Updated 29 September 2025
Dear Traveller
We inform you that Enruta360 S.r.l. (hereinafter, for brevity, also the “Company”), as Data Controller, will process – for the purposes and in the manner set out below – the personal data provided by you or acquired in the context of the travel contract, on the terms set out below.
In the event of any conflict between this English translation and the Italian original, the Italian version shall prevail.
1. CATEGORIES OF DATA
ORDINARY PERSONAL DATA
Identification, contact and personal details:
First name and surname;
Nationality and date of birth;
Tax identification number (codice fiscale);
Telephone and personal e-mail,
Residential address,
Profession,
Passport and/or identity card number (number, date of issue, date of expiry);
Driving licence, where required according to the type of trip;
Emergency contact details;
Payment data:
IBAN;
Data relating to travel preferences, collected following the booking:
Age;
Sex:
Geographical origin;
Destination;
Images and recordings:
Photographic images
Audio and video recordings;
SPECIAL CATEGORIES OF DATA
Data capable of revealing health status:
In-flight meal preferences;
Medical reports in the event of incidents during the trip;
Medical certificates in the event of cancellation of the trip;
Where the data subject is a minor, the data referred to above relate to the minor and to the person exercising parental responsibility.
2. LEGAL BASIS AND PURPOSES OF PROCESSING
2.1 Booking and purchase of a trip
The processing of the data referred to in point 1.1 lett. A and B (limited to in-flight meal preferences) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party” and in art. 6(1)(c) GDPR “processing is necessary for compliance with a legal obligation to which the controller is subject” and is aimed at fulfilling the legal and contractual obligations connected with the conclusion and performance of the contract, having regard to the type of trip and/or services purchased (airline bookings, ground services, visas and entry procedures into the country, etc.), as well as for invoicing the services purchased.
In relation to the chosen destination, we inform you that some non-EU countries may not have a level of personal data protection equivalent to that guaranteed by the EU. This means that there may be no detailed rules on the protection of data subjects’ rights or dedicated supervisory authorities, and that access to data by local authorities may not be regulated in the same way.
To protect the confidentiality and security of your personal data, we adopt specific safeguards provided for by Title V of the GDPR.
In countries for which no adequacy decision has been adopted pursuant to Article 45(3) GDPR or appropriate safeguards pursuant to Article 46, the processing of the data referred to in point 1.1 lett. A and, where necessary, B above finds its legal basis in art. 49(1)(a) and (b) GDPR (so-called explicit consent for the performance of a contract).
2.2 Cancellation of a trip
The processing of the data referred to in point 1.1 lett. A and B (limited to medical certificates attesting the inability to depart) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party” and is aimed at fulfilling the legal and contractual obligations connected with the performance of the contract and, in particular, at avoiding, so far as possible, that cancellation penalties for flights are charged to you, in accordance with the policies of certain airlines.
2.3 Travel organisation e-mail communications
The processing of the data referred to in point 1.1 lett. A (and in particular, the e-mail address) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party” and is aimed at sending you communications that are indispensable to complete and finalise the contract (for example: booking confirmations, payment instructions, contractual details); as well as at transmitting operational information about the trip, enabling you to receive operational updates from the coordinator before departure.
2.4 Trip chat group
The processing of the data referred to in point 1.1 lett. A (and in particular, the mobile phone number) above finds its legal basis in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller” and is aimed at including the Data Subject in the chat group, created before departure, by the other participants and the coordinator, for the purpose of exchanging organisational and operational communications relating to the trip. The Controller’s interest has been balanced with that of the Data Subject who, through the operational information provided within the WhatsApp group, will be able to stay up to date. You may object to the processing at any time by leaving the chat group.
2.5 Newsletter and Magazine
The processing of the data referred to in point 1.1 lett. A (in particular, the e-mail address or the physical residential address) above finds its legal basis in art. 6(1)(a) GDPR “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”, and is aimed at sending e-mails and newsletters relating to the promotion of services similar to those already purchased, as well as, where requested, the Magazine. At any time, you may withdraw the consent given by clicking on the unsubscribe link placed at the foot of the newsletters received or by sending an e-mail to privacy@enruta360.com
2.7 Images and videos during the trip
The processing of the data referred to in point 1.1 lett. A (in particular, photographic images and audio-video recordings during the trip) above finds its legal basis in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller” and is aimed at documenting the trip, with respect for cultures and peoples in keeping with the philosophy of responsible travel.
