Privacy Policy
This page explains what personal data Prestige Rent S.r.l. collects when you use this website, why we collect it, who else sees it and what you can ask us to do about it. It is written under the EU General Data Protection Regulation (Regulation 2016/679, “GDPR”), which applies to us because we are established in Italy — wherever in the world you are reading this from.
Last updated: 27 August 2026
1. Who we are
The data controller is Prestige Rent S.r.l., Via della Saggina 98, 50145 Florence, Italy. VAT number IT05745220482, registered with the Florence Register of Companies under REA no. FI 571489. Certified email (PEC): prestigerent@pec.it.
You can reach us at usa@prestigerent.com or on +39 055 286059. For anything about your personal data, write to usa@prestigerent.com.
2. What we collect, and why
When you send us a request through the contact form
We ask for your name and email address, which are required, and optionally your phone or WhatsApp number, the tour you are interested in, a date, the number of people and a free-text message. We also record the page you were on and the language you were reading in.
We use this only to answer you and to prepare the quote you asked for. The legal basis is Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. If you write something extra in the message box (an allergy, a wheelchair, a medical need) that may be special category data: we use it only to organise your day, on the basis of your explicit request under Article 9(2)(a), and we ask you not to send us more than we need to know.
When you book and pay
Bookings and payments do not happen on this website. The booking calendar you see on our tour pages is operated by Regiondo GmbH (Munich, Germany), and your name, contact details and payment are collected there, under Regiondo’s own terms. We receive from Regiondo the booking details we need to run your tour. Legal basis: Article 6(1)(b) GDPR, performance of the contract.
When you contact us on WhatsApp, by phone or by email
We keep the conversation and the contact details it contains, so that whoever answers you next already knows what was said. Legal basis: Article 6(1)(b), or for general enquiries our legitimate interest in answering the people who write to us, Article 6(1)(f).
When you simply browse
Our hosting provider records the technical information every web server records — IP address, browser, pages requested, time — which we use to keep the site up and to stop abuse of the contact form. Legal basis: legitimate interest, Article 6(1)(f). Analytics and advertising cookies are a separate matter and are used only with your consent: see our Cookie Policy.
3. Who else sees your data
We do not sell your data and we do not rent it to anyone. We do share it with:
- Regiondo GmbH (Germany) — booking and payment platform.
- Supabase — the database where contact-form requests are stored, hosted in Ireland, inside the European Union.
- Vercel Inc. (United States) — hosting of this website.
- HighLevel Inc. (United States) — the CRM our team uses to answer you. Your request is copied there so the person replying already has your tour, date and party size in front of them.
- Brevo (Sendinblue SAS, France) — email delivery.
- Google Ireland Ltd. and Meta Platforms Ireland Ltd. — measurement and advertising, and only if you accept the relevant cookies.
- Our drivers, guides, wineries and restaurants, limited to what they need to welcome you on the day.
- Accountants, insurers and lawyers, and public authorities where the law requires it.
4. Transfers outside the European Economic Area
Some of the providers above are established in the United States. Where that is the case the transfer is covered by the European Commission’s Standard Contractual Clauses and, where the provider is certified, by the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards in place by writing to the address in section 1.
5. How long we keep it
- Contact-form requests that do not become a booking: 24 months.
- Booking and customer records: 10 years from the end of the tax year, as Italian tax and accounting law requires.
- Messages on WhatsApp, email and in the CRM: 24 months.
- Click identifiers stored in your browser (gclid and similar): 90 days.
- Cookies: for the lifetime shown in the Cookie Policy.
6. Your rights
Under Articles 15 to 22 GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable format. Where we rely on legitimate interest you can object. Where we rely on consent you can withdraw it at any time, and withdrawing it does not make what we did before unlawful.
Write to the address in section 1 and we will answer within one month. If you are not satisfied you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, or to the authority where you live.
7. Children
This website is not addressed to children. Where children travel with you we receive their details from the adult who books, and we use them only to organise the tour — a child seat, a lunch, a headcount.
8. Automated decisions
We do not make decisions about you by automated means, and we do not profile you in a way that produces legal effects.
9. Changes to this policy
If we change how we use your data we will update this page and change the date at the top. Where the change is significant we will say so on the site.