Last updated: 13 September 2026
This Privacy Policy explains how personal data is collected and used when you visit www.discoverypisa.com, contact Discovery Pisa, subscribe to communications, or book or participate in a Discovery Pisa tour or experience.
Discovery Pisa is a trading brand jointly operated by two independent Italian professionals:
Andrea Dominguez Maraver
Via Contessa Matilde 64 D
56123 Pisa (PI), Italy
VAT number: IT02176310502
National Register of Tourist Guides (ENGT): 09001467
Anastasia Sierp
Via Ranieri Galletti 11 B
56122 Pisa (PI), Italy
VAT number: IT03735650792
National Register of Tourist Guides (ENGT): 09001164
Andrea and Anastasia act as joint controllers for personal data processed in operating the Discovery Pisa website, handling enquiries and direct bookings, communicating with customers and administering Discovery Pisa’s services. This means they jointly determine why and how that data is processed and share responsibility for complying with data-protection law.
You may exercise your rights against either joint controller. The shared contact point for privacy requests is:
Email: info@discoverypisa.com
Telephone/WhatsApp: +39 351 542 5848
Depending on how you interact with us, we may process:
– Identity and contact data: name, email address, telephone number, country and contact preferences.
– Booking and participation data: selected tour, date and time, language, number and ages of participants, booking reference, ticket options, meeting arrangements, requests, correspondence and attendance information.
– Transaction data: amount, currency, payment status, refunds and limited payment references. Payment-card details are collected by FareHarbor and its payment providers; Discovery Pisa does not receive or store your complete card number.
– Accessibility, dietary or health-related information: information you voluntarily provide when it is necessary to respond to an accessibility request, manage an allergy or dietary requirement, or protect participant safety.
– Enquiry and communication data: messages submitted through forms, email, telephone, WhatsApp or social media, together with our responses.
– Marketing data: newsletter subscription, consent record, communication preferences and engagement with communications.
– Technical and usage data: IP address, approximate location derived from IP, device and browser information, language, referring page, pages viewed, timestamps, identifiers and interaction data.
– Feedback and media: reviews, survey responses, photographs or other content you choose to provide or permit us to use.
We do not intentionally collect more information than is reasonably necessary for the relevant purpose.
We collect personal data:
– directly from you;
– from the person who books on your behalf;
– through our website, contact forms and consent-management tools;
– from FareHarbor and its payment providers when you make or manage a booking;
– from an online travel agency, reseller, hotel, travel adviser or other partner when you book through them; and
– from analytics, advertising and review services, where permitted by your consent and applicable law.
If you provide another participant’s data, you must be authorised to do so and should make this Privacy Policy available to them.
We process personal data for the following purposes:
Purpose | Data commonly used | Legal basis |
|---|---|---|
Answering questions and taking steps requested before a booking | Identity, contact, enquiry and requested-tour data | Steps at your request before entering a contract; legitimate interests in responding to genuine enquiries |
Creating, administering and delivering a booking | Identity, contact, booking, participation and transaction data | Performance of a contract |
Sending confirmations, service messages and important tour updates | Contact and booking data | Performance of a contract; legitimate interests in safely administering the service |
Processing payments, cancellations, refunds and disputes | Booking and transaction data | Performance of a contract; legal obligations; establishment, exercise or defence of legal claims |
Meeting accounting, tax, consumer-protection and legal requirements | Identity, booking and transaction data | Compliance with legal obligations |
Managing safety, accessibility, allergies and dietary requirements | Information you choose to provide | Explicit consent for special-category data; where applicable, protection of vital interests |
Preventing fraud, misuse and security incidents | Contact, transaction and technical data | Legitimate interests in protecting customers, the website and our services; legal obligations where applicable |
Improving the website and measuring performance | Technical and usage data | Consent where non-essential cookies or similar technologies are used; limited legitimate interests for strictly necessary security and aggregate operational measurement |
Measuring advertising and reaching interested audiences | Online identifiers and interaction data | Consent |
Sending newsletters or promotional emails | Contact details, preferences and engagement | Consent, unless a limited existing-customer exception lawfully applies; you may opt out at any time |
Handling feedback, complaints and legal claims | Communications, booking and relevant supporting data | Legitimate interests; compliance with legal obligations; establishment, exercise or defence of legal claims |
Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations. You may object as explained in section 10.
Information about health, disability, allergies or similar matters can receive additional protection under the GDPR. Please provide only what is necessary for us to understand and respond to your needs.
When you voluntarily give us this information for tour arrangements, we process it with your explicit consent. You may withdraw that consent, although doing so may prevent us from safely accommodating the request. In an emergency, information may be used where necessary to protect someone’s vital interests.
Our tours may include children, but bookings must be made by an adult. We may process a child’s name, age, ticket information and needs when supplied by the responsible adult and necessary to administer the booking or comply with attraction rules.
The website and marketing communications are not directed at children, and we do not knowingly invite children to subscribe to marketing.
