Legal information

Privacy policy

How VeniceAround by Daniela Zarpellon handles the personal data of people who visit the website, ask for a quote or join a private tour in Venice, Italy.

Last updated: October 21, 2026 · Version 1.4

In short

How does VeniceAround.it handle personal data?

VeniceAround.it processes personal data only to answer inquiries, organize private tours and comply with legal obligations. The data controller is Daniela Zarpellon, a licensed tourist guide. The website uses no profiling or advertising tools, counts visits with anonymous, cookie-free internal statistics and uses Google Analytics 4 and Microsoft Clarity, for aggregated statistics on visits and usability, only if you accept; it keeps proof that you have read this policy and keeps your inquiry only in a private area reserved for Daniela, for the periods stated below. You can exercise your rights by writing to daniela@venicearound.it.

This translation is provided for convenience; in case of discrepancy the Italian version prevails.

Who processes your data

Data controller and contact details

The controller of the personal data collected through the VeniceAround.it website and in the course of the guiding service is Daniela Zarpellon, owner of the sole proprietorship VeniceAround by Daniela Zarpellon, a tourist guide entered in the Elenco nazionale delle guide turistiche (National Register of Tourist Guides) under no. 05000058.

VAT number (Partita IVA): 03934120241
Registered address: [TO BE COMPLETED: full address of the registered office or professional domicile], Vicenza
Email: daniela@venicearound.it
Phone and WhatsApp: +39 338 4103735
PEC (certified email): [TO BE COMPLETED: PEC address, if any]

For any request concerning your personal data, please write to the email address above. VeniceAround is a one-person business: requests are read and handled by Daniela herself. The same business also runs the sister site GiraVicenza.it, dedicated to tours of Vicenza.

Scope

Who this policy applies to

This policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 (Codice privacy, the Italian Personal Data Protection Code), and applies to:

anyone who visits the VeniceAround.it website;
anyone who sends an inquiry through the website form, by email, by phone or on WhatsApp;
anyone who receives a quote and takes part in a private tour in Venice, its lagoon or the Veneto, or in the Venice Stay Design planning service, including members of the party, families with children and, for school groups on request, teachers and pupils;
anyone who reports a problem, makes a complaint or exercises their privacy rights.

The website has no private areas for visitors, does not sell services online, sends news by email only to people who subscribe and confirm their subscription (see Newsletter) and uses no profiling or advertising tools. It uses two analytics tools, Google Analytics 4 and Microsoft Clarity, only with your consent (see Browsing the website). It also uses anonymous, aggregated internal statistics, without cookies and without storing IP addresses (see Anonymous internal statistics). Should anything change, we will update this page first.

What data

What personal data we process and where it comes from

We process only the data needed to reply to you and organize the tour:

Browsing data: IP address, date and time of the request, page visited, browser and device type, recorded automatically by the server hosting the website.
Anonymous internal statistics (DV Insight 360): aggregated counts per day and per page of visits, clicks and other actions, without cookies, IP addresses or identifiers, which cannot be traced back to the person who visited the website.
Statistical data, only if you accept analytics cookies: pseudonymous identifiers in the Google Analytics cookies, pages viewed, referral source, device and browser type, approximate geographic area and anonymous events such as sending the form or clicking on the email, phone and WhatsApp links, without the content of the messages.
Usage data for Microsoft Clarity, only if you accept analytics cookies: pseudonymous identifiers in the Clarity cookies, interactions with the pages (clicks, scrolling, pointer movements), pages viewed, device and browser type and approximate geographic area, used for heatmaps and session recordings; text typed into forms and sensitive content are masked.
Contact and inquiry data: name, email, phone or WhatsApp number (optional), dates, number of guests, tour or service of interest, language and the text of your message.
Accessibility needs, only if you choose to tell us (optional field).
Data for the quote and the tour: lead contact name, contact details, party composition, meeting point and any bookings to be made with third-party sites and services, such as museums, licensed boat or water taxi operators or, for day trips, a car with driver.
Administrative and tax data: the data needed to issue the tax document and record payments.
Images, only in the cases described in the section on photographs.

