- Who is responsible for your data
The data controller is Stefano Scarafiotti, operating under the name Scarafiotti Travel Concierge.
Address: Viale Tica 160/C, 96100 Siracusa, Italy
VAT number: 02072230895
Email: stefano@scarafiottitravel.com
This notice describes how we handle personal data collected when you browse this website, contact us through our Contact and Private Aviation inquiry forms, and communicate with us about your request.
- Information you provide
Depending on the form, we collect your name, email address, telephone number, travel destinations, dates, passenger numbers, flight preferences, luggage information and any details you include in your message.
Please do not include passport details, payment card information, medical information or other sensitive personal data in these forms. If additional information is needed, we will discuss an appropriate way to provide it.
- Why we use your information
We use your information to respond to your inquiry, discuss your preferences and prepare requested travel or private aviation proposals.
For requests concerning our services, processing is necessary to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).
For general professional correspondence, including collaboration inquiries, processing is based on our legitimate interest in responding to relevant communications and managing professional relationships (Article 6(1)(f) GDPR).
Submitting a form does not subscribe you to a newsletter or promotional mailing list.
Technical data necessary for website operation and security is processed on the basis of our legitimate interest in maintaining a functioning website and protecting it against misuse (Article 6(1)(f) GDPR).
- Required and optional information
Fields marked with an asterisk are required to submit the form and allow us to respond. Other fields are optional. Providing fewer travel details may limit our ability to prepare a suitable proposal.
- Sharing your information
Where necessary to address your request, relevant information may be shared with operational partners, including Air-Dynamic for private aviation inquiries, and selected travel suppliers.
For initial quotations, we aim to use itinerary details without sharing your name or contact details where these are unnecessary. Identifying information is shared only when needed to progress your request.
Technical providers supporting the website, email and related systems may also process information in delivering their services.
- How long we retain inquiry data
Inquiries that do not lead to a booking are retained for up to 12 months after the last contact, then deleted.
If an inquiry leads to a contractual relationship, relevant records are retained for the periods required by applicable legal obligations. Limited information may be retained where necessary for the establishment, exercise or defence of legal claims.
- Your rights
Subject to the conditions established by the GDPR, you may request access to, correction or deletion of your personal data, restriction of processing, or data portability. You may also object to processing based on legitimate interests.
To exercise your rights, contact stefano@scarafiottitravel.com.
You may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali: https://www.garanteprivacy.it.
- Website technologies and international transfers
The website and its email service are provided by Aruba S.p.A.
Enquiries submitted through the website forms are delivered by email. The current WPForms Lite configuration does not store enquiry entries in the WordPress database, and its optional LiteConnect backup service is disabled. Enquiries remain subject to the retention periods described above.
WordPress uses a technical session-storage item, “wpEmojiSettingsSupports”, to remember the browser’s emoji-display capabilities. This item is not used for advertising or profiling. Fonts are configured to load locally from this website.
Aruba processes HTTP access logs containing technical information such as IP addresses, request dates and times, requested resources and connection details. These logs are used for service operation, security, abuse prevention and diagnostics. According to Aruba’s confirmation for our hosting service, HTTP access logs are retained for no longer than six months.
The hosting service includes automatic website backups: a daily copy overwritten each day and a rolling copy corresponding to seven days earlier. Database backups are created daily, retained for seven consecutive days and automatically removed as they expire. Data deleted from the live website or database may therefore remain temporarily in these backup copies until they are replaced or expire.
Aruba has confirmed that the email service active for this domain does not include mailbox backups. Inquiry emails are subject to the retention periods described in section 6.
To prepare or fulfil your requested services, necessary personal data may be shared with Air-Dynamic, hotels, transport providers and other selected service partners, including partners outside the European Economic Area. Initial availability and quotation requests are made without identifying you wherever your identity is unnecessary.
Before transferring personal data outside the European Economic Area, we assess the destination and the applicable transfer requirements. Depending on the circumstances, transfers require an applicable adequacy decision, appropriate safeguards or a specific legally permitted derogation. You may contact us to obtain information about the safeguards applicable to your data and, where relevant, a copy of them.
Last updated: 8 October 2026