What we collect, why, and what you can ask us to do about it.
Last updated: August 2026
The data controller is AdventureLab S.r.l., Via Giulio Braga 98, 59100 Prato (PO), Italy — VAT no. 02410590976. For anything concerning your personal data, write to[email protected].
There is nothing here to sign up for: no account, no newsletter, no booking form, no contact form. We never ask you for your name, your email address or any other personal detail, and we have no way to receive one unless you choose to write to us yourself.
If you do email us, we process your address and the content of your message for the sole purpose of replying — legal basis: our legitimate interest in answering someone who contacted us (Art. 6(1)(f) GDPR). We keep that correspondence only as long as it is useful for the exchange.
Technical logs. The site is served by Cloudflare Pages. Like any web server, the infrastructure processes your IP address, the requested page, the time of the request, your browser and operating system. This is necessary to deliver the pages and to protect the site from abuse (Art. 6(1)(f) GDPR). Cloudflare acts as our data processor.
Google Analytics 4 — only if you accept. We use GA4 to understand how many people reach the site and which pages they read. It runs in Google Consent Mode v2 with every storage category denied by default: until you press Accept on the banner, no analytics cookie is written and no measurement identifier is stored on your device. The legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time — see the cookie policy. We do not use GA4 for advertising or profiling: ad storage, ad user data and ad personalisation are all left denied.
Google Ireland Limited acts as our data processor for GA4. Analytics data may be transferred outside the European Economic Area under the safeguards described in Google's own privacy documentation. GA4 data is retained for the period configured in the property (by default, 14 months).
The accommodation buttons send you to Stay22 or to the property's own website. Some of those links are affiliate links — we explain exactly which ones, and why, in ouraffiliate disclosure. The route buttons send you to Ride with GPS.
Once you follow one of those links you are on someone else's site, and their privacy policy applies — not ours. We do not receive your personal data back from them: what reaches us is, at most, aggregate commission reporting with no information that identifies you.
Under Articles 15 to 22 GDPR you may ask us for access to your personal data, and for its rectification or erasure; you may ask us to restrict or object to a processing operation; and you may ask for your data in a portable format. Where processing rests on your consent, you can withdraw it at any time without affecting what was lawful beforehand.
Write to [email protected] and we will reply within one month. In practice, since we hold almost nothing about you, most requests are answered in a line or two. If you believe your data has been mishandled you also have the right to lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the country where you live.
If this notice changes we update the date at the top of the page. Should a change affect a processing operation that rests on your consent, we will ask for that consent again.