As a rule, the data comes directly from you. It may also come from third parties when one person books on behalf of a family or group of friends, when a school organizes a visit for a group, or when you book through a third-party platform, which passes on to us the data needed for the service. Anyone who provides data about other people must have informed them and should give us only what is necessary.

Please do not enter unnecessary data in the free-text fields: no diagnoses, identity documents, payment details or information about other people that is not needed to organize the tour.

Why and on what basis

Purposes, legal bases and retention periods

For each processing activity we set out its purpose, the legal basis under Article 6 GDPR and how long we keep the data. Each case is described in more detail in the sections that follow.

Processing	Purpose	Legal basis	Retention
Browsing the website	Operation, security, prevention of abuse	Legitimate interest (Art. 6(1)(f))	Server logs: [TO BE COMPLETED: period set by the hosting provider]. Spam check: 30 minutes at most
Anonymous internal statistics (DV Insight 360)	Measuring, in aggregated form, how the website is used, how the pages perform and its security	Legitimate interest (Art. 6(1)(f))	Aggregated counts: 25 months. Technical log of contact clicks: 13 months. Abuse check: about 90 seconds
Cookie preferences	Remembering and documenting the choices made in the panel	Legitimate interest in demonstrating lawful processing (Art. 6(1)(f), Art. 5(2))	12 months
Statistics (Google Analytics 4)	Aggregated statistics on visits and contact requests	Consent (Art. 6(1)(a); Article 122 of the Codice privacy), which can be withdrawn at any time	User- and event-level data: 2 months (period set in Google Analytics). `_ga` and `_ga_<ID>` cookies: up to 2 years, unless withdrawn or deleted
Statistics and usability (Microsoft Clarity)	Aggregated statistics on how the website is used, heatmaps and session recordings to improve usability	Consent (Art. 6(1)(a); Article 122 of the Codice privacy), which can be withdrawn at any time	According to Microsoft: recordings 30 days (favorites and a random sample up to 9 months), heatmaps and aggregated data 9 months. Clarity cookies: up to 1 year, unless withdrawn or deleted
Inquiry form	Replying and preparing a proposal	Pre-contractual steps at your request (Art. 6(1)(b))	Proof of acknowledgment: 24 months. Inquiries with no follow-up: [TO BE COMPLETED: period, for example 24 months from last contact]
Email, phone, WhatsApp	Replying, agreeing on the quote and details	Pre-contractual steps and contract (Art. 6(1)(b))	As for inquiries; if the tour takes place, as for contractual documents
Quote and delivery of the tour	Providing the agreed guiding or planning service	Contract (Art. 6(1)(b))	10 years from completion of the service
Tax and accounting obligations	Tax documents, bookkeeping, statutory filings	Legal obligation (Art. 6(1)(c))	10 years, in accordance with civil and tax law
Accessibility needs	Adapting the route and arrangements	Pre-contractual steps and contract; for any health data, explicit consent (Art. 9(2)(a))	Until the tour has taken place, then deleted from organizational notes
Reviews on third-party platforms	Presenting the reputation of the service fairly	Legitimate interest (Art. 6(1)(f))	For as long as the content is published on the website
Photographs for promotional purposes	Showing what the tours are like on the website or VeniceAround's channels	Consent (Art. 6(1)(a))	Until consent is withdrawn
Complaints and privacy requests	Handling and documenting the response	Legal obligation and legitimate interest (Art. 6(1)(c) and 6(1)(f))	Until closed; if linked to a service, 10 years
Protection of rights	Defending or asserting a right in the event of a dispute	Legitimate interest (Art. 6(1)(f))	For the duration of the dispute and the applicable limitation periods
Newsletter (news by email)	Sending new VeniceAround news to subscribers	Consent (Art. 6(1)(a)), which can be withdrawn at any time	Until you unsubscribe; proof of subscription, confirmation and unsubscription is kept for 24 months after unsubscribing

Website

Browsing the website, statistics, browser storage and spam protection

When you visit the website, the server automatically records certain technical data (IP address, date and time, page requested, browser) needed to display the pages and for security. This data is not used to identify you, nor is it combined with other data.

