Grand Palladium White Island Resort & Spa

PRIVACY POLICY – YESWORLD TOUR OPERATOR

Data Controller

The Data Controller is Sunset Group S.r.l., with registered office at Traversa III di Via Castagna 1, 80026 Casoria (NA), Italy.

Phone: 08118097866

1. Types of data collected

The Data Controller collects and processes the following categories of personal data:

• Identification data (name, surname)
• Contact data (email address, phone number)
• Booking-related data (identity documents, travel information)
• Payment-related data (processed through external systems)
• Navigation data (IP address, cookies, system logs)

2. Purpose of processing

Personal data are processed for the following purposes:

• Management of bookings and requested travel services
• Responding to information requests and quotations
• Administrative, accounting, and tax obligations
• Customer support
• Sending marketing communications, subject to user consent
• Statistical analysis and service improvement

3. Processing methods

Data are processed using electronic and telematic tools, in compliance with principles of lawfulness, fairness, and transparency, and with appropriate technical and organizational security measures.

4. Legal basis of processing

Processing is based on:

• Performance of a contract or pre-contractual measures
• Legal obligations
• User consent for marketing and profiling purposes

5. Tools and services used

The following tools are used for operational and marketing purposes:

• EasyADV (CRM) for customer and booking management
• Google Analytics for website traffic analysis
• Meta Platforms (Facebook and Instagram) for advertising, marketing, and remarketing
• MailTurismo for sending promotional email campaigns

These services may involve the processing of personal data by third-party providers, including those located outside the European Union, in compliance with GDPR safeguards.

6. Data sharing with third parties

Personal data may be shared with:

• Travel service providers (hotels, airlines, tour operators)
• Payment service providers used for transactions
• IT, hosting, and CRM providers (including EasyADV)
• Email marketing tools (including MailTurismo)
• Advertising and analytics platforms (Google, Meta)
• Competent authorities, where required by law

7. International data transfers

Some personal data may be transferred outside the European Union, particularly through Google and Meta services, in compliance with applicable data protection safeguards.

8. Data retention

Personal data are retained only for as long as necessary for:

• Contractual relationship management
• Legal and fiscal obligations
• Marketing purposes, until consent is withdrawn

9. Data subject rights

Data subjects may exercise the following rights under GDPR Articles 15 and following:

• Access to personal data
• Rectification or updating
• Erasure (“right to be forgotten”)
• Restriction of processing
• Objection to processing
• Data portability
• Withdrawal of consent

Requests may be sent to the Data Controller using the contact details above.

10. Cookies

The website uses technical cookies and, subject to consent, profiling and third-party cookies, including those from Google and Meta.

For more details, please refer to the dedicated Cookie Policy.

11. Changes to this policy

The Data Controller reserves the right to modify or update this Privacy Policy at any time. Updates will be published on this page and will take effect upon publication.