Privacy Policy

1. Controller

The controller is:

• Controller: Ricasoli Swiss SA
• Registered office: Via Giacometti 1, 6900 Lugano, Switzerland
• UID: CHE-410.717.248
• E-mail: info@ricasoligroup.ch

The Controller has not appointed a data protection advisor under Art. 10 FADP or a data protection officer (DPO) under Art. 37 GDPR. Any request concerning the processing of personal data may be sent to the email address above.

2. Representative in the European Union

As the Controller also offers services to individuals in the European Union, it has designated the following representative under Art. 27 GDPR: Ricasoli Swiss SA, Via Giacometti 1, 6900 Lugano, Switzerland.

3. Categories of personal data

The Controller processes the following categories of personal data:

• Contact and identification data — first name, surname, email address, telephone number and any other information voluntarily provided through the Website forms, by email, telephone or messaging;
• Enquiry and booking data — details of the trip or service requested, dates, number of guests or passengers, preferences and any information needed to provide the service;
• Traveller and travel document data — where required for the service (e.g. air ticketing or private flights): date of birth, nationality, passport or identity document details, any visa information, including for companions named by the client;
• Sensitive personal data — only if voluntarily provided by the client and to the extent necessary for the service (e.g. assistance needs of persons with reduced mobility or health-related dietary requirements);
• Payment and billing data — billing details and transaction data. Full card details are entered directly with the payment service provider and are not stored by the Controller;
• Browsing data — data collected automatically while browsing (e.g. IP address, browser and device type, pages visited, date and time of access);
• Data collected through cookies and similar technologies — as described in the Cookie Policy.

Clients who provide personal data of third parties (e.g. other travellers) must inform them of this Privacy Policy.

4. Purposes and legal bases of processing

The Controller processes personal data in accordance with the principles of Art. 6 FADP. Where required, processing is justified by consent, by an overriding private or public interest or by law (Art. 31 FADP). For individuals to whom the GDPR applies, the legal basis is stated for each purpose.

• Responding to enquiries — handling requests for information and quotations. GDPR: pre-contractual measures and legitimate interest in responding (Art. 6(1)(b) and (f)).
• Providing services and managing bookings — arranging and booking the requested services with suppliers and assisting the client before, during and after the trip. GDPR: performance of a contract (Art. 6(1)(b)); for health data, explicit consent (Art. 9(2)(a)).
• Payment processing and accounting — processing payments and complying with accounting and tax obligations. GDPR: performance of a contract and legal obligation (Art. 6(1)(b) and (c)).
• Legal compliance — complying with obligations under the law or orders of public authorities, including passenger data reporting obligations. GDPR: legal obligation (Art. 6(1)(c)).
• Website operation and statistics — ensuring the security of the Website and, with consent, analysing its use as described in the Cookie Policy. GDPR: legitimate interest (Art. 6(1)(f)) and consent (Art. 6(1)(a)).
• Protection of rights — establishing, exercising or defending legal claims in or out of court. GDPR: legitimate interest (Art. 6(1)(f)).

The Controller does not make automated individual decisions within the meaning of Art. 21 FADP and Art. 22 GDPR.

5. Whether providing data is mandatory

Providing the data requested through the Website forms is voluntary; however, if the data marked as mandatory is not provided, it will not be possible to handle the request or provide the service. The processing of browsing data is described in the Cookie Policy.

6. Recipients of personal data

For the purposes described above, personal data may be disclosed to the following categories of recipients, acting either as processors on behalf of the Controller (Art. 9 FADP; Art. 28 GDPR) or as independent controllers:

• travel service suppliers — airlines, aircraft and helicopter operators, hotels and other accommodation providers, chauffeur services, yacht and car rental companies, event organisers and other providers engaged to perform the booked service, which process the data as independent controllers;
• booking systems — the global distribution systems (GDS) and booking platforms used;
• technical and hosting service providers for the Website — Vercel, Supabase, GitHub;
• email, form-management and analytics/marketing providers — such as Google (Google Tag Manager, Google Analytics, Google Ads), Microsoft (Clarity) and Meta, used subject to consent as described in the Cookie Policy;
• Stripe — payment service provider processing card payments in accordance with the PCI-DSS standard;
• Ricasoli group companies — Ricasoli Group S.r.l. (Milan), to the extent necessary for administration and service delivery;
• advisers and professionals (e.g. accounting, tax and legal), to the extent necessary to perform their engagement;
• public authorities, where required by law or by an order of a public authority.

7. Disclosure of personal data abroad

Personal data may be disclosed abroad, in particular to the Member States of the European Union and the European Economic Area, the United States of America and, for the performance of travel services, to the country of destination or of the supplier’s seat, which may be located anywhere in the world.

Disclosure takes place to countries recognised by the Swiss Federal Council as providing an adequate level of data protection (Art. 16(1) FADP and Annex 1 to the Data Protection Ordinance, DPO) — including the EU/EEA Member States — or, in the absence of such protection, on the basis of appropriate safeguards, such as the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission, or the recipient’s certification under the Swiss-U.S. Data Privacy Framework. Where such safeguards are not available, data is disclosed only if this is necessary for the conclusion or performance of the contract with the client or in the client’s interest, for example to book a hotel in the country of destination (Art. 17(1)(b) FADP; Art. 49(1)(b) and (c) GDPR). A copy of the safeguards in place may be requested from the Controller.

8. Retention period

Personal data is retained for as long as necessary to achieve the purposes for which it was collected, and in particular:

• data collected through the Website forms that does not lead to a booking is retained for as long as necessary to handle the request and thereafter for a maximum of 24 months;
• contract, payment and billing data is retained for ten years, in line with the statutory retention obligation for accounting records (Art. 958f of the Swiss Code of Obligations);
• data processed to comply with other legal obligations is retained for the period required by applicable law;
• data needed to protect legal rights is retained until the relevant limitation periods have expired.

9. Data security

The Controller implements technical and organisational measures appropriate to the risk to protect personal data against unauthorised access, loss, destruction or alteration (Art. 8 FADP; Art. 32 GDPR).

10. Rights of data subjects

Within the limits provided by law, data subjects have the right to: obtain information about their personal data (Art. 25 FADP; Art. 15 GDPR); request its rectification if inaccurate; request its erasure or destruction; object to processing; receive or have their data transmitted in a commonly used electronic format (Art. 28 FADP; Art. 20 GDPR); and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Individuals to whom the GDPR applies also have the right to restriction of processing (Art. 18 GDPR).

These rights may be exercised by writing to the Controller’s email address. The Controller may request proof of identity to prevent disclosure to unauthorised persons.

Data subjects may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch). Individuals in the European Union may also lodge a complaint with the supervisory authority of the Member State in which they reside, work or where the alleged infringement took place (e.g. in Italy, the Garante per la protezione dei dati personali).

11. Changes to this Privacy Policy

The Controller may amend or update this Privacy Policy at any time by publishing the new version on the Website. The version in force is the one published on this page at the time of consultation.