The website does not use profiling cookies, external Google Fonts (the fonts are hosted on our own server) or embedded maps. Where a page includes a video from YouTube or Vimeo, the player loads only after you click on it. In your browser's local storage the website saves two technical items, your choices in the preferences panel (va_consent) and the state of the language bar (va_lb), and, only if DV Insight 360 pop-ups, the assistant or invitations are active, the fact that you have already seen or closed them, so that they are not shown again. WordPress cookies are set only for people who log in to the administration area. Full details are in the cookie policy.

When you save your cookie preferences, the website records a random pseudonymous identifier, the date and time, the policy version and the choices made, together with a fingerprint of your IP address produced by a truncated hash function: the IP address itself is not stored in clear. These records are kept for 12 months. How the log works is explained on the consent and preferences log page.

The inquiry form is protected by an in-house anti-spam system: a hidden field, a temporary token and a limit on the number of submissions, calculated on a fingerprint (hash) of the IP address that is kept for no more than 30 minutes. We do not use external anti-spam services or third-party CAPTCHAs.

Statistics with Google Analytics 4

Only if you give consent in the banner ("Accept statistics") or in the cookie preferences does the website use Google Analytics 4, installed through the "Site Kit by Google" plugin, to obtain aggregated statistics on visits and contact requests: form submissions and clicks on the email, phone and WhatsApp links are counted as anonymous events, without the content of the messages or the data entered in the form. Before consent the Google Analytics script is not loaded at all, and Google Consent Mode is set to "denied" by default. Your consent is recorded in the consent log.

Processor: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Legal basis: consent (Art. 6(1)(a) GDPR and Article 122 of the Codice privacy).
Our configuration: Google Signals switched off, no advertising features, no ads personalization, no data sharing for advertising purposes. According to Google, Google Analytics does not log or store the IP addresses of users in the EU, Switzerland and the UK: it uses them only to derive an approximate location and then discards them.
Retention: the data-retention period set in Google Analytics, 2 months; cookies up to 2 years.
Transfers: possible transfer to Google LLC in the United States, on the basis of the EU-U.S. Data Privacy Framework (Google LLC is certified) and standard contractual clauses.
Withdrawal: at any time from the "Cookie preferences" link in the footer; you can also use the Google Analytics opt-out browser add-on. How Google processes data: Google privacy policy.

Statistics and usability with Microsoft Clarity

With the same consent to analytics, the website also uses Microsoft Clarity, installed through the official "Microsoft Clarity" plugin, to obtain aggregated statistics on how the website is used, heatmaps and recordings of browsing sessions, which help us understand what is unclear or awkward and improve usability. Text typed into forms and sensitive content on the pages are masked and do not appear in the recordings. Before consent the Clarity script stays blocked and is not executed; after consent the website sends Clarity the consent signal (Consent API v2) with analytics granted (analytics_Storage) and advertising denied (ad_Storage). Your consent is recorded in the consent log.

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which according to Microsoft's documentation acts as a data controller for Clarity data.
Legal basis: consent (Art. 6(1)(a) GDPR and Article 122 of the Codice privacy).
Our configuration: no advertising use, advertising consent signal always denied, Clarity's "Brand Agents" advertising feature switched off, content masking on.
Retention: according to Microsoft, recordings 30 days (favorited recordings and a random sample up to 9 months), heatmaps and aggregated data 9 months; cookies up to 1 year, listed in the cookie policy.
Transfers: possible transfer to Microsoft Corporation in the United States, on the basis of the EU-U.S. Data Privacy Framework (Microsoft participates in it) and standard contractual clauses.
Withdrawal: at any time from the "Cookie preferences" link in the footer. How Microsoft processes data: Microsoft privacy statement and Microsoft Clarity terms of use.