The Controller’s interest in promoting trips is balanced with yours, as Data Subject, insofar as, having been informed in advance, you may object to the processing by asking not to take part in photographs and recordings.
2.8 Accidents or illness during the trip
The processing of the data referred to in point 1.1 lett. A and B (in particular, medical reports in the event of incidents during the trip) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party” and in art. 6(1)(c) GDPR “processing is necessary for compliance with a legal obligation to which the controller is subject” and is aimed at fulfilling the obligations arising from the travel contract concluded with you; as well as at the proper management of relations with insurance companies when claims (accidents, injuries or illness) occur during the trip.
2.9 Inappropriate facts or conduct during the trip
The processing of the data referred to in point 1.1 lett. A (in particular, identification data) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party” and is aimed at ensuring compliance with the contractual conditions relating to participation in the trip and the Travel Decalogue, including rules of conduct and safety; protecting the safety of the other participants; and enabling the Data Controller to adopt any consequent measures (e.g. exclusion from future trips, reports to the competent authorities if necessary, handling of complaints or disputes).
2.10 Handling of complaints and disputes
The processing of the data referred to in point 1.1 lett. A above finds its legal basis in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller” and is aimed at the protection of rights and defence in the event of complaints and/or claims raised by data subjects in the pre-contractual, contractual and post-contractual phase, as well as for the handling of disputes.
2.11 Communications in case of emergency
The processing of the data referred to in point 1.1 lett. A (and in particular, the emergency contact) above finds its legal basis in art. 6(1)(d) GDPR “processing is necessary in order to protect the vital interests of the data subject”, as well as in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller”, and is aimed at managing all communications in extraordinary cases of safety and emergency.
The Controller’s interest in being able immediately to contact a family member or a person close to the traveller is balanced with that of the Data Subject through the principle of minimisation (request of the telephone contact only and indication of the relationship) and use of the same exclusively in case of need.
It is your responsibility to inform in advance the person whose emergency contact you have provided, specifying that their data have been communicated to Enruta360 S.r.l. for this purpose and to provide them with this information notice.
2.12 Travel feedback
The processing of the data referred to in point 1.1 lett. A (and in particular, the e-mail address) above finds its legal basis in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller”, and is aimed, at the end of the trip, at verifying the traveller’s degree of satisfaction with the experience undertaken.
The Controller’s interest in verifying the degree of satisfaction with the services provided is balanced with your interest, insofar as you may also choose not to reply to the e-mail received. You have the right to object to the processing by not completing the questionnaire that will be sent to you at the end of the trip.
2.13 Exclusion from marketing advertising campaigns
The processing of the data referred to in point 1.1 lett. A (and in particular, name and e-mail address) above finds its legal basis in art. 6(1)(f) GDPR “processing is necessary for the purposes of the legitimate interests pursued by the controller”, and is aimed at carrying out targeted marketing campaigns that exclude persons who are already customers.
The Controller’s interest in promoting marketing activities is balanced with your interest, insofar as you will not be subject to redundant or potentially inappropriate advertisements, thereby improving the user experience.
2.14 Website registration and Reserved Area
The processing of the data referred to in point 1.1 lett. A (in particular, first name and surname, e-mail address, telephone number and further identification data provided at the time of registration) above finds its legal basis in art. 6(1)(b) GDPR “processing is necessary for the performance of a contract to which the data subject is party”, including as a pre-contractual measure taken at your request, and is aimed at the creation and management of the personal Account on the website, necessary to complete purchases made online and to access the Personal Record (consultation, modification or cancellation of your bookings).
Registration on the website takes place at the same time as the online purchase of a package or tourist service.
Within the Account, through the personal booked area of the website www.enruta360.com, the “Personal Record: Travel information” is also created, protected by access credentials, which updates in real time with information relating to the booking and the trip and enables you to: modify some of the data already entered; verify the proper progress of your booking; change or cancel the trip. Through the Personal Record, your right to rectification of personal data is also guaranteed.
If, at the time of registration, you give specific and separate consent, the data provided (in particular, name and e-mail address) may also be processed, pursuant to art. 6(1)(a) GDPR, for the sending of newsletters and promotional communications, as already described in point 2.5. Such consent is optional, independent and withdrawable at any time in the manner set out in point 2.5, without any consequence for the use of the Account and of the services purchased.
