish the rating, the comment and the shortened name (first name and surname initial) on the product page
- Security: preventing fraud and unauthorised access
4. Legal Basis for Processing
- Performance of a contract: to process orders and bookings
- Compliance with legal obligations: for tax and accounting requirements
- Consent: for newsletter and marketing, for the site chat and for publishing the review you write (you can withdraw it at any time)
- Legitimate interest: to prevent fraud, improve our services and ask you for a review after a purchase (one email per order, with a link to stop receiving them)
5. How long we keep data
| What | How long | Why |
|---|---|---|
| Orders, invoices and accounting data | 10 years | Required by tax law |
| Experience bookings | 10 years if linked to a payment | They are part of the accounts |
| Quote requests and uploaded images | As long as they are needed to prepare the work, then 1 month after archiving | The image you send is what lets us understand and prepare the job: without it no quote can be made. When the request is closed it is archived, and a month later it disappears along with the images. You can ask for deletion earlier, at any time. |
| Messages sent through the contact form | 24 months | Handling the request |
| Site chat conversations, and any email left for the reply | 24 months from the last message | Time to reply to you and to see which questions come up again. You can delete the conversation earlier, from the chat itself |
| Published reviews | As long as the product is on sale | They help whoever chooses after you. You can ask us to remove them at any time |
| Rejected reviews (spam, insults, personal data) | 1 month | Time to fix a mistake, then they disappear |
| Review requests | 24 months | If you asked not to receive any more, that request is kept for as long as it is needed to respect it |
| Newsletter subscription | Until you unsubscribe | It is based on your consent |
| Abandoned carts | 6 months | Time to send you a reminder, if you left us your address |
| Server technical logs with IP address | 12 months | Security and fault diagnosis |
| Data in Google Analytics | no more than 14 months | The maximum the service allows |
Once the period ends, data are deleted or anonymised. If some data are needed to defend a right in court, we keep them for as long as that requires.
6. Who we share data with
Your data are not sold to anyone. They are processed on our behalf by the parties below, appointed as data processors under Art. 28 GDPR:
| Who | What for | Where |
|---|---|---|
| Stripe Payments Europe Ltd | Card payments | Ireland, with transfers to the USA |
| Google Ireland Ltd | Visit statistics (only with your consent) | Ireland, with transfers to the USA |
| Anthropic PBC | The language model behind the site chat and our internal assistant (see section 7) | United States |
| Armada S.r.l. (hostingperte.it) | The servers the site runs on | Italy |
| Couriers | Delivering parcels: name, address and contact details | Italy and EU |
PayPal is a separate case. It does not process data on our behalf: it decides for itself how to use them, for its own legal obligations on payments and against fraud. Technically it is an independent controller, not one of our processors, and we are required to tell you so.
| Who | Role | What for | Where |
|---|---|---|---|
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Independent controller | If you choose to pay with PayPal, it processes the payment data under its own privacy policy | Luxembourg |
Email and backups stay on our own infrastructure, not with third-party providers. Data may also be disclosed to the authorities when the law requires it. The up-to-date list, with contract details, is available by writing to the address in section 9.
7. Artificial intelligence
We use a language model provided by Anthropic PBC in three places:
- The site’s itinerary generator, which writes the story of the day. The stops are chosen by our own program from real places and events: the model puts them into words. It receives no data about you.
- The internal assistant we use for stock and orders. When we look up an order, the model may receive the customer’s name and email address along with the items bought.
- The site chat, which answers visitors’ questions using only the texts published on the site. The model receives your question, the last few messages of the conversation and the site texts that relate to it; it does not receive your email or your IP address. Many answers (events, shipping, contacts) we give by reading our database directly, without the model. If the answer isn’t there, the assistant says so and the question goes to a person on our staff, who reads it and can reply to you. To limit abuse we keep an encrypted fingerprint of the IP address, not the address itself. Please don’t type personal data into the chat that your question doesn’t need.
In none of the three cases is there an automated decision about you: the model decides nothing about you, sets no personalised prices and does not assess people. Every action the assistant proposes is confirmed by a person before it takes effect. Anthropic does not use the data sent to train its models.
8. Children
The site is not aimed at children under 14 and we do not knowingly collect their data. To buy you must have the capacity to enter into a contract. If you notice that a child has left us their data, write to us: we will delete them without asking anything else.
9. Your rights
EU Regulation 2016/679 gives you these rights, which you can exercise free of charge and at any time:
- Access (Art. 15): to know whether we process data about you and receive a copy.
- Rectification (Art. 16): to correct wrong data or complete them.
- Erasure (Art. 17): to have them deleted, when no legal obligation requires us to keep them.
- Restriction (Art. 18): to freeze their use while a dispute is being clarified.
- Portability (Art. 20): to receive them in a format another program can read, or have them transferred.
- Objection (Art. 21): to object to processing based on our legitimate interest.
- Automated decisions (Art. 22): not to be subject to decisions made by a machine alone. As explained in section 7, we make none today.
- Withdrawal of consent (Art. 7): to withdraw it whenever you like, without affecting what was done before.
To exercise them write to privacy@brindeasy.it, stating which right you want to exercise. We reply within one month of the request; if it is complex we may take two more months, but we will tell you within the first. We charge nothing for this, except for manifestly excessive or repeated requests.
10. Complaints to the supervisory authority
If you believe the processing of your data breaches the Regulation, you can contact the supervisory authority without having to come to us first:
Garante per la protezione dei dati personali
Piazza Venezia 11, 00187 Roma, Italy
www.garanteprivacy.it ·
protocollo@gpdp.it
You can also bring the matter before the courts.
11. Data Security
- SSL/TLS encrypted connection across the whole site
- Payments handled exclusively by PCI-DSS certified providers
- Access to data limited to authorised staff
- Regular backups and monitoring systems
12. International Transfers
Data are processed mainly within the European Union. Any transfers to third countries take place with the safeguards provided by the GDPR (standard contractual clauses or adequacy decisions).
13. Changes to this Policy
We may update this policy. If there are substantial changes we will inform you by email. The current version is always available on this page.
14. Contact
- Privacy email: privacy@brindeasy.it
- General email: info@brindeasy.it
- Address: Via Giovanni XXIII 38, 72100 Brindisi (BR), Italy