NEW OPENING

Privacy policy

www.cannobioadventure.com

Last updated: 30 June 2026

Welcome to the privacy policy of www.cannobioadventure.com. This policy will help you understand what data we collect, why we collect it, and what your rights are in this regard.

 

DATA PROTECTION AND PRIVACY

The data provided during booking and the visit is processed in accordance with Italian and European privacy regulations.

Applicable Regulations

  • Regulation (EU) 2016/679 (GDPR – General Data Protection Regulation)
  • Legislative Decree No. 196 of 10 August 2018 (Italian Privacy Code)
  • Legislative Decree 196/2003 and subsequent amendments (ePrivacy Regulation)
  • Legislative Decree 206/2005 (Consumer Code – consumer rights)
  • Legislative Decree 81/2008 (Workplace Safety – health declarations)

Data Controller

Cannobio Adventure s.r.l.

Via Vigezzo, 14, 28827 Valle Cannobina (VB)

VAT No.: IT02730010036

Email: info@cannobioadventure.com

Phone: +39 375 14530103

Types of Data We Collect

The Controller does not provide a list of the categories of Personal Data collected.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific information notices displayed prior to Data collection.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically when using this Application.

Unless otherwise specified, all Data requested by this Application is mandatory. If the User refuses to provide it, it may be impossible for this Application to provide the Service. In cases where this Application indicates some Data as optional, Users are free to refrain from providing such Data, without any consequence for the availability of the Service or its functioning.

Users who are uncertain about which Data are mandatory are encouraged to contact the Controller.

Any use of Cookies – or other tracking tools – by this Application or by the owners of third-party services used by this Application is aimed at providing the Service required by the User, in addition to any other purposes described in this document and in the Cookie Policy.

The User is responsible for any third-party Personal Data obtained, published, or shared through this Application.

Personal Data Collected

During online booking and the park visit, the following data is collected:

Identification Data

  • First name, last name
  • Date of birth
  • Residential address
  • Email address
  • Phone number

Payment Data

  • Payment method chosen (Link, Klarna, Amazon Pay, Bancontact, EPS, credit cards)
  • Transaction/payment confirmation number
  • NOT stored: full card number, IBAN, CVV, sensitive banking data (processed by external gateways)

Data for Minors

  • Full identification data of the parent/guardian
  • Date of birth of the minor

Photographs and Videos

  • Personal photographs (ONLY with explicit consent)
  • Personal videos (ONLY with explicit consent)
  • Screenshots/images from surveillance cameras (for safety purposes)

Park Usage Data

  • Date and time of entry
  • Course/route used
  • Exit time
  • Any accidents or injuries
  • Anomalous safety-related behaviour

Legal Basis for Processing

Article 6(b) GDPR – Performance of a Contract

Processing necessary for:

  • Execution of the booking
  • Payment verification
  • Organisation of the visit
  • Communications regarding date/time/route
  • Issuing vouchers in case of park closure

Article 6(c) GDPR – Legal Obligation

Mandatory processing for:

  • Health declarations (safety obligation at height)
  • Civil liability (retention for 5 years)
  • Compliance with accident-prevention regulations (Legislative Decree 81/2008)
  • Communication to competent authorities where required (Police, Judiciary, Local Health Authority)

Article 6(f) GDPR – Legitimate Interest

Processing for:

  • Management of emergency contacts
  • Fraud prevention and detection
  • Safety of the park and visitors
  • Anonymised visitor statistics
  • Service improvement
  • Administrative communications

Article 6(a) GDPR – Explicit Consent

Processing (optional) for:

  • Promotional photographs/videos
  • Marketing and commercial communications
  • Newsletter

Permitted Uses of the Data

1. Booking and Entry Management

  • Payment verification and transaction confirmation
  • Booking confirmation by email
  • Communications on date, time, route, pre-visit instructions
  • Issuing vouchers and refund procedure (in case of park closure)
  • Sending post-visit follow-up emails

2. Legal Compliance

  • Retention of health declarations for 5 years (limitation period for civil liability under Art. 2967 Italian Civil Code and obligation under Legislative Decree 81/2008)
  • Entry logs available to competent authorities where legally required
  • Documentation of accidents/injuries for insurance purposes
  • Documentation for legal proceedings

