Privacy Policy

1. Data Controller

The Data Controller is Vispetta S.r.l., registered office at Via Barbarani 11, 37016 Garda (VR) — VAT IT04958500235. Contact: info{'@'}vispetta.com — Tel. +39 045 2456033.

2. Types of Data Collected

During browsing and use of our services we collect the following categories of data:

• Navigation data: IP addresses, browser type, operating system, pages visited, access times (automatically collected by servers).
• Contact details: first name, last name, email address, phone number provided via booking or contact forms.
• Identity and driving data: driving licence, identity document, date of birth, nationality (required at vehicle pickup).
• Payment data: processed exclusively by PCI-DSS certified providers (Stripe); Vispetta does not store card data.
• Cookies and tracking technologies: see the Cookie Policy.

3. Purposes and Legal Bases for Processing

Personal data are processed for the following purposes, each supported by a specific legal basis:

• Performance of the rental contract (Art. 6(1)(b) GDPR): booking management, confirmations, modifications, rental assistance.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): retention of fiscal and contractual documentation, communications to public security authorities when required by law.
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, IT security, aggregate statistical analysis to improve services.
• Consent (Art. 6(1)(a) GDPR): sending commercial communications and newsletters (revocable at any time).

4. Processing Methods and Retention

Data are processed using electronic tools and, where necessary, paper-based tools, with appropriate technical and organisational security measures. Retention periods:

• Contractual data (bookings, driving documents): 10 years from contract termination, in compliance with fiscal and civil law obligations.
• Navigation data and logs: maximum 12 months.
• Marketing data: until consent is withdrawn.
• Payment data: retained by the provider for the applicable legal terms.

5. Data Sharing with Third Parties

Data may be shared with the following categories of recipients, to the strictly necessary extent:

• Payment providers (Stripe Inc.) for transaction management.
• Cloud and hosting service providers for data storage.
• Web analytics platforms (e.g. Google Analytics) in aggregate and anonymised form.
• Public authorities (law enforcement, tax authorities) when required by law.
• Law firms and accountants for legal compliance.

6. International Data Transfers

Some providers (e.g. Stripe, Google) may transfer data outside the European Economic Area. In such cases, transfers are made on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR) or where an adequacy decision exists. A copy of the safeguards adopted can be requested by writing to info{'@'}vispetta.com.

7. Rights of the Data Subject

Pursuant to Arts. 15–22 GDPR, data subjects have the right to:

• Access: obtain confirmation of whether data concerning them are being processed and receive a copy.
• Rectification: obtain correction of inaccurate data or completion of incomplete data.
• Erasure ('right to be forgotten'): obtain deletion of data when no longer necessary or upon withdrawal of consent.
• Restriction: obtain restriction of processing in certain circumstances.
• Portability: receive their data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest or for marketing purposes.
• Withdrawal of consent: at any time, without affecting the lawfulness of prior processing.
• Complaint: lodge a complaint with the relevant data protection authority.

8. Cookies

The site uses technically necessary cookies and, subject to consent, analytical cookies. For detailed information please refer to the Cookie Policy available on the site.

9. Minors

Vispetta's services are intended for persons aged 18 and over. We do not knowingly collect personal data from minors under 18. If such data were collected in error, we will delete it immediately upon notification.

10. Updates

This notice may be updated for regulatory compliance or service improvements. The latest version will always be available on this page with the date of last revision. Last updated: May 2026.