Esichia
Privacy Policy
Last updated: October 28, 2026
This policy explains how we handle the personal data of people who visit www.esichia.com, write to us or call us, and book a journey or service with us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, «GDPR») and Italian Legislative Decree 196/2003 (the Italian Privacy Code).
1. Data controller
Esichia is a brand of Tailored Apulia S.r.l.s., which is the data controller.
Address: Via Cavour 146, 74024 Manduria (TA), Italy
VAT IT03485180735 · Tax code 03485180735
Email: info@esichia.com · Certified email (PEC): tailoredapulia@pec.it
Phone: +39 345 603 9802
Data Protection Officer (DPO): not appointed, as it is not required for our activity.
2. The data we process
Browsing data. Like any website, the systems that run this site collect some technical data: IP address, browser and device type, pages visited, date and time of the request. We need it to operate and protect the site.
Data you give us. When you fill in the inquiry form, send us an email or a WhatsApp message, or call us: your name, contact details, travel dates and preferences, number and ages of travelers, and anything you choose to share with us in your Travel Personality Portrait.
Data needed to arrange your trip. If you book: personal details for you and your fellow travelers (including any minors), identity document details when hotels or suppliers require them, flight or arrival details, billing and payment details.
Special categories of data. Only if you choose to share them: health information such as allergies, food intolerances, mobility needs or notes relevant to massages and treatments; dietary preferences that may reveal religious beliefs. We process them only with your explicit consent and only to arrange your trip.
If you give us data about other people (fellow travelers, children), please do so only after informing them and, for health data, after obtaining their consent.
3. Why we process your data and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Operating the site and protecting it from abuse | Our legitimate interest (Art. 6(1)(f) GDPR) | We do not keep server logs ourselves; Cloudflare processes technical data only for as long as needed to deliver and protect the site |
| Replying to your inquiries and preparing your travel proposal | Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) | 12 months after the last contact if no booking follows |
| Arranging and delivering the journey or service you booked, assisting you during your stay | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of the contract, then as long as needed to protect our rights within the statute of limitations |
| Processing health information you choose to share | Explicit consent (Art. 9(2)(a) GDPR) | Until the end of your trip; deleted within 30 days of your return |
| Complying with legal obligations (tax, accounting, Italian Tourism Code) | Legal obligation (Art. 6(1)(c) GDPR) | 10 years for accounting and tax records (Art. 2220 of the Italian Civil Code) |
| Defending our rights in case of disputes | Our legitimate interest (Art. 6(1)(f) GDPR) | For the duration of any dispute |
| Measuring the performance of our ads on Google and Meta and showing you our ads, through marketing cookies | Consent given in the cookie banner (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) | Until you withdraw your consent, and no longer than the cookie durations listed in our Cookie Policy |
We do not make decisions based solely on automated processing, including profiling.
4. Do you have to give us your data?
No, but without your contact details we cannot reply, and without the details needed for a booking we cannot arrange your trip. Sharing health information is always optional: if you do not, we may be unable to take some needs into account. You can withdraw your consent at any time, without affecting processing carried out before.
5. Who we share your data with
The suppliers of your journey, only as far as necessary: hotels and villas, drivers and transfer services, boat owners and skippers, chefs, guides, wineries, artisans, wellness professionals. They act as independent controllers for the part of the service they provide to you.
The providers that help us run the website and our work, appointed as processors (Art. 28 GDPR):
- Cloudflare, Inc., for website hosting and delivery;
- Supabase, Inc., for the database that receives inquiries sent through the form, on servers in the European Union (Ireland);
- Neo (neo.space), for the info@esichia.com mailbox, and Cloudflare, Inc., for email forwarding;
- providers of payment, invoicing and accounting services, and our professional advisers, such as our accountant, only for what they need.
Advertising platforms, only if you accept marketing cookies: Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited (Facebook, Instagram). Meta acts as joint controller with us for the collection and transmission of data through its pixel, under the Meta Controller Addendum; Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms.
Parties we must share data with by law, such as public and tax authorities.
If you contact us on WhatsApp, the service is provided by WhatsApp and your data is also processed under WhatsApp's own privacy policy.
We do not sell your data and we do not make it public.
6. Transfers outside the European Economic Area
Some providers are based in the United States or may process data outside the European Economic Area. In those cases data is transferred only on the basis of an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework, for participating providers) or of standard contractual clauses approved by the Commission (Articles 45 and 46 GDPR).
7. Your rights
At any time you may ask us to access, correct or erase your data, to restrict its processing, or to receive it in a machine-readable format (portability), and you may object to processing based on our legitimate interest (Articles 15 to 22 GDPR). You may withdraw any consent you have given at any time.
Simply write to info@esichia.com. We will reply without undue delay and in any case within one month.
If you believe our processing breaches the law, you may lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.
8. Children
Our website and services are intended for adults. Data about children traveling with their families is provided by their parents or guardians, and we use it only to arrange the trip.
9. Security
We use appropriate technical and organizational measures to protect data against loss, unauthorized access and misuse. Access is limited to the people who need it to work on your journey.
10. Cookies
For the cookies and similar technologies used on this site, please see our Cookie Policy.
11. Changes
We may update this policy. The version in force is always published on this page, together with the date of the last update.
This policy is available in Italian, English, French and German. In case of differences, the Italian version prevails.