Last updated: 29 September 2026
Privacy notice
In short
Turpronto is the website of Fala Noleggi SRL for booking tours and experiences offered by local businesses. This notice explains which personal data we use, why, for how long and what your rights are. It applies to visitors, customers, businesses, partners and business contacts.
- We use data only to run the site, handle bookings and payments, answer requests and comply with the law.
- We do not sell your data or use it for other companies’ advertising.
- The site uses technical cookies only: no advertising or profiling cookies and no third-party analytics.
- The business running your experience receives only the data needed for your booking.
- Promotional emails are sent only if you say yes, and you can stop them with one click.
- From your account area you can download your data and ask for your account to be deleted.
- We apply the European rules (GDPR) to everyone, even if you live outside the European Union.
Who we are and how to reach us
The data controller is Fala Noleggi SRL, VAT number 13160840016, Via Natale Sandre 22/A, 10078 Venaria Reale (TO), Italy, PEC falanoleggi@pec.it. It runs turpronto.com and decides why and how the data described here are processed.
For any privacy question or request you can contact us by writing to info@turpronto.com, from your account area on the site (the “Your data” and “Support” sections) or by post at the address above.
We have not appointed a data protection officer (DPO): the law does not require one for the type and amount of data we process (GDPR Article 37).
Who this covers and who does what
This notice covers site visitors, people who create an account or book (customers), businesses offering experiences, partners (for example hotels and agencies that refer customers) and people at companies we contact to propose a collaboration.
Fala Noleggi SRL is the controller for the site, accounts, bookings and payments. The business running the experience receives the data it needs and uses it as an independent controller under its own privacy notice (for example for safety during the activity or its own tax duties). Stripe, which handles card payments, is an independent controller for the checks the law requires of it (for example fraud and anti-money-laundering checks).
When a business uses the site’s management tools for its own data (customers booked by phone or at the desk, staff, shifts, notes), the business is the controller and Fala Noleggi SRL processes that data only on its behalf, as a processor (GDPR Article 28). See the section “Data businesses enter in the management tools”.
Account and sign-in
To create an account you give us your name, email address and a password. The password is stored only in encrypted form (hash): nobody, including us, can read it. We send you an email to confirm the address.
If you sign in with Google (or Apple, Microsoft or Facebook when available) we receive from that service your name, email, any profile photo and a code linking your account; we never receive your password. That service knows you used its sign-in on our site, under its own privacy notice.
Your profile also stores your preferred language, your role (customer, business, partner) and, if you arrived through a partner’s invitation, who invited you: this is used to calculate their commission and does not change your price. Legal basis: contract (GDPR Article 6(1)(b)); without this data we cannot give you an account.
Bookings
When you book we collect: the booker’s name, email and phone number; the number and ages of participants (to check prices, requirements and minimum age); your choices (date, option, pick-up hotel, equipment sizes, extras); the language; amounts, discount codes and payment status.
We use them to confirm and manage the booking: voucher, reminders, date changes, cancellations, refunds and support. The business running the experience receives your name, phone, email, participants and choices, and records your attendance on the day using the voucher code.
We ask only for what is needed. Please do not send us diagnoses or medical documents: for accessibility use the search filters, which only help find suitable experiences and are not saved to your profile. If you book for other people, make sure they agree to you giving us their age.
Legal basis: contract (Article 6(1)(b)); to keep bookings and amounts, tax and accounting obligations (Article 6(1)(c)).
Payments
Card payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland). You enter your card details on Stripe’s page: we never see or store them. From Stripe we receive only the payment result, the amount, a reference code and any refunds or disputes.
Stripe runs automatic fraud checks and may refuse a payment it considers risky; for these checks and for anti-money-laundering duties it acts as an independent controller under its own notice (stripe.com/privacy). We pay businesses and partners ourselves by bank transfer, to the account they enter in their dashboard.
Legal basis: contract and legal obligations (Article 6(1)(b) and (c)).