3. Administrative Communications

  • Automatic emails regarding booking cancellations
  • Weather-related park closure notices
  • Voucher expiry notifications (12 months)
  • Post-visit follow-up contacts
  • Satisfaction surveys

4. Anonymised Statistics

  • Number of visitors per route (without personal identification)
  • Aggregated demographic data (age groups, not names)
  • Visitor trend analysis
  • Operational improvement and capacity planning
  • All data is anonymised and does not identify specific individuals

5. Promotional Photographs/Videos

(ONLY with explicit consent given during booking)

  • Use on the Cannobio Adventure website
  • Use on social media (Facebook, Instagram, TikTok, YouTube)
  • Use in marketing materials
  • Use in printed brochures
  • Use in promotional presentations

6. Fraud Prevention

  • Verification of anomalous transactions
  • Comparison of booking data with identification documents (if necessary)
  • Reporting suspicious conduct to the authorities (where required)

What We Do NOT Do With Your Data

Your data is NOT:

  • Sold to third parties
  • Used for purposes other than those indicated
  • Transferred without consent
  • Subject to automated profiling
  • Subject to automated decisions producing legal effects
  • Shared with external companies for marketing purposes

Sharing of Data with Third Parties

Your data is shared ONLY with the following parties for specific purposes:

Payment Gateways (Stripe, Klarna, Amazon Pay, etc.)

  • Purpose: Payment processing
  • Data shared: Payment method, amount, email, first name, last name
  • Protection: Data encrypted in transit, subject to DPA agreements
  • Note: These providers do NOT have access to sensitive data (health, biometric)

Email Service Provider

  • Purpose: Sending automatic communications (confirmations, notices, vouchers)
  • Data shared: Email, first name, last name, booking data
  • Protection: Data encrypted, deleted after email is sent

Booking Platforms

  • Purpose: Calendar and booking management
  • Data shared: Booking data, email, first name
  • Protection: Data managed under specific DPA agreements

Public Authorities

  • Purpose: Exclusively upon lawful request
  • Who: Police, Carabinieri, Judiciary, Health Authorities (ASL)
  • Data: Only what is required by law
  • Note: Cannobio Adventure will disclose the authority’s request unless legally prohibited from doing so

Civil Liability Insurance

  • Purpose: Management of claims and injuries
  • Data: Health declarations, accident data, accident photos/videos
  • Protection: DPA agreement

Cannobio Adventure does NOT share data with:

  • Marketing companies
  • Profiling companies
  • Credit agencies
  • Data brokers
  • Any other party not expressly authorised

Data Retention Period

Booking, Payment and Entry Data

Retention: 5 years from the visit

Legal basis: Art. 2967 Italian Civil Code (limitation period for civil liability for personal injury)

Health Declarations

Retention: 5 years from the visit

Legal basis: Legislative Decree 81/2008 (Workplace safety – document retention obligation)

Photographs and Videos

Retention: Indefinite, for the company archive

Right of withdrawal: You may request deletion at any time (not retroactive for publications already made)

Access Logs and Staff Records

Retention: 30 days (then deleted), unless requested by an authority

Marketing/Newsletter Data

Retention: Until consent is withdrawn (you may unsubscribe at any time)

Your Privacy Rights

Pursuant to Articles 12-22 of the GDPR and Legislative Decree 196/2018, you have the following rights:

1. Right of Access (Art. 15 GDPR)

You may request a copy of all data that Cannobio Adventure holds about you in a readable format.

How to exercise it: Contact Cannobio Adventure indicating the approximate date of your visit.

2. Right to Rectification (Art. 16 GDPR)

You may request the correction of inaccurate or incomplete data, such as:

  • Incorrect email address
  • Wrong phone number
  • Inaccurately declared height/weight

How to exercise it: Write to Cannobio Adventure indicating the data to be corrected and the desired correction.

3. Right to Erasure – “Right to be Forgotten” (Art. 17 GDPR)

You may request the deletion of data not required to be kept by law.

Possible: Deletion of promotional photos/videos (if not yet published)

Not possible: Deletion of health declarations (legal obligation under Legislative Decree 81/2008), booking data (5-year limitation period under Art. 2967 Italian Civil Code)

How to exercise it: Contact Cannobio Adventure indicating the data to be deleted.

4. Right to Restriction of Processing (Art. 18 GDPR)

You may request the temporary suspension of the processing of your data during a dispute over its accuracy, without having requested deletion.