Anonymous internal statistics with DV Insight 360

To know, in aggregated form, which pages are read and how the website is used, VeniceAround.it uses DV Insight 360, a plugin by DVweb Marketing that counts visits directly on the website's server, without cookies and without external analytics services. The counting script saves nothing on your device, does not record your IP address or any identifier of the visitor or browser, and is not loaded for people logged in to the administration area; legal pages are not counted. Data are stored only as counters per day and per page:

pages viewed, time slot of the visit, time spent on the page and how much of the page is read;
clicks on buttons and links (destination address and link text), including email, phone, WhatsApp and map links, without the content of any message, and use of the inquiry form (seen, started), without the data entered;
device type (computer, tablet or smartphone) and browser language;
where the visit comes from, only as a category (search engine, AI assistant, social network) or the name of the referring website, never the full address;
page speed measured in the browser (Core Web Vitals), recorded only as a good, needs-improvement or poor rating;
pages not found (404 errors) with the referring website, words searched on the website, and visits by automated programs of search engines and artificial intelligence services (crawlers), recognized by the program name.

For clicks on email, phone, WhatsApp and map links the plugin also keeps a technical log with the type of click, the page, the date and the time, without any visitor data. To prevent abuse, the number of signals sent by the same browser is limited using a temporary fingerprint (hash) of the IP address, deleted after about 90 seconds and never stored with the statistics. Words searched on the website are counted as text: please do not enter personal data there.

Legal basis: legitimate interest in measuring, in aggregated form, how the website is used and in ensuring its operation and security (Art. 6(1)(f) GDPR). These are first-party, anonymous and aggregated statistics, without cookies and without combining them with other data: under the Garante's Guidelines of June 10, 2021 they do not require consent. You can still object by writing to daniela@venicearound.it.
Where they are stored: in the website's database, on the hosting server of Aruba S.p.A.; they are not disclosed to third parties or used for profiling or advertising.
Retention: aggregated counts are deleted automatically after 25 months, the technical log of contact clicks after 13 months.

From the server, without any visitor data, the plugin also uses some external services to check the website: Google PageSpeed Insights and the Bing Webmaster Tools API (Microsoft) receive only public addresses of the pages or of the website, to measure speed and read search data; IndexNow (api.indexnow.org) receives the public addresses of pages that are published or updated, only if the website does not already use another IndexNow tool. The plugin also shows the site administrator the Google Search Console data described below and periodically checks that the website is reachable and that its security certificate is valid.

Google Search Console

Daniela uses Google Search Console to check how the website appears in Google search results, for example which pages are indexed and which searches lead to the website. Search Console sets no cookies and loads no scripts in visitors' browsers.

Technical tools used by the website

The website, built with WordPress and hosted by Aruba S.p.A., also uses some technical plugins. None of them is used to profile visitors or to collect statistics:

Rank Math SEO: manages page metadata (titles, descriptions, sitemap) for search engines; it sets no cookies for visitors.
IndexNow: when a page is published or updated, it notifies search engines that support the IndexNow protocol (for example Bing and Yandex) of the page's public address; participating engines share these notifications with one another. Only public page addresses and a site verification key are sent, no personal data about visitors.
UpdraftPlus: makes backup copies of the website, which may contain personal data stored on the website, such as contact requests and consent records. Backups are made for security and service continuity, on the basis of legitimate interest (Art. 6(1)(f) GDPR), and are kept only for the time needed for the backup rotation. They are stored on the hosting server and, if configured, with a remote storage service acting as a processor.
WP-Optimize and Aruba HiSpeed Cache: cache and optimize pages to make them faster; they set no profiling or analytics cookies.
Elementor: a page-building tool; it sets no tracking cookies on public pages.

