Version 1.0 of 02/11/2026: complete text submitted for the controller's legal approval. Not yet published.
Privacy Policy — AMALFI VIBES, Amalfi New Service and AMALFI OS
Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003. It covers the processing actually carried out by the amalfivibes.com website, bookings, rentals, boat tours, the shop and the AMALFI OS management platform. Only features that are live today are described; features that are not live are marked as such.
1. Data controller and DPO
Controller: ELYSIUM S.R.L. — Via Maestra dei Villaggi 22, 84011 Amalfi (SA), Italia — P.IVA/C.F. 06424260658 — PEC elysiumamalfi@pec.it — email info@amalfinewservice.it. Trade names: AMALFI VIBES (website and shop) and Amalfi New Service (rentals and boat tours).
ELYSIUM S.R.L. is the controller of the processing whose purposes and means it determines: rentals, boat tours, experiences, transfers, photo shoots, the shop and the AMALFI OS platform (confirmed by the administrator on 02/11/2026). When a service is delivered by a partner (for example a hotel or a local operator), the partner processes the data needed to deliver it as an independent controller. Hotels and properties that refer the services through QR codes or links only see, in their private area, the bookings attributed to their own property, to calculate commissions. Technical providers processing data on our behalf are listed in section 8.
Data Protection Officer (DPO): Andrea Porpora. To contact the DPO, write to the certified email elysiumamalfi@pec.it marked "For the attention of the DPO": your message will be forwarded.
2. What data we process, why and on what legal basis
Mandatory fields are marked in the forms: without them we cannot confirm the booking, sign the contract or reply. Optional fields (notes, special requests) do not affect the service.
| Processing | Data | Purpose | Legal basis | Provision |
|---|---|---|---|---|
| Website browsing | IP address, browser, pages, date and time (technical logs) | running the website, security, abuse prevention | legitimate interest (Art. 6(1)(f)) | needed to browse |
| Bookings (website, hotel, station and ferry QR codes, partners) | name, email, phone/WhatsApp, language, dates, service, number of people, pick-up point, referring property or QR code, notes | managing bookings of rentals, boat tours, transfers, photo shoots and experiences | contract and pre-contractual steps (Art. 6(1)(b)) | mandatory to book |
| Bookings received from GetYourGuide | name, contact details, service, date, number of participants sent by GetYourGuide | delivering the service bought on GetYourGuide | contract (Art. 6(1)(b)); data not collected from you (Art. 14) | provided by GetYourGuide |
| Rental contract (scooter, Vespa, car) | personal details, address, contact details, driving licence and ID data, vehicle, period, price, deposit, accepted terms | concluding and performing the rental | contract (Art. 6(1)(b)); civil and tax obligations (Art. 6(1)(c)) | mandatory to rent |
| Photos of driving licence and ID | front/back images of driving licence, ID card or passport; for minors also the guardian's ID | identifying the driver and checking the licence | contract (Art. 6(1)(b)) and legal obligation for the CaRGOS report (Art. 6(1)(c)) | mandatory to rent vehicles |
| Electronic signature of the contract | signature image, date and time, IP address, browser, SHA-256 fingerprint of the PDF | accepting the contract and specific clauses, proving integrity | contract (Art. 6(1)(b)) and legitimate interest in evidence (Art. 6(1)(f)) | mandatory to sign remotely or at the desk |
| Handover, return and damage | photos of the vehicle, dashboard and damage, description, amounts charged, traffic fines notified | recording the vehicle condition, handling damage, charges and fines | contract (Art. 6(1)(b)) and defence of legal claims (Art. 6(1)(f)) | needed for the rental |
| CaRGOS report to the Italian State Police | driver, ID, vehicle and period data | complying with the obligation to report vehicle rentals | legal obligation (Art. 6(1)(c)): Art. 17 Decree-Law 113/2018, converted by Law 132/2018, and Interior Ministry Decree of 29/10/2021 | required by law |
| Payments at the desk | amount, method (cash, card, POS), receipt reference; no card numbers | recording payments, deposits and refunds | contract and tax obligation (Art. 6(1)(b) and (c)) | needed |
| Service messages (email, WhatsApp) | name, email, phone, message content, personal signing or contract-copy links | confirmations, signing links, reminders, contract copy, support | contract (Art. 6(1)(b)) | needed to receive confirmations and the contract |
| Contact and support requests | name, email or phone, request content | replying and handling complaints | pre-contractual steps, contract or legitimate interest | needed to get a reply |
| Shop back-in-stock alert | email, product, language, date of consent | telling you when a product is available again | consent (Art. 6(1)(a)), withdrawable | optional |
| Rewards discount codes | code, name, email, use | applying the promised discount between shop and experiences | contract (Art. 6(1)(b)) | optional |
| Channel measurement and partner commissions | clicks to partner websites with a random ID valid only for the open page and not stored on your device, referring property or QR code, attributed bookings | calculating partner commissions without double counting | legitimate interest (Art. 6(1)(f)) | automatic, without identifying you |
| Visit statistics (QR pages and guide only) | page views and main events with a pseudonymous ID, without URL parameters | improving QR pages and the guide | consent (Art. 6(1)(a) and Art. 122 Italian Privacy Code) | optional, consent only |
| Privacy requests | name, email, request, outcome, dates | handling and documenting the exercise of rights | legal obligation (Arts. 12-22 and 5(2) GDPR) | needed to handle the request |
| Staff and partner accounts (AMALFI OS) | name, email, role, hashed password, verification codes, access and activity log | secure access, traceability of access to customer documents | contract or employment; legitimate interest and Art. 32 GDPR | needed to use AMALFI OS |
| Backups | encrypted copy of the database and documents | business continuity and recovery | security obligation (Art. 32) and legitimate interest | automatic |
3. Driving licences, ID documents and automatic reading (OCR/AI)
Collection: to rent a vehicle, you upload photos of the front and back of your driving licence (and, if required, your ID card or passport), from your phone via the link you receive. Alternatively, staff take them at the desk.