How to exercise it: Write to Cannobio Adventure indicating the reason for the request.

5. Right to Object (Art. 21 GDPR)

You may object to the processing of data for:

  • Marketing and commercial communications
  • Promotional photographs/videos
  • Statistics and analysis

You cannot object to: Data mandatory under the contract (booking, payment) or by law (health declarations).

How to exercise it: Contact Cannobio Adventure indicating which processing you object to.

6. Right to Data Portability (Art. 20 GDPR)

You may receive your data in a structured, commonly used and machine-readable format (e.g., Excel file, PDF) and transfer it to another service.

How to exercise it: Contact Cannobio Adventure and specify the desired format.

7. Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR)

Cannobio Adventure does NOT use:

  • Automated profiling systems
  • Fully automated decisions producing legal effects
  • Automated exclusion algorithms

Any exclusion (e.g., a minor not meeting the height requirement) is a manual decision made by staff, which can be verified and contested.

8. Right to Lodge a Complaint (Art. 77 GDPR)

If you believe that the processing of your data violates your privacy rights, you may report the matter to the Data Protection Authority.

How to exercise it: See the “Data Protection Authority Contacts” section below.

How to Exercise Your Privacy Rights

Contacts for Privacy Requests

You may contact Cannobio Adventure by ordinary mail:

Cannobio Adventure s.r.l.

Via Vigezzo, 14, 28827 Valle Cannobina (VB)

Italy

Or by email:

info@cannobioadventure.com

What to Include in Your Request

To exercise a privacy right, send a request containing:

  • Full name, email address and phone number
  • ID document number (driving licence, passport, ID card)
  • A clear indication of the right requested (access, rectification, erasure, objection, portability, etc.)
  • Approximate date of your visit (month/year)
  • Specific description if requesting correction/deletion (e.g., “delete photo with blue background”)
  • Signature (physical or digital)

Response Times

Cannobio Adventure will respond within 30 days of receiving the request, in accordance with Art. 12 GDPR.

Extension to 60 days: If the request is complex or requires further verification, Cannobio Adventure may extend the deadline to 60 days, notifying the delay in writing within 30 days.

If the request is manifestly unfounded or excessive, Cannobio Adventure may refuse the request or charge a reasonable fee, communicating the reason in writing.

Data Security – Technical Measures

Encryption in Transit

  • All payment data is transmitted over an encrypted HTTPS connection with an SSL/TLS certificate
  • All sensitive data is encrypted in transit (no data transmitted in plain text)

Encryption at Rest

  • Databases protected by firewalls and restricted access
  • Daily backups on redundant servers
  • User passwords hashed and encrypted with a secure algorithm (not stored in plain text)
  • Sensitive data encrypted with AES-256

Restricted Access

  • Only authorised personnel have access to personal data
  • Access controlled through unique credentials and multi-factor authentication
  • Access logs recorded for audit purposes

DPA Agreements

Cannobio Adventure has entered into Data Processing Agreements (DPA) with all providers in accordance with the GDPR, including:

  • AWS (if used for backups)
  • Stripe, Klarna, Amazon Pay (payments)
  • Email provider
  • Booking platforms

Staff Training

All staff are trained on:

  • GDPR privacy
  • Data security
  • Personal data protection
  • Security incidents and how to report them

Limits of Security

Important: Absolute security cannot be guaranteed. A data breach is possible despite preventive measures.

In the event of a significant data breach:

  • You will be notified by email (Art. 33 GDPR)
  • The Data Protection Authority will be informed (Art. 34 GDPR)
  • You will receive instructions on how to protect yourself (e.g., changing your password)

Promotional Photographs and Videos – Specific Consent

During the visit, Cannobio Adventure staff may take promotional photographs and videos for marketing purposes.

