Privacy Policy

Last updated: 14 October 2026.

This policy explains what personal data Lakes & Stories collects, why, and what your rights are, as the EU General Data Protection Regulation (GDPR) requires.

Who is responsible for your data

Heloise Tinguely, trading as Lakes & Stories, VAT number (Partita IVA) IT04270010137, Como, Italy. Email: [email protected]. Phone and WhatsApp: +39 375 941 9760.

This website

The site uses no cookies and no advertising, and stores nothing on your device.
To understand how the site is used, it counts visits with Cloudflare Web Analytics, which works without cookies and without identifying you: it records the pages viewed, where visitors came from (for example a search engine), their country, the type of device and how fast the pages loaded. The site also counts clicks on its contact buttons (WhatsApp, phone, email, booking) as anonymous daily totals per page. Neither identifies you, follows you from one site to another or builds a profile of you, and my click counter stores no data about you at all. The legal basis is my legitimate interest in knowing how the site performs (GDPR Art. 6(1)(f)).
Fonts and photos are served by the site itself: visiting a page sends no information to Google, social networks or advertisers.
The site is delivered by Cloudflare, which processes technical data such as your IP address, browser type and the page requested, in order to deliver the site and protect it from attacks. In rare cases, to tell visitors from automated traffic, Cloudflare may set a strictly necessary security cookie, which needs no consent.
Links to other sites, such as WhatsApp or the sources of the photos, take you to services with their own privacy policies.

When you contact me or book a tour

When you write by email, call or message on WhatsApp, I receive what you choose to share: usually your name, contact details, travel dates, the number of guests, where you are staying and your questions. For a booking I may also need details for the day, such as a pickup address, mobility needs or, for food and wine tours, allergies and dietary requirements.

I use this information only to answer you, to plan and run your tour, and to handle payment. The legal bases are:

steps taken at your request before a booking, and carrying out the booking (GDPR Art. 6(1)(b));
keeping the accounting and tax records required by Italian law (Art. 6(1)(c));
for allergies or other health information, your explicit consent when you share it (Art. 9(2)(a)), which you can withdraw at any time.

Who else sees it

The services you choose to contact me through: Google (Gmail), WhatsApp (Meta) and your phone provider.
Where your tour needs it, the operators who make it happen, such as the boat operator, the driver or a venue for tastings, receive only what they need: for example a name, the number of guests and the time.
My accountant, for invoices, and public authorities where the law requires it.

Some of these providers (Google, Meta, Cloudflare) may process data outside the European Union, in particular in the United States, under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

I never sell your data or use it for marketing.

How long I keep it

Enquiries that do not lead to a booking: up to 12 months.
Bookings: as long as needed to run the tour; invoices and accounting records for 10 years, as Italian law requires.
Allergies and other health information: deleted after your tour.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its use, or to receive it in a portable format, and you can withdraw your consent at any time: just email me. You also have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Changes

If this policy changes, the new version will be published on this page with a new date.