Privacy Policy

1. Controller and contact details

Apulian Experiences acts as the data controller for the personal data described in this notice in relation to operation of the platform. For privacy requests, data-rights requests, or questions about this notice, contact [email protected].

We do not currently publish a separate data protection officer contact. If the legal or operational setup changes and a DPO contact becomes required, this notice will be updated accordingly.

2. Categories of personal data we process

• Account and identity data: name, email address, preferred language, password-authentication data handled through our authentication provider, and role/profile information.
• Host and listing data: business contact details, location data, listing descriptions, images, operational notes, claim requests, provider profile details, and moderation history.
• Booking, inquiry, and messaging data: request details, participant counts, preferred dates, message content, thread metadata, and booking-management status data.
• Technical and usage data: IP-related security logs, session data, browser/device information, cookie or local-storage preferences, and analytics events where enabled with the appropriate legal basis.
• Publicly sourced professional data: publicly available experience, venue, and business-contact information used to create editorial listings and invite the relevant provider to claim, correct, or request removal of a listing.

3. Sources of personal data

We collect data directly from you when you fill in forms, create an account, send messages, submit requests, update a profile, claim a listing, or contact support.

We also receive data from technical service providers that support authentication, hosting, analytics, transactional communications, and platform security.

For provider and listing discovery, we may collect professional information from publicly accessible sources such as official business websites, public listing pages, social profiles used for business, and other publicly available materials relating to local experiences in Puglia.

4. Purposes and legal bases

• To create and manage accounts, authenticate users, and maintain account security: performance of a contract or pre-contractual steps, and our legitimate interest in securing the service.
• To publish, moderate, assign, and manage experience listings and provider profiles: performance of a contract where applicable, and our legitimate interest in operating and improving the platform.
• To handle booking requests, contact requests, and in-platform messaging between travelers and hosts: performance of a contract or pre-contractual steps.
• To review claim requests, prevent abuse, enforce platform rules, maintain logs, and protect users and the platform: our legitimate interests and, where applicable, compliance with legal obligations.
• To use publicly available professional provider data to create editorial draft listings and invite the relevant provider to claim or correct them: our legitimate interest in building and maintaining a reliable local-experience directory, subject to your right to object.
• To send service and transactional communications, including verification, password reset, request-related updates, moderation notices, and account notices: performance of a contract or pre-contractual steps.
• To operate non-essential analytics or similar measurement tools: consent where required by applicable ePrivacy or data-protection rules.

5. When providing data is necessary

Some data is necessary to use the service. For example, we need account credentials to register and authenticate you, contact details to respond to support requests, and core booking or messaging details to route requests to the appropriate host.

If you choose not to provide mandatory data, we may be unable to create your account, process a request, assign or verify a host profile, or provide the relevant platform functionality.

6. Recipients and processors

We share personal data only where necessary and proportionate to operate the service. Recipients may include hosting and infrastructure providers, authentication and database providers, email delivery providers, analytics providers, customer-support tools, and professional advisers where needed for legal, security, or operational reasons.

We may also share limited data with other users when that is inherent to the service, for example when a traveler sends a request to a host or when a host replies through platform messaging.

We do not sell personal data and we do not disclose personal data to third parties for their own unrelated advertising purposes.

7. International transfers

Some service providers may process data outside the European Economic Area. Where that happens, we rely on an appropriate transfer mechanism under GDPR, such as an adequacy decision or the European Commission standard contractual clauses together with supplementary safeguards where needed.

8. Retention periods

• Account and profile data: kept for as long as the account remains active and for a limited period thereafter where reasonably necessary to handle disputes, security incidents, fraud prevention, or legal obligations.
• Booking, messaging, moderation, and claim records: retained for as long as necessary to operate the service, resolve disputes, document platform decisions, and protect the platform against abuse or legal claims.
• Publicly sourced provider/listing data: kept only while the listing remains relevant to the platform purpose, and removed or restricted where a justified objection, correction request, or removal request is accepted.
• Security logs and technical records: retained for proportionate security, troubleshooting, and audit needs.
• Consent records and analytics preferences: retained for compliance and evidence of consent choices for an appropriate period.

9. Your GDPR rights

Subject to the conditions and limits set by applicable law, you may request access, rectification, erasure, restriction, objection, and portability. You may also withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

If we process publicly sourced professional data about you or your business on the basis of legitimate interests, you may object to that processing and ask us to review, correct, restrict, or remove the listing.

You also have the right to lodge a complaint with your local supervisory authority. If you are in Italy, the competent authority is the Garante per la protezione dei dati personali.

10. Automated decision-making

We do not currently use solely automated decision-making that produces legal effects or similarly significant effects about you within the meaning of Article 22 GDPR.

11. Cookies, consent, and analytics

We use essential technologies necessary for security, login, language preference, and basic platform operation. Where non-essential analytics or tag-management tools are used, they are configured subject to the consent choices required by applicable law.

For more detail on cookies and consent controls, please consult the Cookie Policy.

12. Security and changes

We apply technical and organizational measures appropriate to the nature of the service and the risks involved, including access controls, service-provider controls, moderation controls, and operational safeguards designed to reduce unauthorized access, misuse, or loss of data.

We may update this notice to reflect changes in the product, legal requirements, service providers, or processing practices. The version published on this page is the current reference version.