When to Give Consent

UPON ENTERING THE PARK, you must explicitly choose one of the following options:

Option A: “I consent to promotional photos/videos”

If you choose this option:

  • Cannobio Adventure may photograph/film you during the visit
  • Cannobio Adventure may use your images for promotional purposes without further consent
  • Images may be published on: the website, social media (Facebook, Instagram, TikTok, YouTube, LinkedIn), marketing materials, printed brochures, presentations, email marketing
  • Use is indefinite, for the company and promotional archive
  • You will not receive any compensation for the use of the images

Option B: “I do NOT consent to promotional photos/videos”

If you choose this option:

  • Cannobio Adventure will NOT photograph/film you for promotional purposes
  • You may still take personal photos/videos as a keepsake (and share them on social media if you wish)
  • This choice does not in any way affect access to the park

Changing Your Consent Before the Visit

Your choice is not binding. You may change your consent by contacting Cannobio Adventure up to 7 days before the visit:

  • Email: info@cannobioadventure.com
  • Phone: +39 375 14530103

Simply write: “I would like to change my choice on promotional photos/videos from YES to NO” (or vice versa).

Withdrawing Consent After the Visit

You may withdraw your consent at any time after the visit by contacting Cannobio Adventure.

Limitations:

  • Photographs/videos already published online may take time to be removed
  • Cannobio Adventure will make every effort to remove the images from its website
  • Removal from third-party platforms (e.g., Google Images, social media archives) where the content may have been shared cannot be guaranteed

To request removal, contact Cannobio Adventure with:

  • Full name
  • Date of the visit
  • Brief description of the image/video
  • Specific request (full removal, face blurring, etc.)

Cookies and Online Tracking

(you can find the full text here)

The Cannobio Adventure website uses cookies for:

Essential Cookies

  • Website functionality (login, booking cart)
  • Security (CSRF protection)
  • Language preferences

Analytics Cookies (optional)

  • Google Analytics (anonymised, IP masked)
  • Traffic and user behaviour analysis
  • Website usability improvement

Marketing Cookies (optional)

  • Retargeting pixels (Facebook, Google Ads)
  • Personalised advertising
  • Promotional campaign tracking

Cookie Management

Cookies are managed in accordance with:

  • Legislative Decree 196/2003 (Italian ePrivacy Regulation)
  • Directive 2002/58/EC (EU ePrivacy Directive)

On first accessing the site you will see a cookie banner allowing you to:

  • Accept only essential cookies
  • Reject marketing/analytics cookies
  • Accept all cookies

Your data is NOT profiled by the site if you reject marketing/analytics cookies.

Data Protection Authority Contacts

If you believe that Cannobio Adventure is violating privacy regulations, you may report this to the Italian Data Protection Authority:

Garante per la Protezione dei Dati Personali (Italian Data Protection Authority)

Address: Piazza di Monte Citorio 121, 00186 Rome (Italy)

Email: protocollo@garanteprivacy.it

Phone: +39 06 696771

Website: www.garanteprivacy.it

How to file a complaint

  • Online: Visit www.garanteprivacy.it and fill in the reporting form
  • By post: Send a registered letter to the address above
  • By email: Send the report to protocollo@garanteprivacy.it

What to include in the complaint

  • Your full name and contact details
  • Detailed description of the privacy violation
  • Dates of the events
  • Company name (Cannobio Adventure s.r.l.)
  • Supporting documentation (emails, screenshots, etc.)

The complaint is free of charge and can be filed without a lawyer.

APPLICABLE LAW AND COMPETENT COURT

Applicable Law

These Terms and Conditions are governed by Italian law, in particular:

  • Italian Civil Code (Articles 1173-1231) – Contracts and obligations
  • Legislative Decree 206/2005 (Consumer Code) – Consumer rights
  • Law 118/1948 – Civil liability for sporting and recreational activities
  • Legislative Decree 81/2008 – Workplace health and safety
  • Legislative Decree 196/2018 – Privacy Code (GDPR in Italy)

Exclusive Jurisdiction

The Court of Verbania (Italy) has exclusive territorial jurisdiction over any dispute relating to:

  • Booking and payment for tickets
  • Access to and use of the park
  • Personal injury and civil liability
  • Violation of the Terms and Conditions
  • Data protection and privacy
  • Any other dispute arising from this contract

Dispute Resolution Procedure

  • Attempt at amicable resolution: We recommend contacting Cannobio Adventure before taking legal action:
  • Email: info@cannobioadventure.com
  • Phone: +39 375 14530103
  • Address: Via Vigezzo, 14, 28827 Valle Cannobina (VB)
  • Recourse to the Courts: If the dispute is not resolved amicably, it must be submitted to the Court of Verbania in accordance with Italian civil procedure rules.

3. Not permitted: Recourse to private arbitration, mandatory mediation, or any other jurisdiction.