Automatic reading: staff may have the images read by an artificial-intelligence model (OpenAI GPT as main model and Google Gemini as fallback). Images are decrypted in memory only and sent over an encrypted connection to Emergent's service (integrations.emergentagent.com), which forwards them to the model provider. The model suggests name, number, category, issue and expiry dates. Uncertain values are flagged, and a staff member always checks and confirms the result before use. The raw result is not stored, and application logs record only outcome, model and timing, with no images or licence data.
Transfer: images sent to the model may be processed in the United States. The transfer is based on the European Commission standard contractual clauses (Art. 46 GDPR) included in Emergent's data processing agreement, which extends to its sub-processors. In the same agreement (clause 12.1) Emergent undertakes not to use customer personal data to train artificial-intelligence models and to prohibit its AI sub-processors from doing so. If you prefer, you can ask for manual entry without automatic reading.
Storage and protection: images are encrypted in storage, including in backups, which are themselves encrypted. Operational staff can only view them, while download is restricted to managers and administrators, and every access is logged. When the period in section 9 expires, the system flags the images to be deleted and the controller has them deleted.
No decision based solely on automated processing (Art. 22 GDPR): fitness to drive is always checked by a person.
4. Contracts, signatures and documentation
The rental contract is generated as a PDF with the confirmed data and accepted terms. The signature is a simple electronic signature (Art. 20 Italian Digital Administration Code and Art. 25 Reg. (EU) 910/2014): the signature image, date and time, IP, browser and the PDF fingerprint prove its integrity. It is neither a qualified signature nor certified long-term archiving.
The signing link is personal, single-use and time-limited. The signed copy is sent to you by email or WhatsApp with a personal time-limited link.
Handover, return and damage photos and notified traffic fines are linked to the contract and accessible only to authorised staff. Signed contracts are never altered: any correction creates a new, tracked version.
5. CaRGOS and reports to authorities
For rentals of vehicles without a driver, Art. 17 of Decree-Law 113/2018 (converted by Law 132/2018) and the Interior Ministry Decree of 29/10/2021 require the contract, vehicle, renter and any second driver data, with ID and licence references, to be reported to the State Police through the CaRGOS portal when the contract is signed and in any case before the vehicle is handed over. Under the decree, CaRGOS keeps these data for at most 7 days after handover. AMALFI OS prepares and checks the data, but automatic sending from AMALFI OS is not active: transmission takes place on the State Police CaRGOS portal.
We disclose data to other authorities (for example for fines or accidents) only when required by law or to defend a legal claim.
6. Communications and marketing
We only send messages needed for the service: confirmations, signing links, rental or tour reminders, contract copy, operational messages and support replies.
No newsletters, email or WhatsApp marketing, commercial profiling or personalised advertising are active. The shop back-in-stock alert is sent only with your explicit consent, once, for the requested product. If we introduce promotional messages in the future, we will first ask for specific consent.
7. Cookies, statistics and maps
Details are in the Cookie Policy. In short: technical tools are always active. Statistics (PostHog via Emergent, only on QR pages and the guide) and Google Maps and OpenStreetMap maps load only after your consent. Session recording is not active. You can change your choice at any time from "Cookie preferences".
The __emg_vid (12 months) and __emg_sid (30 minutes) cookies are set by the servers of the hosting provider Emergent on the first page, before any choice, and the website cannot block them. According to Emergent's documentation they measure traffic and reliability of apps published on the platform. You can block them in your browser settings without losing any website feature.