Service and promotional emails
Service emails. We write to you about your account or bookings: email confirmation, new password, booking confirmation and voucher, reminders before departure, changes, cancellations, refunds and support replies. Businesses and the site owner receive a weekly summary on Mondays, which can be switched off in the profile. Legal basis: contract; for the summary, our legitimate interest in providing a useful service.
Promotional emails. Travel ideas and Turpronto offers are sent only if you tick the consent box (never pre-ticked), when booking or in your profile. We record when, where and with which words you said yes, so we can prove it. To choose who receives an offer we use simple information: language, destinations and booking dates. Every email has a one-click unsubscribe link, and you can also withdraw consent in your profile; afterwards we keep only the address and the date of your choice, so we do not write again. Legal basis: consent (GDPR Article 6(1)(a) and Article 130 of the Italian Privacy Code).
Our emails are plain text: they contain no tracking pixels recording whether you open them.
Support, reviews, favourites and notes
If you write to support we store the messages, topic, dates and any linked booking. If the message concerns a booking, the business involved can also read and answer it. Our staff may add internal notes. Legal basis: contract and our legitimate interest in resolving requests.
After an experience you can leave a review (rating and comment): it is public on the experience page without your name, and the business can reply. You can ask us to remove it at any time. Legal basis: legitimate interest in offering genuine reviews to other travellers.
Experiences you save as favourites stay in your account until you remove them. We may note in your profile preferences or requests you tell us, only to serve you better: you can ask to see or delete them.
Location and AI assistant
The “Near me” search uses your location only if you press the button and your browser asks for permission. The location is rounded to about 1 km before it leaves your device, is used only for that search and is not saved to your account.
When the AI assistant is active, the text you type in the guided search (for example “boat trip with children on the lake”) is sent to the AI service we use (Anthropic or OpenAI) to understand destination and interests. It works only with an account, we do not save the text and the provider does not use it for its own purposes (it may keep it for a limited time, usually up to 30 days, for abuse monitoring). Do not write health details or other personal data. Legal basis: legitimate interest in offering an easier search; you can always use the filters without AI.
Our staff may also use AI to draft support replies or listings: in that case the text of the conversation or listing is sent to the AI service, and every draft is checked by a person before use.
Experience listings are translated automatically with the same service into the site’s languages: we send only the listing’s texts, never customer data, and the translated page says so, with a link to the text written by the business.
Businesses and partners
If you offer experiences (business) or refer customers (partner), besides account data we collect: company name; billing details (tax code, VAT number, address, SDI code, certified email); documents you upload for verification (for example the representative’s identity document, company documents, insurance and licences with their expiry dates); operational contact; the account we pay you on (holder and IBAN, seen only by whoever prepares the transfers); sales, commission and payment data.
We use them to verify who you are before publishing offers, pay the amounts due, show statistics and deadlines in your dashboard and meet tax obligations. Experience pages and the business name are public. Partners see their earnings and the related bookings, but not customers’ private contact details.
Legal basis: contract and legal obligations (Article 6(1)(b) and (c)); for document checks, also our legitimate interest in the safety of the platform and customers.
Business contacts
To propose a collaboration we contact businesses, hotels and agencies. We use business contact details (company name, contact person, phone, email, website, area) taken from public sources such as websites, trade directories and fairs, or that you gave us.
We use them to introduce Turpronto, including through a personal invitation page: we record whether and how often you open it and whether you accept or decline, to know whether to contact you again. Legal basis: legitimate interest in developing business-to-business relationships (Article 6(1)(f)). We send you promotional emails only with your consent.
If you fill in “We call you” on the “Become a partner” page, we use the details you give us to call you back and answer your request (legal basis: your request, Article 6(1)(b)). To stop automated programs we count the requests from each connection using an encrypted fingerprint of the IP address, which we delete after a few days.
