Privacy Policy

This notice describes how the personal data of users visiting verona.stepbystory.com and using the services made available through it are processed. It is provided pursuant to art. 13 of Regulation (EU) 2016/679 (the “GDPR”) and applies to this website only, not to other websites that may be reached through links.

1. Data Controller

The Data Controller is Step by Story, VAT no. 04944860230.

For any matter concerning the processing of personal data, please write to [email protected].

The Controller has not appointed a Data Protection Officer (DPO), as the conditions under art. 37 GDPR do not apply.

2. What is meant by personal data and processing

“Personal data” means any information relating to an identified or identifiable natural person. “Processing” means any operation performed on personal data: collection, recording, storage, consultation, alteration, disclosure, erasure and destruction.

3. Categories of data processed

3.1 Browsing data

The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP addresses, browser and operating system type, URI addresses of the resources requested, the time of the request, the method used, the size of the file obtained in response and the status code of the server’s response.

This data is used solely to obtain anonymous statistical information on the use of the website and to check that it is working properly. It may be used to establish liability in the event of computer crimes against the website.

3.2 Data voluntarily provided through the website forms

The website provides three forms, which collect different data depending on their purpose:

• Contact form — first name, surname, email address, telephone number (required) and the content of the message.
• Booking form — first name, surname, email address, telephone number (optional), number and type of participants, requested date and time, chosen language and itinerary, together with any notes and information on intolerances or dietary requirements.
• Become a Partner form — identification and contact details of the business or organisation (name, category, description, address, telephone, email, website, opening hours) and any materials uploaded (logo, main image, photo gallery).

The information users choose to enter in the field concerning intolerances and dietary requirements may reveal data concerning health, which the GDPR classifies as a special category of data (art. 9). Such information is processed solely on the basis of the explicit consent given by submitting the form (art. 9.2.a GDPR), for the sole purpose of organising the requested experience safely, and is disclosed only to the operational partners involved in delivering that specific experience. Providing it is entirely optional: users are advised not to enter information that is not strictly necessary.

3.3 Data collected through cookies and similar technologies

The website uses technical cookies, necessary for its operation, and — subject to the user’s consent collected through the dedicated banner — statistical and third-party cookies. A detailed description of each cookie, its duration and its purpose is set out in the Cookie Policy, which forms an integral part of this notice. Preferences may be changed or withdrawn at any time from the consent management panel.

4. Purposes of processing and legal basis

Providing the data marked as mandatory in the forms is necessary in order to act on the request: failure to provide it means the request cannot be fulfilled. Providing any other data is optional.

5. Processing methods and retention period

Data is processed using IT and electronic tools, according to logic strictly related to the stated purposes and with technical and organisational measures appropriate to ensure its security (art. 32 GDPR).

Data is retained for as long as strictly necessary to achieve the purposes for which it was collected and, in any case, according to the following terms:

• requests for information: up to 24 months from the last contact;
• bookings and experiences delivered: for the duration of the relationship and thereafter for the periods required by civil and tax obligations (as a rule 10 years);
• information on intolerances and dietary requirements: until the experience has taken place, and erased thereafter;
• unsuccessful partner applications: up to 12 months;
• browsing data: for the technical time necessary, except where computer crimes need to be established;
• data collected through cookies: for the durations set out in the Cookie Policy.

6. Place of processing, disclosure and transfers

Processing connected with the website’s web services takes place at the Controller’s premises and at the data centres of the hosting and infrastructure providers, and is carried out by personnel authorised to process the data or by parties appointed as processors under art. 28 GDPR.

Data may be disclosed to:

• the provider of the hosting and email services on which the website runs;
• the provider of the network and security services (CDN) through which the website is delivered;
• the provider of the statistical analysis service, limited to users who have given their consent;
• the partners and guides involved in delivering the specific experience booked, limited to the data necessary;
• consultants, professionals and suppliers providing technical, administrative, accounting and legal assistance;
• judicial authorities and public administrations, in the cases provided for by law.

Some providers (in particular those of the statistical analysis, content delivery and web font services) may involve a transfer of data to third countries. Such transfers take place in compliance with Chapter V of the GDPR, on the basis of adequacy decisions of the European Commission — including the EU-U.S. Data Privacy Framework — or Standard Contractual Clauses.

Step by Story does not sell users’ personal data to third parties and does not use it for automated profiling.

7. Rights of the data subject

Data subjects may exercise the rights provided for by arts. 15-22 of the GDPR at any time:

• obtain confirmation as to whether processing is taking place and access their personal data;
• obtain rectification of inaccurate data or completion of incomplete data;
• obtain erasure of the data in the cases provided for by law;
• obtain restriction of processing;
• receive the data provided in a structured, commonly used format and transmit it to another controller (portability);
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests should be addressed to [email protected]. The Controller will respond within one month of receiving the request.

Data subjects also have the right to lodge a complaint with the supervisory authority, the Italian Data Protection Authority (www.garanteprivacy.it).

8. Personal data of minors

Step by Story’s experiences and services may also be enjoyed by minors, provided they are accompanied by a parent or by those holding parental responsibility, or as part of activities organised by schools and other bodies. Personal data may however only be submitted directly through the website’s forms by users aged 14 or over, the threshold set by art. 2-quinquies of Legislative Decree 196/2003 for information society services; for children under 14, data must be provided by those holding parental responsibility. In the case of experiences aimed at schools and groups, the data of underage participants is collected and processed through the school or organising body, which acts as an independent controller in relation to families.

9. Links to third-party websites and profiles

The website contains links to third-party websites and social media profiles, as well as to messaging services. Simply displaying the link does not involve any transmission of data to those parties: processing begins only if the user chooses to follow the link, and in that case it is governed by the notices of the respective operators, over which the Controller has no control.

10. Changes to this notice

The Controller reserves the right to update this notice, giving notice on this page. Users are invited to consult it periodically. In the event of substantial changes, and where necessary, consent will be requested again.

Last updated: 24 August 2026.