8. Recipients, providers and transfers
Only authorised staff and the parties listed below access the data. Data are not sold or disclosed for marketing.
| Party | Service | Role | Country and safeguards |
|---|---|---|---|
| Emergent | hosting, database, file storage, backups, access to AI models, statistics | processor (Art. 28), under Emergent's data processing agreement | USA, EU and India (Annex 1 of the agreement); transfers under standard contractual clauses and the UK Addendum |
| OpenAI and Google (Gemini), via Emergent | automatic licence reading | Emergent sub-processors | USA; standard contractual clauses through Emergent's agreement |
| PostHog, via Emergent | QR page statistics, consent only | Emergent sub-processor | countries listed in Emergent's sub-processor list; standard contractual clauses |
| Aruba S.p.A. | email delivery | processor (Art. 28) | Italy (EU) |
| WhatsApp (Meta Platforms Ireland) | service messages sent by staff with the WhatsApp app, with no automatic link to AMALFI OS | independent controller of its messaging service | EU; transfers to the USA under WhatsApp's privacy policy |
| GetYourGuide Deutschland GmbH | selling experiences and sending bookings | independent controller | Germany (EU) |
| Hotels and partners delivering or referring the service | service delivery, commissions | independent controllers for the services they deliver; for referrals they only see bookings attributed to their own property | Italy |
| Google (Maps) and OpenStreetMap Foundation | embedded maps, consent only | independent controllers | USA (Google: DPF) / United Kingdom (adequacy decision) |
| Italian State Police (CaRGOS) and other authorities | reports required by law | recipients under legal obligation | Italy |
| Accounting firm engaged by the controller | accounting and tax compliance | processor for the tasks entrusted | Italy |
Online payments and shop shipping are not active: the payment provider and courier will be listed here before activation. QuickFerries and other external websites are reached only through links: once there, their own privacy notice applies.
9. How long we keep data
For each category we state the period and the reason. The periods distinguish legal obligations from contractual needs and technical periods. In case of a dispute, accident, penalty or request from an authority, the relevant data are kept until it is resolved. Backup copies follow the backup rotation.
| Data | Period | Reason |
|---|---|---|
| Bookings without a contract | 24 months after the service | support and complaints (contractual need) |
| Rental contracts, signed PDFs, signatures and signing evidence | 10 years after the rental ends | legal obligation: Art. 2220 Italian Civil Code; ordinary limitation period (Art. 2946) |
| Invoices, receipts and accounting data | 10 years | legal obligation: Art. 2220 Civil Code, Art. 22 Presidential Decree 600/1973 |
| Driving licence images | end of rental + 90 days; number, category and expiry remain in the contract | data minimisation: immediate disputes and notification of traffic fines (Art. 201 Highway Code) |
| ID card and passport images | same as licences | identification; no need to keep them longer |
| Handover, return and damage photos | 24 months after the rental ends, or until the damage case is closed | defence of legal claims (contractual need) |
| CaRGOS reports | no separate copy in AMALFI OS beyond the contract; on the CaRGOS portal at most 7 days after handover | Interior Ministry Decree of 29/10/2021 |
| Service emails and WhatsApp (sending log) | 24 months after sending | proof of service messages |
| Customer records | 24 months after the last service, or as the contract if one exists | managing the relationship |
| Staff and partner accounts | duration of the relationship + 12 months | security and access management |
| Security and activity logs | 24 months (automation log: 60 days, already applied) | security and accountability (Arts. 32 and 5(2)) |
| Visit statistics | aggregated data 24 months; ID kept in memory only until the page is closed | service improvement; at the provider under Emergent's agreement |
| Session recording | not active: no data collected | — |
| Privacy requests | 5 years after closure | demonstrating that requests were handled (Art. 5(2)) |
| Partner data | duration of the contract; accounting data 10 years | contract and tax obligation |
| Shop back-in-stock alerts | until the alert is sent or consent is withdrawn, at most 12 months | consent limited to the purpose |
| Shop orders (not yet active) | 26 months after delivery; tax data 10 years | legal guarantee (Arts. 132-133 Italian Consumer Code) and tax obligation |
| Backups | 30 daily + 12 monthly copies, then deletion | recovery (Art. 32) |
When these periods expire, data are deleted or anonymised. The automation log is deleted automatically after 60 days; for the other categories the system periodically flags expired data and the controller has them deleted.
10. Security
Encrypted connection (HTTPS), encrypted document storage, role-based access with logging, two-step email verification for administrators, hashed passwords, revocable sessions, time-limited personal links, encrypted backups with an off-site copy. Partners only see bookings for their own properties.
11. Your rights
You can request access, rectification, erasure, restriction and portability of the data you provided for the contract or with consent, and you can object to processing based on legitimate interest (Arts. 15-21 GDPR). You can withdraw consent at any time without affecting earlier processing. We do not take decisions based solely on automated processing (Art. 22).
How: use the "Exercise your privacy rights" form or write to elysiumamalfi@pec.it or info@amalfinewservice.it, stating your request and the email or phone you used with us. If confirming your identity is essential, we will ask using proportionate means. Requests are free of charge. We reply within one month, extendable by two months for complex cases: in that case we will explain why within the first month.
You have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of the country where you live or work.
12. Minors
Services are booked by adults. Rentals to minor drivers, where allowed, require the data and ID of the parent or guardian, who signs the contract.
13. Changes
Version 1.0 of 02/11/2026. Changes will be published on this page with the date and version number.