Privacy policy

Last updated: 9 ottobre 2026

This notice explains how we process the personal data of people who visit vintagethecity.com, write to us or buy our services, under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, Reg. EU 2016/679) and the Italian Privacy Code (Legislative Decree 196/2003).

1. Data controller

Data controller and seller

Vintage & The City by Ilaria Colombo

Email

hello@vintagethecity.com

2. What data we process, why, and on what legal basis

• Browsing data. The server hosting the site (Netlify) automatically logs technical data such as IP address, browser, page requested, date and time. This is needed to run the site and protect it from abuse. Legal basis: legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR).
• Tour dates. To show the next dates, your browser reads our public calendar through the Google Calendar API: Google receives your IP address and technical request data, without cookies. Legal basis: legitimate interest in showing you up-to-date dates and availability (Art. 6(1)(f)).
• Requests by form or email. Name, email, service of interest, dates, number of people, how you found us and your message. We use them only to reply and to organise the service you asked for. Legal basis: pre-contractual measures and contract (Art. 6(1)(b)). Required fields are needed to reply to you.
• Purchases. Tickets, gift cards and guides are bought on Payhip; payments are handled by Payhip and its payment providers (e.g. Stripe, PayPal). We receive your name, email and order details, never your full card data. Legal basis: contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)).
• Photos and videos during tours. We only film or photograph participants for our social channels with their explicit consent, collected at the start of the tour and revocable at any time (Art. 6(1)(a) GDPR, Arts. 96-97 Italian Copyright Law).

We do not use your data for profiling or automated decisions and we never sell it. We only send you a newsletter if you subscribe yourself: subscription happens on Substack, which acts as an independent controller under its own privacy policy.

3. Who receives the data

Only the providers we need to deliver the service, appointed as processors (Art. 28 GDPR) or acting as independent controllers:

• Netlify, Inc. (USA): website hosting and form handling;
• Google Ireland Ltd / Google LLC: email (Google Workspace) and the public tour calendar;
• Payhip Ltd (United Kingdom) and its payment providers: sale of tickets, gift cards and guides;
• our tax advisor, for legal obligations.

4. Transfers outside the EU

Netlify and Google may process data in the United States: transfers rely on the EU-US adequacy decision (Data Privacy Framework) and, where needed, on the European Commission's Standard Contractual Clauses. The United Kingdom (Payhip) benefits from a European Commission adequacy decision.

5. How long we keep the data

• requests that do not lead to a booking: up to 24 months;
• sales data and tax documents: 10 years, as required by Italian law (Art. 2220 Civil Code);
• browsing data: for the period set by the hosting provider, usually a few days or weeks;
• photos and videos: until consent is withdrawn.

6. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR), and withdraw any consent you gave, by writing to hello@vintagethecity.com. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or the authority of your EU country.

7. Cookie policy

This website does not use cookies or other tracking tools: no profiling or advertising cookies, no analytics, no social pixels. Fonts are hosted on our own server and are not loaded from Google Fonts. That is why we do not ask for consent with a banner, in line with the Italian Data Protection Authority's cookie guidelines of 10 June 2021.

When you click a link to Instagram, TikTok, Substack or Payhip you leave our site, and their own cookie and privacy policies apply.

If we ever add analytics or other non-essential tools, we will update this page and ask for your consent before turning them on.

8. Changes

We may update this notice; the date at the top shows the latest version.