3. METHODS OF PROCESSING
3.1 The processing of your personal data is carried out, including with the aid of electronic means, by means of the operations indicated in art. 4 no. 2) GDPR and specifically: the processing of personal data may consist of collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination.
On certain occasions your data may be subject to erasure or destruction (for example with reference to processing in the form of video-surveillance).
The processing of your personal data will be carried out both with manual instruments and with IT and telematic instruments, with organisational and processing logic strictly related to the purposes themselves and in any event in such a way as to guarantee the security, integrity and confidentiality of the data in compliance with the organisational, physical and logical measures provided for by the applicable provisions. The activation of an automated decision-making process is excluded
4. MANDATORY NATURE OF THE PROVISION OF DATA
4.1 The provision of data for the purposes indicated in point 2.1 is necessary for the conclusion of the travel contract. If you fail to provide your data, Enruta360 S.r.l. will not be able to proceed with the booking and the finalisation of the contractual relationship.
4.2 The provision of data for the purposes indicated in point 2.2 is optional. However, if you fail to provide your data and, in particular, the certificates requested, penalties may be charged to you.
4.3 The provision of data for the purposes indicated in point 2.3 is necessary for the performance of the contract. If you fail to provide your data, Enruta360 S.r.l. will not be able to finalise your booking or properly manage the contractual relationship, given that the Personal Record is the area through which you may modify, verify or cancel your booking.
4.4 The provision of data for the purposes indicated in point 2.4 is necessary for the conclusion and performance of the travel contract. If you fail to provide your data, Enruta360 S.r.l. will not be able to proceed with the booking and the finalisation of the contractual relationship.
4.5 The provision of data for the purposes indicated in point 2.4 is not mandatory.
Failure to communicate the data, therefore, does not prevent the conclusion of the contract or participation in the trip, but may create practical inconvenience linked to the failure to receive essential operational information in a timely manner. You may object to the processing at any time by leaving the chat group specifically created.
4.6 The provision of data for the purposes indicated in point 2.5 is not mandatory.
Failure to consent to the processing will not preclude your participation in the trip or the conclusion of the contract. Simply, if you decide not to provide the data, you will not receive newsletters and/or our Magazine.
4.7 The provision of data for the purposes indicated in points 2.7 is not mandatory and does not preclude your participation in the trip.
You are free to refuse to be photographed or recorded. You may do so by informing the coordinator in advance or by refraining from group photographs. You may object to the processing at any time, either by asking not to take part in photographs/recordings, or by requesting the removal of content that may have been published on the institutional channels by writing to privacy@enruta360.com
4.8 The provision of data for the purposes indicated in point 2.8 is necessary. Failure to provide the data entails, for Enruta360 S.r.l., the impossibility of proceeding with and performing the insurance contract, as well as of properly managing the event, with practical consequences such as the lack of coverage of healthcare expenses by the insurance.
4.9 The provision of data for the purposes indicated in point 2.9 is necessary. If the data referred to above are not provided, Enruta360 S.r.l. will not be able to proceed with the booking and the finalisation of the contractual relationship.
4.10 The provision of data for the purposes indicated in point 2.10 is necessary to enable Enruta360 S.r.l. to protect its interests and rights.
4.11 The provision of data for the purposes indicated in point 2.11 is necessary to enable Enruta360 S.r.l. to carry out the communicative fulfilments and duties in case of safety or emergency.
4.12 The provision of data for the purposes indicated in point 2.12 is optional.
You are not obliged to leave your feedback or to reply to the e-mail received. The only consequence will be that Enruta360 S.r.l. will not have useful information to further improve the quality of the services offered.
4.13 The provision of data for the purposes indicated in point 2.13 is necessary to enable Enruta360 S.r.l. to avoid sending you repetitive advertisements, making communication with you more relevant.
Objection to such processing is technically possible, but may result in the receipt of future advertising communications, as it will no longer be possible to manage the targeted exclusion.
4.14 The Data Subject is always responsible for the accuracy and updating of the data provided. If of your own initiative you provide personal information that is not necessary or useful for the pursuit of the purposes indicated above, the same will not be used except to the extent necessary to assess their necessity, and the acts and documents containing them will be duly returned or destroyed.
