Vai al contenuto principale
Share Shore Excursions

Privacy policy

Last updated: 24 October 2026

Information pursuant to Articles 13-14 Reg. EU No. 2016/679 for the processing of personal data

Dear navigator,

Share Shore Excursions hereby informs you that, pursuant to and for the purposes of articles 13 and 14 of the European Regulation no. 2016/679 GDPR, the data acquired and/or provided by you will be processed in compliance with the regulations mentioned below.

Roles

The Data Controller is: Share Shore Excursions, Livorno (LI), Italy, VAT number IT01781900491, walter.occhinincc@gmail.com

Purpose of mandatory processing

Processing of personal data for registration purposes

The mandatory information required for registration is highlighted in the respective input field. If you do not provide this mandatory information, you will not be able to proceed with registration. During the registration process you have the opportunity to provide additional information on a voluntary basis, this information is not mandatory and submission is at your discretion.

The personal data you provide during registration will be used by us to create your profile and identify you following each login. Your private area is created automatically with your first booking, so that you can see your bookings.

The applicable legal basis for these data processing operations is Article 6 (1) (b) of the GDPR. We will carry out all data processing described in this section based on your consent and/or to comply with our contract with you and/or based on our legitimate interests.

Processing of personal data for e-commerce purposes

The personal data provided by the user when finalizing the order (the tour booking) will be used for the execution and processing of the order and of any payment transactions, namely the cancellation or no-show fee charged to the card left as a guarantee.

The credit or debit card left as a guarantee is entered directly into the payment provider’s system (Stripe): the site does not collect or store the card number, expiration date, cardholder name or verification number (CVC), only the references provided by Stripe. Nothing is charged at booking and the tour is paid in cash to the driver.

The applicable legal basis for these data processing operations is Article 6 (1) (b) of the GDPR. In order to process payment transactions, we may pass on the relevant data to the collection service provider commissioned by us (Stripe), who will process this data on our behalf and only for payment processing.

We will retain information relating to each purchase made on e-commerce for 10 years, to fulfill legal obligations regarding tax matters and the conservation of company documents.

The personal data contained in your account will be retained until you decide to close your account.

Processing of data to organise the tours

To organise your tour we process full name, email, phone, tour, date, ship and port call, number of adults and children and the optional notes (for example children’s ages for car seats, or mobility needs). We use them to confirm the booking, send reminders and vouchers and arrange the service with the licensed driver and the guide. Legal basis: Article 6 (1) (b) of the GDPR. Any health information you add in the notes is used only to organise the tour, based on your explicit consent (Article 9 (2) (a)).

Chat assistant

The messages you write to the chat assistant are processed by an artificial intelligence system to answer you. If you ask to be contacted, we send our team your name, email or phone and a summary of your request. Legal basis: Article 6 (1) (b) and (f) of the GDPR. Please do not type payment details or documents in the chat.

Contact requests and guide applications

The details sent through the contact form or by email are used to answer you. The details sent with the “Become a guide” form (name, contacts, city, languages, experience, specialisations, certifications, bio, portfolio) are used to assess the application. Legal basis: Article 6 (1) (b) of the GDPR.

Security and statistics

Browsing data (IP address, browser and device, pages visited, date and time) is logged by our servers to run and protect the site and prevent payment fraud (Article 6 (1) (f)). Only with your consent, Google Analytics collects pseudonymous statistics on how the site is used (Article 6 (1) (a)): details are in the cookie policy. We do not sell data or use it for advertising profiling.

Processing methods

The processing consists, for example, of collection, recording, organisation, conservation, extraction, consultation, use, communication and deletion of personal data. It is carried out, for the aforementioned purposes, according to the principles (ex art. 5 of GDPR n. 2016/679) of lawfulness, correctness, transparency, data minimization and accuracy. The data is processed by telephone, paper, computer and telematic methods. The processing takes place using suitable tools, technical and organizational measures adequate to guarantee security, integrity and confidentiality, avoiding in particular the risk of loss, unauthorized access, illicit use, diffusion, in compliance with the provisions of art. 32 of GDPR n. 2016/679, by the subjects and in compliance with the provisions of art. 29 of GDPR n. 2016/679 and art. 2-quaterdecies of the Privacy Code.

Nature of the provision of data and consequences of refusal to respond

The provision of data for mandatory purposes does not require explicit consent. Without this data, we will not be able to provide our services. The provision of data for other purposes is optional and requires your explicit consent. In case of lack of consent, you will not be able to receive newsletters, information material or commercial communications regarding the services offered by the Owner or by third-party companies. However, you will still have access to our services.

We process your personal information only when there is a legal basis for such processing. The legal bases include:

  • Your consent to the processing activities in question;
  • The legal obligations that we are required to satisfy;
  • The execution of rules dictated by laws or regulations, or by contracts, agreements or other legal instruments;
  • Studies conducted by research institutions, preferably on anonymized personal information;
  • The execution of a contract and related pre-contractual obligations, if you are a party to such contract;
  • The exercise of our rights in court, administrative proceedings or arbitration;
  • The defense or protection of your or a third party’s physical safety;
  • Health protection, in the context of procedures implemented by entities or professionals in the healthcare sector;
  • Our legitimate interests, provided that your fundamental rights and freedoms do not override those interests;
  • Credit protection.

