This privacy policy describes how we handle your personal data when you visit this website or send us a request. It complies with Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

1. Data controller

The data controller is FOLK S.r.l. under incorporation, who can be contacted at hello@folktrips.com.

The company is currently being set up. Once registration with the Business Register is complete, we will update this page with the registered office, VAT number and final contact details. This update will not change the purpose of processing or your rights.

2. What data we collect

a) Data you provide through the contact form:

• first and last name

• email address

• telephone number

• the trip you want to book, your travel dates, and how many people are travelling with you

b) Data you provide when booking, if you choose to join a trip:

• first name, last name, home address, and tax code

• any request to activate travel cancellation insurance

We collect this data solely to allow Carousel S.r.l. to prepare your travel contract and any insurance policies. We pass it on to them for this reason.

c) Browsing data:

• technical data collected automatically as you browse (IP address, browser and device type, pages visited, duration of visit), via cookies and the tools described in section 9.

We do not collect special categories of data (such as health data) under Art. 9 GDPR through this site. If such information is needed for the trip or insurance, Carousel S.r.l. will collect it under the travel contract, following their own privacy policy.

3. Why we process your data and the legal basis

• Answering your request and planning your trip. Data: Form data · Legal basis: Pre-contractual measures taken at your request (Art. 6.1.b GDPR) · Provision: Necessary: we cannot contact you without this data

• Sharing your data with Carousel S.r.l. to complete your travel contract, arrange insurance, and process payments. Data: Name, surname, email, phone, address, tax code, request details · Legal basis: Pre-contractual measures taken at your request (Art. 6.1.b GDPR) · Provision: Necessary if you decide to book

• Aggregate statistical analysis on website use. Data: Browsing data · Legal basis: Consent given via the cookie banner (Art. 6.1.a GDPR) · Provision: Optional

• Establishing, exercising, or defending a legal claim; compliance with legal obligations. Data: Relevant data · Legal basis: Legitimate interest (Art. 6.1.f GDPR); legal obligation (Art. 6.1.c GDPR)

We do not use automated decision-making or profiling under Art. 22 GDPR.

4. Who we share your data with

Carousel S.r.l., with registered office at Viale della Vittoria 69, 60123 Ancona (AN), VAT number 00865350425. If you want to join a trip, we share your data with Carousel S.r.l. They are the authorised travel agency that organises and sells the trips shown on this site. Carousel S.r.l. processes your data as an independent data controller to arrange and manage your travel contract, in line with their own privacy policy. A link to the Carousel S.r.l. policy will be published here shortly.

Technical service providers, who process data on our behalf as data processors under Art. 28 GDPR:

• Framer B.V. (Netherlands), hosting and website management

• Google Ireland Ltd., statistical analysis services (Google Analytics 4), active only with your consent

• Microsoft Ireland Operations Ltd., user experience analysis and session recording services (Microsoft Clarity), active only with your consent

The updated list of data processors is available on request at hello@folktrips.com.

We do not sell your data, share it for third-party advertising, or distribute it.

5. Transfers outside the EU

Some providers (especially Google and Microsoft) may transfer data to third countries, including the United States. These transfers are based on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework or, in its absence, standard contractual clauses pursuant to Art. 46 GDPR, supplemented where necessary by extra measures.

6. How long we keep your data

• Contact form data: as long as needed to handle your request, and no longer than 24 months from the last contact, unless a contract is signed.

• Booking data: as long as needed to send it to Carousel S.r.l. and to meet our legal duties.

• Browsing data: in line with the terms in section 9, and no longer than 14 months for Google Analytics data.

• Data needed for legal obligations or legal claims: for the terms required by law.

Once these terms expire, the data is deleted or anonymised.

7. Your rights

You can exercise your rights under Articles 15-22 GDPR at any time: access, rectification, erasure, restriction of processing, objection, portability, and withdrawal of consent (without affecting the lawfulness of processing before the withdrawal).

To exercise these rights, write to hello@folktrips.com. We will reply within one month, in line with Art. 12.3 GDPR. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the supervisory authority in your country of residence.

For data processed by Carousel S.r.l. as an independent controller, you can exercise your rights directly with Carousel S.r.l. using the contacts in their privacy policy.

8. Security

We use appropriate technical and organisational measures in line with Art. 32 GDPR, including encrypted transmission (HTTPS), limiting data access to authorised persons, and selecting providers who offer sufficient guarantees.

9. Cookies

This site uses:

Technical cookies, which are needed for the site to work. These do not require consent (Art. 122 Legislative Decree 196/2003).

Third-party analysis tools (Google Analytics 4 and Microsoft Clarity), used for aggregate statistics on site use and to understand how visitors interact with the pages. These are active only if you consent via the banner when you first visit the site. No analysis script runs before you consent.

Microsoft Clarity records interactions with the pages anonymously (mouse movements, clicks, scrolling) to create heatmaps and session recordings. Visible text and form fields are hidden at source: we do not collect names, email addresses, or other data you enter in forms.

You can change or withdraw your consent at any time by clicking on Cookie settings at the bottom of any page.

List of cookies used, duration, and purpose:

• framer-cookie-consent · Type: Technical · Purpose: Stores your cookie choice · Duration: 180 days

• _ga · Type: Analytical · Purpose: Distinguishes unique users · Duration: 2 years

• _ga_NTMF7W15RZ · Type: Analytical · Purpose: Maintains session state · Duration: 2 years

• _clck · Type: Analytical · Purpose: Connects visits to an anonymous identifier (Microsoft Clarity) · Duration: 1 year

• _clsk · Type: Analytical · Purpose: Group pages viewed in a single session (Microsoft Clarity) · Duration: 1 day

10. Minors

FOLK trips are for adults. This site is not intended for people under 18 and we do not knowingly collect children's data. If you believe a child has provided us with personal data, please contact us at hello@folktrips.com so we can delete it.

11. Changes to this policy

We may update this policy, for example when setting up FOLK S.r.l., adding new tools, or changing providers. The current version is always the one published on this page. We will notify you on the site if we make significant changes.