Inquiries

Inquiry form, email, phone and WhatsApp

Inquiry form

The form on the contact page asks for your name, email, phone or WhatsApp number (optional), dates, number of guests, tour of interest, language, message and any accessibility needs (optional). Your name and email are needed to reply; without them we cannot handle the inquiry.

The required checkbox is there to confirm that you have read this policy: it is not consent and does not authorize any promotional messages. When you submit the form, the inquiry is sent by email to daniela@venicearound.it and you receive an automatic copy of your request at the address you entered. The website keeps the proof of acknowledgment (date and time, policy version, the sender's email and an inquiry reference) for 24 months. The inquiry (the data entered in the form) is also recorded in the website's private area, accessible only to Daniela Zarpellon and the people she authorizes, in order to handle it and reply; it is kept for the same period as inquiries shown in the table and then deleted.

Email and phone

If you write or call directly, we use your contact details and the information you give us to reply within 24 hours, prepare your free, no-obligation quote and, if you confirm, organize the tour. We do not use your contact details for promotional communications.

In the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited, a Meta group company, which processes data as an independent controller under its own privacy policy. Using it to contact us is your choice: you can use email or phone instead. Conversations remain on Daniela's device and in WhatsApp's systems; they may involve transfers of data to the United States, which Meta states it carries out under the EU-U.S. Data Privacy Framework or standard contractual clauses.

Tours

Quotes, the tour itself and tax obligations

To prepare the quote and deliver the tour, we process the lead contact name, contact details, dates, language, number and composition of the party and the meeting point. Prices are not published on the website: every tour is tailor-made and receives a written quote stating the fee, duration, language, number of guests and what is included or excluded, as set out in the terms of the guiding service.

VeniceAround sells its own guiding and planning services only. When the tour requires admission to museums, churches or other sites, a private boat or water taxi (always from licensed operators) or, for day trips in the Veneto, a car with driver, we pass on to the operator only the data needed (usually a name, the number of people, the date and time), at your request. These operators process the data as independent controllers under their own privacy policies.

To issue tax documents, record payments and meet accounting obligations, we process the data required by law. This data is kept for 10 years and may be disclosed to our tax adviser and to the Italian tax authorities.

If you booked through a third-party platform, the platform passes on to us the data needed to deliver the tour and processes your data under its own privacy policy.

Sensitive data

Accessibility needs and health information

The accessibility field is optional. Please describe only the practical need, for example avoiding bridges with many steps, taking breaks or using a wheelchair, without giving any diagnosis or clinical details.

If the information you choose to give us reveals data concerning health, we process it solely to adapt the itinerary and arrangements for the tour, on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you may withdraw at any time without affecting your ability to request a tour. We do not disclose it to third parties, except where we need to ask a site or a boat operator about access or aids; in that case we describe only the practical need, without identifying details unless they are necessary.

Once the tour has taken place, we delete this information from our organizational notes. If it is contained in an email or chat kept for other reasons, you can ask us to delete it. More information is available on the website and tour accessibility page.

Families and schools

Children, families and school groups

The website is not aimed at children and does not knowingly collect data from children under 14 through the form: inquiries for families with children or teenagers must be sent by an adult.

For family tours we ask, at most, for the number and, where useful for the arrangements or tickets, the approximate age of any guests under 18.

For school groups, which are organized on request, the point of contact is the teacher or the school. We ask for pupils' names only when a site requires them for the booking; in that case the school provides them and we use them solely for that booking. We do not carry out marketing or profiling aimed at children.

Images

Photographs taken during tours

During a tour Daniela may take photographs with your device, at your request: in that case the images remain yours and are not processed by VeniceAround.

Taking part in a tour does not imply any consent to the publication of your image. If Daniela wishes to use a photograph in which you can be recognized on the website or other VeniceAround channels, she will ask you first, specifically, and will use it only with your consent. For children, consent is required from the person with parental responsibility; for school groups, through the school.

You can withdraw your consent at any time by writing to daniela@venicearound.it: we will remove the image from the channels we manage directly as soon as possible. If you do not wish to appear in any image, simply say so before the tour begins.