4.15 The provision of data for the purposes indicated in point 2.14 is necessary for the creation of the Account and for the completion of the online purchase: if the data are not provided it will not be possible to complete registration on the website or to finalise the purchase. Consent for the sending of newsletters and promotional communications referred to in the same point 2.14 is instead optional: refusal does not prejudice the conclusion of the purchase or the use of the Account.
5. SCOPE OF DISCLOSURE OF DATA
5.1 Your personal data, except as provided in point 5.6 below, will not in any way be subject to dissemination.
The data provided for the purposes referred to in point 2.1 may be shared with:
Airlines and flight booking intermediaries;
Travel agencies, local correspondents and other service providers;
Local authorities competent for the issue of visas;
Insurance companies;
Service providers at departure airports;
Banking institutions for economic transactions and invoicing.
The Controller guarantees the utmost care and diligence so that the communication of your personal data to the aforementioned recipients concerns exclusively the data strictly necessary for the achievement of the specific purposes for which they are intended.
5.2 The data provided for the purposes referred to in point 2.2 may be shared with Airlines for the management of cancellations.
5.3 The data provided for the purposes referred to in point 2.3 are not shared with third parties but remain visible exclusively to the data subject through reserved access to the website.
5.4 The data provided for the purposes referred to in point 2.4 will be shared with the Coordinator Participant assigned to the trip.
5.5 The data provided for the purposes referred to in point 2.5 may be shared with the company entrusted with the distribution of the Magazine.
5.6 The data provided for the purposes referred to in point 2.7 may be published on the institutional website www.enruta360.com on the Controller’s social networks (e.g. Facebook, Instagram, YouTube); as well as in the Magazine and not transferred to third parties for marketing purposes.
5.7 The data provided for the purposes referred to in point 2.8 will be shared with:
Insurance companies for the management of claims;
Local authorities and correspondents (if required in case of health emergency).
5.8 The data provided for the purposes referred to in point 2.9 may be shared with:
Competent authorities (law enforcement, judicial authorities), if necessary;
Legal advisers to handle any proceedings;
5.9 The data provided for the purposes referred to in point 2.10 may be shared with:
Law firms or lawyers appointed by the company for defence in court;
Judicial authorities, if required during proceedings;
Insurance companies, if necessary.
5.10 The data provided for the purposes referred to in point 2.11 may be shared with:
Internally with the trip coordinator and personnel authorised by the company;
Local authorities and/or healthcare facilities in case of emergencies.
5.11 Personal data used for the purposes referred to in point 2.12 are managed exclusively by the company Enruta360 S.r.l. and are not communicated externally.
5.12 Personal data used for the purposes referred to in point 2.13 may be shared with companies operating in the digital advertising sector (Meta/Facebook)
5.13 Your data will come to the knowledge of the Coordinator participant, as well as the personnel of Enruta360 S.r.l. specifically authorised, as well as, in the capacity of Processors, third parties who carry out instrumental activities on behalf of the Controller.
5.14 The data provided for the purposes referred to in point 2.14 are not communicated to third parties, except as already provided in point 5.1 in relation to the data necessary for the performance of a travel contract that may be concluded through the Account, and remain visible exclusively to you through the reserved area of the website.
6. TRANSFER OF DATA ABROAD
6.1 Your personal data are stored on servers located in Italy. It is, however, essential that you know that, having regard to the destination chosen by you and in order to perform the travel contract, we will have to transfer your personal data to countries in which the same level of personal data protection as that present in the EU is not guaranteed.
We assure you that the extra-EU transfer of data takes place in accordance with the applicable legal provisions and in particular those of Title V of the GDPR
7. DATA RETENTION PERIOD
7.1 Personal data collected for the purposes referred to in point 2.1 will be retained for the entire duration necessary to properly manage the contract (from booking until completion of the trip).
In addition, these data will be retained for a further period of 10 years following the end of the contract itself, in accordance with the specific legal provisions in that regard.
7.2 Personal data collected for the purposes referred to in point 2.2 will be retained for the period strictly necessary to complete all operations of cancellation of the booking and management of the insurance or refund file, as well as to protect any subsequent legal needs.