To fill in a business’s record we may read the public page of its website; the page text may be sent to the artificial intelligence provider named in this notice only to recognise the kind of activity.
You can object at any time: choose “Not interested” on the invitation page, reply to the message or write to us. From then on we will not contact you again and we keep only the company name and an encrypted fingerprint (hash) of the email or phone, so we do not add you again by mistake. If you do not answer or are not interested, we delete your data 24 months after the last contact.
Data businesses enter in the management tools
Businesses can also use the site for their daily work: entering bookings taken by phone or at the desk (name, phone, email, number of people, amount, notes), their own staff (name, role, phone, email, languages) and shifts.
For this data the business is the controller and must inform its own customers and staff; we process it only on the business’s behalf and instructions, as a processor (GDPR Article 28), with the same security measures as the rest of the site. We do not use it for our own purposes or for marketing and we do not sell it. If you are a customer or staff member of a business, please contact the business first about this data: we will help it answer you.
Who receives the data
We share data only with those who need it, and only what is necessary:
- the business running the booked experience (see “Bookings”);
- Netsons s.r.l. (Italy), which hosts the site and database on servers in European data centres;
- Stripe, for payments and refunds;
- our bank, for bank transfers to businesses and partners (it receives the holder’s name, the IBAN and the amount);
- the service that sends our emails (for example Resend, Inc., United States, or our hosting provider’s mail server);
- Google, Apple, Microsoft or Facebook, only if you choose to sign in with their account;
- Google, for the map, only if you press “Show the map”: to draw it Google receives your IP address and technical browser data, and applies its own privacy notice;
- our partners Tiqets, Klook and GetYourGuide and Travelpayouts (which runs the affiliate programmes), only if you accept their cookies in the banner, press “Show attractions with photos and prices” or open a link to one of them: they receive your IP address and technical browser data (and, if on the “Attractions” page you press “Near me”, a position rounded to about 10 km, which the browser asks your permission to read and which we do not save), may use their own cookies and apply their own privacy notices; legal basis: your consent (GDPR Article 6(1)(a)), which you can withdraw on the cookie page; if you book, you do so with the partner and under its terms;
- Anthropic (Claude) or OpenAI, for the AI assistant and automatic translations, only for the texts described above;
- accountants, legal advisers, banks and auditors, when needed for our business or by law;
- public authorities and law enforcement, when required by law or to defend our rights;
- a possible buyer of the company or part of it, with the same protections as this notice.
Providers processing data on our behalf are bound by a contract (GDPR Article 28) and may use it only for the service they provide to us. “Directions with Google Maps” links take you to Google’s site, which applies its own notice. Exchange rates come from the European Central Bank without any of your data.
Transfers outside the European Union
The site and database are in Europe. Some providers (for example Stripe, Google, Anthropic, OpenAI and the email service) belong to groups based in the United States and may process data there too. In these cases transfers take place only with GDPR safeguards: the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or the standard contractual clauses approved by the Commission (GDPR Articles 45 and 46). You can ask us about the safeguards used.
If the business running the experience is based outside the European Union (for example in Switzerland, which has an adequacy decision), we pass it the data because they are needed to perform the booking you requested (GDPR Article 49(1)(b)).
How long we keep data
We keep data only as long as necessary; then we delete or anonymise it. The site deletes expired technical data automatically.
- Server technical logs: for a short period, normally no more than 30 days, unless an attack or abuse is being investigated.
- Sign-in attempts with IP address: 2 days.
- Sign-in sessions (IP address and browser): while the session is valid, at most 7 days after last use.
- Links to confirm your email or change password: valid for one hour and deleted after expiry.
- Account: as long as you keep it; if you ask for deletion, we carry it out within 30 days.
- Bookings, payments, refunds, statements and invoices: 10 years, as required by Italian civil and tax law (Article 2220 of the Civil Code). If you ask for deletion, we remove your name and contact details and keep only the amounts.
