Last updated: 2 September 2026
1. Who we are
NuAdventure Tour Operator
Registered office: Ferrara (FE), Italy
VAT (P.IVA): 01661160919 – REA: FE-252808
Email: info@nuadventure.nu
Phone: +39 347 934 8615
We are the data controller for the personal data described below. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. For any privacy matter, write to info@nuadventure.nu.
2. What this policy covers
This policy explains how we handle personal data collected through this website, our enquiry and booking forms, our newsletter, and our direct communications with you. Cookies and similar tracking technologies are described separately in our Cookie Policy.
3. What we collect, why, and on what legal basis
3.1 Booking and participation in our tours
Data: full name, email address, phone number, date of birth, gender, nationality, preferred contact method, selected tour and departure date, number of participants, room preference, previous experience with similar activities, self-assessed fitness level, travel insurance provider and policy number, emergency contact (name, phone number, relationship), and anything else you choose to write to us.
Why: to evaluate and manage your booking request, organise and deliver the tour, communicate with you before and during the trip, and meet our obligations as a tour operator.
Legal basis: performance of a contract and pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); compliance with legal obligations in tax, accounting and travel regulation (Art. 6(1)(c) GDPR).
3.2 Health, dietary and accessibility information
Data: medical conditions, allergies, dietary restrictions and preferences, and any accommodation or accessibility needs you tell us about.
Why: our tours involve hiking, water sports, sailing and remote locations. We need this information to keep you safe, to brief guides and local partners, and to arrange suitable meals and accommodation.
Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given when you tick the consent box on the booking form. In a medical emergency we may also process this information to protect your vital interests or those of another person (Art. 9(2)(c) GDPR).
Providing this information is voluntary. If you prefer not to, we may be unable to confirm your participation in certain activities or to meet specific requirements. You can withdraw your consent at any time by writing to info@nuadventure.nu; withdrawal does not affect processing carried out beforehand.
3.3 Information about other people
When you give us someone else’s details — an emergency contact, or a fellow traveller you are booking for — you confirm you are entitled to do so. We use those details only to manage the booking or to reach that person in an emergency. Please make them aware of this policy: under Art. 14 GDPR they have the same rights set out in section 8.
3.4 Enquiries and quote requests
Data: name, email address, phone number and the content of your message, whether sent through our forms, by email, by phone or via WhatsApp.
Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering people who contact us (Art. 6(1)(f) GDPR).
3.5 Newsletter and marketing communications
Data: first name, last name, email address.
Why: to send you news about our tours, departures, offers and content.
Legal basis: your consent (Art. 6(1)(a) GDPR). Every email contains an unsubscribe link, and you can also write to info@nuadventure.nu at any time.
3.6 Browsing data and cookies
When you visit this website, technical data such as your IP address, browser and device details, pages viewed and interactions are collected by our systems and by third-party tools. Each cookie and tracker, its purpose, its provider and its duration are listed in the Cookie Policy.
Legal basis: our legitimate interest in the secure and correct operation of the site, for strictly necessary technical cookies (Art. 6(1)(f) GDPR). Analytics, marketing and third-party content cookies require your consent (Art. 6(1)(a) GDPR).
4. Who we share your data with
We do not sell your personal data. We share it only with:
- Local partners and suppliers who deliver the tour — guides, skippers, instructors, accommodation, transport and restaurants. They receive only what they need, which may include dietary or medical information relevant to your safety.
- Partner tour operators, where you booked through one of them. In that case the partner is an independent data controller for its own relationship with you.
- Service providers acting as data processors on our behalf: web hosting and infrastructure, Cloudflare (security and content delivery), HubSpot (CRM, forms and email), MailerLite (newsletter), Typeform (booking form), and analytics and advertising platforms.
- Insurers, banks and payment providers, accountants and legal advisers, where necessary.
- Public authorities, where we are legally required to disclose.
An up-to-date list of our processors is available on request.
5. Transfers outside the EU/EEA
Some of our providers — including Google, Meta, HubSpot, Typeform and Cloudflare — may process data in the United States or other countries outside the European Economic Area. Where this happens, the transfer is covered by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified) or by Standard Contractual Clauses adopted by the Commission, with additional safeguards where needed. You can request details or a copy of these safeguards by writing to info@nuadventure.nu.
6. How long we keep your data
- Booking and contract data: 10 years from the end of the trip, as required by Italian tax and accounting law.
- Health, dietary and accessibility information: deleted within 12 months of the end of the tour, unless needed to establish or defend a legal claim.
- Enquiries that do not lead to a booking: 24 months from the last contact.
- Newsletter data: until you unsubscribe, plus 12 months as proof of consent.
- Browsing data and cookies: as stated in the Cookie Policy.
7. How we protect your data
The site runs over encrypted connections (HTTPS). Access to booking data is restricted to the people who need it, and we work with providers that offer appropriate security guarantees. No system is completely secure, but we apply technical and organisational measures proportionate to the risk.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your data and obtain a copy;
- have inaccurate data corrected;
- have your data erased, where the conditions apply;
- restrict how we process your data;
- receive your data in a portable format and have it transmitted to another controller;
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing carried out beforehand.
To exercise any of these rights, write to info@nuadventure.nu. We will respond within one month. You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority in your country of residence.
9. Children
Our tours are for adults: the minimum age for participation is 18. We do not knowingly collect personal data from minors through this website. If you believe a minor has provided us with data, please write to us and we will delete it.
10. Automated decision-making
We do not make decisions about you by automated means that produce legal or similarly significant effects. We do use analytics and advertising tools that build profiles of browsing behaviour for marketing purposes; these operate only with your consent, as described in the Cookie Policy.
11. Changes to this policy
We may update this policy to reflect changes in our activities or in the law. The date at the top always shows the latest version. If we make material changes, we will make them visible on this page and, where appropriate, notify you directly.