7.3 Personal data collected for the purposes referred to in point 2.3 will be retained for the period necessary for the performance of the contractual travel relationship and until the end of the trip.
7.4 Personal data collected for the purposes referred to in point 2.4 will be retained for the period necessary for the performance of the contractual travel relationship and until the end of the trip.
7.5 Personal data collected for the purposes referred to in point 2.4 will be retained from the creation of the chat group (before departure) until the conclusion of the trip. Without prejudice to your right to object to the processing and without prejudice to your free will to continue to maintain relations with the Coordinator and the other participants, from which, however, Enruta360 S.r.l. declares itself uninvolved.
7.6 Personal data collected for the purposes referred to in point 2.5 will be retained for as long as you decide to remain subscribed to the service: in practice, until you keep your consent active.
Once consent has been withdrawn (by clicking on the unsubscribe link or by sending a request in the manner described in point 2.5), your data will be erased or anonymised within 30 days of the request.
7.7 Personal data collected for the purposes referred to in point 2.7 will be retained for 5 years from their acquisition, save for a specific need for historical documentation where the travel destination remains inaccessible for a long time (e.g. due to wars, epidemics or extraordinary closures). In these circumstances, prolonged retention makes it possible to have material already available and representative for the tourist promotion of such countries as soon as they become visitable again.
7.8 Personal data collected for the purposes referred to in point 2.8 will be retained for the entire duration of the management of the insurance file and the claim.
Subsequently, the data will be retained to protect the company from possible complaints or disputes (maximum 10 years in the event of potential litigation or legal obligations).
7.9 Personal data collected for the purposes referred to in point 2.9 will be retained for a variable period, proportionate to the event.
This retention period is justified by the need to adopt protective measures towards persons who have engaged in dangerous, violent or otherwise seriously harmful conduct (e.g. failed payments, conduct that puts the group at risk) and up to a maximum period of 15 years.
The Controller, in any event, carries out periodic reviews to verify whether the reasons justifying the retention of the data persist. If they no longer exist, it proceeds to erasure.
7.10 Personal and/or special category data collected for the purposes referred to in point 2.10 will be retained for the entire duration necessary for the complete resolution of the complaint or dispute.
After resolution, the data must be kept for the limitation period provided for by civil law, normally 10 years, to protect any further rights and interests of the Controller.
In the event of judicial litigation, the data will be retained until the judgment defining the relevant proceedings becomes final (passaggio in giudicato).
7.11 Personal data collected for the purposes referred to in point 2.11 will be retained for the period necessary for the performance of the contractual relationship and, in case of safety or emergency, until these cease.
7.12 Personal data collected for the purposes referred to in point 2.12 will be retained for 24 months from the time of collection and will subsequently be anonymised and aggregated.
7.13 Personal data collected for the purposes referred to in point 2.13 will be retained for as long as your contractual relationship with Enruta360 S.r.l. continues and for a period of 12 months following the end of the contract.
7.14 Verification of the obsolescence of the data being processed in relation to the purposes for which they were collected and processed is carried out periodically.
7.15 Personal data collected for the purposes referred to in point 2.14 will be retained for the entire period of validity of the Account, until your possible request for erasure, and subsequently, for the period necessary to protect any contractual, accounting and tax needs connected with purchases made through the Account, and in any event not beyond 10 years, consistent with what is indicated in point 7.1.
8. DATA CONTROLLER
Enruta360 S.r.l.
C.F. 18217641002
P.IVA 18217641002
Via Ludovico Ariosto, 7
Rocca Priora (RM)
E-mail: info@enruta360.com
9. DATA PROTECTION OFFICER
The Controller has appointed a data protection officer who may be contacted at the following e-mail address:
10. RIGHTS OF DATA SUBJECTS
At any time you may know the data concerning you, know how they were acquired, verify whether they are accurate, complete, up to date and well kept, and request their rectification or erasure pursuant to arts. 16 and 17 GDPR.
Pursuant to art. 21 GDPR, you will have the right to object in whole or in part to the processing of data for reasons connected with your particular situation; where the data are processed for direct marketing purposes you will have the right to object at any time to the related processing for such purpose.
These rights may be exercised by means of a specific request to be addressed to the Data Controller at the e-mail address: privacy@enruta360.com
You also have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority).
Rocca Priora, 29.09.2025
The Data Controller
Enruta360 S.r.l.