1. Data controller

Ischia Thermae
Via Monsignor Schioppa 21, 80075 Forio d’Ischia (NA), Italy
Email: info@ischiathermae.com  ·  Tel: +39 081 987562

2. Data collected

• Browsing data: IP address, browser type, pages visited, time of visit — collected automatically by the servers.
• Data provided voluntarily: first name, surname, email, telephone, shipping and billing address, entered at the time of purchase, registration or through the contact form.
• Payment data: we do not store card data. Payment is handled by PCI-DSS certified providers (Stripe, PayPal).
• Marketing data: email address given voluntarily for the newsletter.

3. Purposes and legal bases

• Performance of the contract (art. 6.1.b GDPR): processing orders, payments, shipping and after-sales communications.
• Legal obligation (art. 6.1.c GDPR): tax and accounting requirements.
• Legitimate interest (art. 6.1.f GDPR): site security, fraud prevention, anonymous aggregate statistics.
• Consent (art. 6.1.a GDPR): sending the newsletter and commercial communications.

4. Data retention

Order data is kept for 10 years (tax obligations). Newsletter data until consent is withdrawn. Browsing logs for a maximum of 12 months.

5. Recipients

• Couriers and shipping companies (BRT, DHL, SDA) for delivering orders.
• Payment providers (Stripe, PayPal) for transactions.
• Email marketing providers (Mailchimp, Klaviyo) for the newsletter.
• Google LLC (Analytics, Maps) — transfer to the USA under Standard Contractual Clauses.
• Tax advisers and accountants, within the limits of their duties.

Data is not sold to third parties.

6. Cookies

The site uses necessary technical cookies and, with your consent, analytics and marketing cookies. For details: Cookie Policy.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data (arts. 15–21 GDPR). You may withdraw your consent at any time. You may lodge a complaint with the Italian Data Protection Authority.

To exercise your rights, write to: info@ischiathermae.com

8. International transfers

Some providers (Google, Stripe, PayPal, Mailchimp) are based in the USA. Transfers take place under Standard Contractual Clauses approved by the European Commission (art. 46 GDPR).

9. Children

The site is not aimed at children under 16. For deletion requests, write to info@ischiathermae.com.

10. Changes

We reserve the right to update this notice. The date at the top shows the most recent version. In the event of substantial changes, registered users will be notified by email.