Access to data

Your data may be made accessible for the purposes set out above:

  • to the employees and collaborators of the Data Controller in their capacity as persons in charge of processing and/or system administrators;
  • to third-party companies or other subjects (for example: professional firms, consultants, software houses that provide management software, credit institutions, insurance companies, etc.) who carry out outsourced activities on behalf of the Data Controller, in their capacity as external data processors;
  • to the licensed drivers and guides running your tour, only for the data the service needs (name, phone, ship, times, number of passengers, notes);
  • to the following providers, as external data processors: Supabase (database and authentication, servers in Ireland), Vercel (website hosting), Stripe (guarantee card and any charges), Resend (service emails), Google (Google Analytics, only with consent), Anthropic (chat assistant), Acconsento.click (consent management).

Among the Personal Data collected by this Website, independently or through third parties, there are: Tracking Tools; Usage Data; first name; e-mail; phone; website; number of Users; city; device information; session statistics; browser information; answers to questions; clicks; position relative to scrolling.

Transfers outside the European Union

Some providers (Vercel, Stripe, Resend, Google, Anthropic) are based in, or use servers in, the United States. Transfers rely on the safeguards set by the GDPR: the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

Data communication

The Data Controller may communicate your data to the Public Administration, Supervisory Bodies and/or Judicial Authorities, as well as to all other subjects to whom communication is mandatory or necessary by law. Your information will not be disseminated.

Data retention

All personal data provided will be processed in compliance with the principles of lawfulness, correctness, relevance and proportionality, exclusively with the necessary methods, including IT and telematics, to pursue the purposes described above. Personal data will be retained for a period of 6 years following the last contact with the interested party or until the interested party requests cancellation. In this case, the data related to the legitimate interest of the owner or necessary for the fulfillment of legal obligations may still be retained. It should be noted that the information systems used for the management of the information collected are configured, from the outset, so as to minimize the use of personal data.

In particular:

  • Bookings and accounting records: 10 years, for tax obligations.
  • Private area: until you ask us to close it.
  • Guarantee card references: as long as needed to complete the tour and any fees.
  • Requests, support conversations and applications: up to 6 years from the last contact.
  • Statistics: according to the Google Analytics retention setting, at most 14 months.
  • Browsing data: for the short periods set by our hosting providers.

Rights of the interested party

In your capacity as an interested party, you have the rights referred to in art. 15 ff and art. 77 of the GDPR, and precisely the rights to:

  • Obtain confirmation from the data controller as to whether or not personal data concerning you are being processed and, in this case, to obtain access to the personal data and the following information: the purposes of the processing; the categories of personal data in question; the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organisations; when possible, the expected retention period of personal data or, if this is not possible, the criteria used to determine this period; if the data are not collected from the interested party, all available information on their origin; the existence of an automated decision-making process, including profiling, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party;
  • Obtain from the data controller the rectification of inaccurate personal data concerning you without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration;
  • Obtain from the data controller the erasure of personal data concerning you without unjustified delay, if one of the following reasons exists: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the interested party withdraws the consent on which the processing is based in accordance with Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), and if there is no other legal basis for the processing; the interested party objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2; the personal data have been processed unlawfully; the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject;
  • Obtain from the data controller the limitation of processing when one of the following hypotheses occurs: the interested party contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; the processing is unlawful and the interested party opposes the deletion of the personal data and requests instead that their use be limited; although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; the interested party has objected to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party;
  • Receive the personal data concerning you provided to a data controller in a structured, commonly used and machine-readable format and transmit such data to another data controller without impediments by the data controller to whom you provided them if the processing is carried out by digital means. In exercising their rights regarding data portability, the interested party has the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible;
  • Object at any time, for reasons related to your particular situation, to the processing of personal data concerning you pursuant to Article 6, paragraph 1, letters e) or f), including profiling on the basis of these provisions. If personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is connected to such marketing;
  • Right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you;
  • Right to lodge a complaint with a supervisory authority pursuant to art. 77; in Italy this is the Garante per la protezione dei dati personali, or you can contact the authority of your country.

Method of exercise of rights

You may exercise your rights at any time by contacting the Owner at the following email address: walter.occhinincc@gmail.com

External processors and persons in charge

The updated list of external processors and persons in charge of processing is kept at the registered office of the Data Controller. The main providers are listed in the “Access to data” section.

Cookies

For the cookies used by the site and to change your consent, see the cookie policy.

Modification of the current information

This information was drawn up on 18-08-2026, updated on 24-10-2026, and may undergo changes over time also depending on legislative and regulatory additions or changes in the matter. The interested party is invited to consult this page often.