We disclose personal data only where reasonably necessary. Recipients may include:
– FareHarbor and payment providers such as Stripe, for booking administration, payment processing, refunds, fraud prevention and customer verification;
– SiteGround, WordPress-related services and technical suppliers, for website hosting, maintenance, security and backups;
– Google services, including Google Analytics and Google Tag Manager, for consent-based analytics and tag management, and email or business services used to communicate;
– Meta, where the Meta Pixel or related advertising tools operate after consent;
– ComplianZ, for recording and applying cookie choices;
– Elfsight and review platforms, where review content or widgets are displayed;
– guides, venues, attractions, food providers and other service partners, but only the information they reasonably need to deliver the booked experience;
– online travel agencies, resellers and travel partners, where your booking was made through them or where coordination is needed;
– accountants, insurers, legal advisers and other professional advisers under appropriate confidentiality duties; and
– public authorities, courts or law-enforcement bodies where disclosure is required by law or necessary to protect legal rights or safety.
Some providers act as processors on our instructions. Others, including payment providers, travel platforms and certain analytics or advertising companies, may act as independent controllers for parts of their processing. Their own privacy notices provide further information.
We do not sell personal data.
Some technology providers may process personal data outside Italy or the European Economic Area, including in the United States. Where required, transfers are supported by a European Commission adequacy decision, the EU–US Data Privacy Framework for participating organisations, Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.
You may contact us for more information about the safeguards relevant to your data.
We keep data only for as long as needed for the purpose for which it was collected, including legal, accounting and claims requirements. Our normal criteria are:
– booking, payment, invoice and accounting records: generally 10 years, or longer where required for an ongoing audit, dispute or legal obligation;
– ordinary enquiries that do not become bookings: up to 24 months after the last meaningful contact;
– operational accessibility, dietary and health information: normally deleted or anonymised within 30 days after the tour, unless an incident, complaint or legal obligation requires longer retention;
– marketing subscriptions and consent: until you unsubscribe or withdraw consent; inactive marketing records are reviewed and removed periodically;
– cookie and analytics data: for the periods stated in our Cookie Policy and the settings of the relevant service;
– complaints and legal claims: for as long as reasonably necessary to resolve the matter and meet applicable limitation periods; and
– security logs and backups: for limited periods determined by security and backup cycles, unless preservation is required to investigate an incident.
When retention is no longer necessary, data is deleted, anonymised or securely isolated until deletion from backups.
Subject to the conditions in applicable law, you may:
– request access to your personal data;
– ask us to correct inaccurate or incomplete data;
– request deletion of data;
– request restriction of processing;
– object to processing based on legitimate interests or to direct marketing;
– receive data you provided in a portable format where the right applies;
– withdraw consent at any time, without affecting processing that was lawful before withdrawal; and
– lodge a complaint with a data-protection supervisory authority.
To exercise a right, email info@discoverypisa.com. We may ask for information reasonably necessary to confirm your identity and understand the request. We normally respond within one month, subject to the extensions permitted by law.
You may complain to the Garante per la protezione dei dati personali, the Italian supervisory authority, at www.garanteprivacy.it. If you live elsewhere in the EEA, you may also contact the supervisory authority in your country of residence or work.
Strictly necessary technologies support functions such as security and remembering privacy choices. Optional analytics and marketing technologies operate only where the required consent has been given.
Our Cookie Policy provides the current list of cookies and services, their purposes, duration and providers. You can change or withdraw your choices at any time through the Cookie preferences link on the website. Refusing optional cookies does not prevent you from using the core website and booking functions.
We send promotional email only where we have a lawful basis to do so. You can unsubscribe using the link in a marketing email or by contacting info@discoverypisa.com.
Withdrawing marketing consent does not stop service messages that are necessary for an active booking, such as confirmations, meeting instructions or urgent changes.
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, access, disclosure or destruction. These include access controls, secure service providers, encrypted connections where appropriate, backups and measures intended to limit data access to people who need it.
No internet transmission or storage system can be guaranteed completely secure. If a personal-data breach presents a risk requiring notification, we will notify the competent authority and affected individuals as required by law.
Discovery Pisa does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you.
The website may link to attractions, maps, social networks, travel platforms and other independent websites. Their privacy practices are governed by their own notices.
If you book through an online travel agency or reseller, that organisation collects and processes data under its own privacy policy and may share the information needed for us to provide the tour.
We may update this Privacy Policy when our services, providers or legal obligations change. The current version will be published on this page with a revised “Last updated” date. If a change materially affects how we use data already collected, we will provide additional notice where required.
Questions, requests or concerns about privacy can be sent to:
Discovery Pisa – Privacy
Email: info@discoverypisa.com
Telephone/WhatsApp: +39 351 542 5848
You may also write to either joint controller at the address in section 1.
Please also review our Terms and Conditions, Cancellation and Refund Policy and Cookie Policy.