Data Controller and contact details
The Data Controller is Waves and Dreams di Eleonora Locci, VAT no. 04175770926, REA CA-369373, registered office at Via Carlo Rosselli 5, 09047 Selargius (CA), Italy. Privacy requests may be sent to info@wavesanddreams.it or to the certified email address elocci@legalmail.it.
Personal data processed
The website may process identification and contact data, information entered in forms, details required for an enquiry or booking, the number and age group of participants, operational communications, transaction and refund information, IP address, device and security logs, and information strictly required to prevent abuse and fraud.
The website does not receive complete payment-card details. Free-text notes should not contain health data or other particularly sensitive information unless strictly necessary to organise the experience safely.
Purposes and legal bases
- Answering enquiries and preparing a booking: steps taken at the data subject’s request before entering into a contract.
- Managing the booking, payment, participation, communications, cancellations and refunds: performance of the contract.
- Complying with administrative, tax, accounting and legal duties: compliance with a legal obligation.
- Protecting the website, systems, accounts and transactions against abuse, spam and fraud: the Controller’s legitimate interest and, where applicable, legal obligations.
- Handling disputes and protecting legal rights: legitimate interest in establishing, exercising or defending legal claims.
The website does not currently carry out direct marketing, profiling or behavioural advertising. Any future introduction of such activities will require an updated notice and, where required, specific consent.
Required and optional data
Mandatory data are required to answer the enquiry or conclude and manage the booking. Failure to provide them may prevent the form, payment or service from being completed. Optional data are used only to handle the request more effectively.
Online payments through Stripe
Payments are processed through Stripe. During Checkout, Stripe collects and processes data required for the transaction, security, authentication, fraud prevention, accounting, disputes and refunds. Waves & Dreams receives only the information needed to confirm the payment outcome and manage the booking; it does not receive the complete card number or security code. Further information is available in Stripe’s Privacy Policy.
Anti-spam and security protection
Forms may use Cloudflare Turnstile to distinguish legitimate requests from automated traffic. The service may process IP addresses, technical device signals and identifiers strictly required for security. Depending on its configuration, Cloudflare may use cookies or equivalent technologies necessary for operation and abuse prevention. Further information is available in Cloudflare’s Privacy Policy.
Recipients, processors and international transfers
Data may be processed by authorised persons and service providers supporting the business, including hosting and technical maintenance, email, infrastructure, security, content management, payment and professional advisers. Depending on the activity, they act as processors or independent controllers.
Some providers may process data outside the European Economic Area. Where this occurs, transfers are made using safeguards recognised by applicable law, such as adequacy decisions, Standard Contractual Clauses or other valid mechanisms.
Retention periods
- Enquiries not followed by a booking: normally up to 12 months after the last communication.
- Booking, payment, refund and administrative records: for the duration of the relationship and then for the periods required by civil, tax and accounting law, normally up to 10 years.
- Technical and security logs: for a period proportionate to the purpose, normally no longer than 6 months, unless needed for investigation, security or legal protection.
- Data connected with disputes or claims: until the matter and the relevant limitation periods have ended.
Children’s data
A booking must be made by an adult. For participants under 18, only strictly necessary details are requested, such as number and age group. The parent or guardian making the booking confirms that they are entitled to provide this information and remains responsible for supervising the child during the experience.
Data subject rights
Where provided by law, data subjects may request access, rectification, erasure, restriction, portability and object to processing, and may withdraw consent without affecting the lawfulness of processing carried out before withdrawal. They may also request information about the source, purposes, recipients and retention periods.
Requests may be sent to info@wavesanddreams.it or to elocci@legalmail.it. The Controller will respond within the time limits set by Regulation (EU) 2016/679.
Complaints and updates
Data subjects may lodge a complaint with the Italian Data Protection Authority or seek a judicial remedy. Information is available on the Italian Data Protection Authority website.
This notice may be updated when services, providers or processing activities change. The version published on the website is the current version.