1. Data Controller

The data controller of personal data is:

Ermesia Viaggi S.R.L.

Viale Misurata 23, 20146 Milan (MI) – Italy

Email: info@ermesia.com

PEC (certified email): ermesiaviaggisrl@pec.it

2. Scope

This notice describes how personal data is processed for users who interact with the online services of Ermesia Viaggi S.R.L., accessible from the website www.ermesia.com and from related digital tools (Google forms, booking platforms such as WeTravel, contractual documents and internal platforms).

3. Categories of data processed

Ermesia Viaggi S.R.L. processes the following categories of personal data:

• Identification data: first name, last name, address, email, telephone.

• Billing data: VAT number, tax code, bank details.

• Traveller data (students, teachers, chaperones): date and place of birth, sex, nationality, identity documents, allergies or specific needs communicated for the management of the trip.

• Payment data: IBAN, card details, bank transfers.

• Browsing data: IP address, cookies, technical connection data, web forms.
  
  

4. Purposes and legal basis of processing

5. Processing methods

Processing is carried out using IT and electronic tools, in compliance with the principles of lawfulness, fairness, transparency and data minimisation.

Ermesia Viaggi mainly uses the following tools and platforms:

• Google Workspace / Drive / Gmail / Asana / WeTravel / internal CRMs

• Cloud storage on servers located in the European Union and, in part, outside the EU (e.g. Google LLC), in compliance with the standard contractual clauses approved by the European Commission.

Appropriate technical and organisational security measures are in place, including two-factor authentication, encryption, regular backups and access restricted to authorised personnel.

6. Transfer of data outside the EU

Some data may be transferred to parties established outside the EU (e.g. Google LLC, WeTravel Inc.), exclusively to countries that guarantee an adequate level of protection or on the basis of Standard Contractual Clauses in accordance with Art. 46 of the GDPR.

7. Data retention period

• Contractual, tax and administrative data: 10 years, in compliance with legal obligations.

• Contact data and communications: up to 24 months after the end of the relationship.

• Travellers' personal data and documents: deleted at the end of the trip or project, unless longer retention is required for tax or civil liability reasons.

• Data collected for marketing purposes (if active): until consent is withdrawn.

8. Communication and dissemination of data

Personal data may be communicated to:

• external professionals and consultants (accountant, insurers, technical consultants);

• tourism service providers (hotels, transport companies, museums, local agencies);

• public bodies or schools, where necessary to carry out the trip;

• authorised persons within the Ermesia Viaggi organisation.
  
  

Data will under no circumstances be disseminated or transferred for unauthorised commercial purposes.

9. Rights of the data subject

Users may at any time exercise the rights provided for by Articles 15-22 of the GDPR:

• access, rectification, erasure of data (“right to be forgotten”);

• restriction of or objection to processing;

• data portability;

• withdrawal of consent (without affecting the lawfulness of prior processing).

Requests should be sent to: info@ermesia.com.

10. Processing of minors' data

For school trips, minors' data is collected:

• through schools for educational and organisational purposes, or

• directly through online platforms (e.g. WeTravel), where the parent or legal guardian provides or confirms the minor's data, authorising its processing.

11. Updates

This notice may be updated at any time in the event of regulatory or technical changes.

The latest version is always available on the website www.ermesia.com.