Reputation

Reviews published on third-party platforms

On the website we show the overall rating and some short excerpts taken from Daniela's public profile on ToursByLocals, giving the author's first name and last initial as they appear on the platform, with the date and the source. We do so on the basis of our legitimate interest in presenting the reputation of the service fairly and verifiably.

Reviews are written and managed on the platform, which processes the data as an independent controller. If you are the author of a quoted review and would prefer it not to appear on the website, write to us and we will remove it. The method we follow is described on the how we display reviews page.

Who receives the data

Recipients of the data

The data is processed by Daniela Zarpellon and is neither sold nor made public. It may be received, only to the extent necessary, by:

Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy, the website's hosting provider, which processes data on our behalf as a processor (Art. 28 GDPR);
[TO BE COMPLETED: email service provider for daniela@venicearound.it], as a processor;
[TO BE COMPLETED: any technician or agency responsible for website maintenance], as a processor, limited to technical work;
our tax adviser or accountant, for statutory obligations;
operators of museums, churches and other sites, licensed boat and water taxi operators, car-with-driver services for day trips and other suppliers you choose to use, as independent controllers;
Google Ireland Limited, for Google Analytics 4, only if you accept analytics cookies, as a processor (Art. 28 GDPR);
Microsoft Ireland Operations Limited, for Microsoft Clarity, only if you accept analytics cookies, as a data controller according to Microsoft;
WhatsApp Ireland Limited, if you contact us on WhatsApp, as an independent controller;
booking platforms, if you booked through one of them, as independent controllers;
banks and payment institutions, for collecting payments;
public authorities, where required by law.

An up-to-date list of processors is available on request.

Outside the EU

Transfers of data outside the European Economic Area

The website's data is hosted on servers located in [TO BE COMPLETED: country where the hosting provider's servers are located]. Except as stated below, VeniceAround does not intentionally transfer data outside the European Economic Area.

Some services you choose to use may involve transfers to third countries, in particular the United States: Google Analytics, if you accept statistics (possible transfer to Google LLC), Microsoft Clarity, if you accept statistics (possible transfer to Microsoft Corporation), WhatsApp (Meta group), YouTube or Vimeo if you start a video and, where applicable, [TO BE COMPLETED: email provider, if based or with servers outside the EEA]. In these cases the transfer is based on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified companies, or on standard contractual clauses (Articles 45 and 46 GDPR). You can ask us for information about the safeguards applied.

Protection

How we protect your data

The website uses an encrypted connection (HTTPS). The consent log stores pseudonymous identifiers and IP fingerprints rather than IP addresses in clear, and inquiries are kept only in the website's private area, for the periods stated above. Access to the administration area is restricted. We do not take decisions based solely on automated processing and we do not carry out profiling.

Your rights

Your rights and complaints to the Garante

At any time you may request access to your data, its rectification or erasure, the restriction of processing and the portability of the data you have provided to us, or object to processing based on legitimate interest (Articles 15-21 GDPR). Where processing is based on consent, you may withdraw it whenever you wish, without affecting processing already carried out; consent to statistics can be withdrawn from the "Cookie preferences" link in the footer.

To exercise your rights, write to daniela@venicearound.it. We reply without undue delay and in any event within one month, which may be extended by two further months in complex cases, as provided by Article 12 GDPR. We may ask you for some information to verify your identity.

If you believe that the processing infringes data protection law, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work, or bring proceedings before the courts.

Updates

Changes to this policy

This is version 1.4 of the privacy policy of VeniceAround.it, in force from October 21, 2026. If the processing, tools or suppliers change, we update this page and the date at the top, and keep the previous versions. The version in force is also shown in the consent and preferences log.

Transparency

Other legal and practical information

For questions about this page, write to daniela@venicearound.it or visit the contact page. Practical information about private tours, quotes and tickets is on the how tailor-made tours and quotes work page.