- Support conversations: 24 months after closing. Requests about personal data are kept as proof of our answer for as long as the answer could legally be challenged.
- Reviews: until you ask us to remove them; if you close your account they stay public, without a name. Favourites: until you remove them or close your account.
- Consent to promotional emails and its proof: until you withdraw it; afterwards, only the address and the date of your choice.
- Business contacts: 24 months after the last contact without a reply or interest; after a refusal, only the company name and the encrypted fingerprint.
- Business and partner data and documents: throughout the collaboration; afterwards, those needed for contracts and accounting for up to 10 years.
- Backup copies: overwritten on a rolling basis within 30 days.
- Page view counts: anonymous data, with no expiry.
- Anonymous visit paths: 30 days.
Children
You must be at least 18 to create an account and book. Children can take part in experiences through a booking made by an adult, who gives us only their age. We do not knowingly collect other data about children and we do not send them promotional emails. If you think a child has given us personal data, write to us and we will delete it.
Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22). The site’s automatic checks prevent mistakes, such as selling the same seat twice. Stripe may automatically block a payment it considers fraudulent: in that case write to us and a person will review the situation with you.
Security
We protect data with an encrypted connection (HTTPS), passwords stored only in encrypted form, role-based access (each business sees only its own customers), documents visible only to authorised people, a log of important operations and backups. No system is 100% secure: if a breach may put you at risk, we notify the Italian data protection authority within 72 hours and, if the risk is high, you as well (GDPR Articles 33 and 34). We will never ask for your password by email or phone.
Your rights and how to use them
You have the right to:
- know whether we process your data and get a copy (access, GDPR Article 15);
- correct wrong or incomplete data (rectification, Article 16);
- have your data deleted, except what the law requires us to keep (erasure, Article 17);
- restrict processing in some cases, for example while we check a complaint of yours (Article 18);
- receive the data you gave us in a machine-readable format and take it elsewhere (portability, Article 20);
- object to processing based on our legitimate interest and, always and without giving a reason, to marketing (objection, Article 21);
- withdraw your consent at any time, without affecting what was done before (Article 7);
- lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it, Piazza Venezia 11, 00187 Rome), or with the authority of the country where you live or work (Article 77).
How: in your account area, “Your data” section, you can immediately download a copy of your data and request deletion of your account; for anything else use the contacts in “Who we are and how to reach us”. We answer free of charge within one month (for complex cases up to two more months, and we will tell you). To protect you we may ask you to confirm your identity, for example by writing from your account email.
If you live outside Italy
We apply the GDPR to everyone, wherever you live. In addition:
- European Union: you can also contact the supervisory authority of your country (for example CNIL in France, AEPD in Spain or your Land authority in Germany). The full list is on the European Data Protection Board website (edpb.europa.eu).
- United Kingdom: you have the same rights under the UK GDPR and the Data Protection Act 2018 and can complain to the Information Commissioner’s Office (ico.org.uk).
- Switzerland: you have the rights under the Federal Act on Data Protection (revFADP, in force since 1 September 2023) and can contact the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).
- United States (California and other states with consumer privacy laws): we collect the categories of data described on this page (identifiers and contact details, booking and payment data, technical browsing data, approximate location only if you request it, credentials used only to sign you in). We do not sell or “share” personal information for targeted advertising and we do not use sensitive information to infer characteristics about you, so there is nothing to opt out of. You can ask to know what data we hold, to correct it and to delete it, including through an authorised agent; we will not treat you differently for exercising your rights. If we deny a request you can ask us to reconsider it and, if still unsatisfied, contact your state’s Attorney General.
- Other countries (for example Canada, Brazil, Australia, Japan, South Korea): you can also exercise the rights granted by your country’s law by writing to the contacts above.
Changes to this notice
We may update this notice when the site, our providers or the law change. The version and date are shown at the top. If the changes are significant we will tell you on the site or by email before they apply. The Italian text is the reference version.