Privacy Policy
This notice describes how the personal data of users visiting the website https://www.heysole.travel/ is processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR») and Legislative Decree 196/2003 («Privacy Code»).
1. Data controller
The data controller is HeySole!, with registered office at Carlos Calvo 17, C1102 Buenos Aires (CABA), Argentina. For any request concerning the processing of personal data, you can write to info@heysole.travel.
2. Data Protection Officer (DPO)
The controller has not appointed a Data Protection Officer (DPO), as the cases in which appointment is mandatory under Article 37 GDPR do not apply.
3. Types of data processed
Browsing data. The IT systems that run the website acquire, during their normal operation, some data whose transmission is implicit in the use of Internet protocols: for example the IP address, the type of browser, the operating system, the pages visited, and the date and time of the request. This data is used to ensure the operation and security of the website.
Data provided voluntarily by the user. When the user fills in the forms on the website, the data entered is processed, such as name, email address and any other information contained in the message. Users are asked not to enter special categories of data in the forms (for example data concerning health) unless strictly necessary.
Cookies and other tracking tools. For information on the cookies and similar tools used by the website, please refer to the Cookie Policy.
4. Purposes, legal bases and retention periods
Data is processed for the purposes listed below, each based on the corresponding legal basis.
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation, security and prevention of abuse of the website | Legitimate interest of the controller in ensuring the operation and security of the website (Art. 6(1)(f) GDPR) | 6 months |
| Replying to requests sent through the contact forms | Performance of pre-contractual measures taken at the request of the data subject or legitimate interest in replying (Art. 6(1)(b) and 6(1)(f) GDPR) | 24 months from the reply |
| Statistical analysis of the use of the website | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Measurement of advertising campaigns and delivery of personalised ads (marketing and remarketing) | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Google Signals: measuring the use of the website across multiple devices, estimating demographic data and interests, and building audiences for advertising, through users’ Google accounts | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Protection of forms against automated submissions (spam) | Consent of the data subject (Art. 6(1)(a) GDPR), given through the cookie banner | See the Cookie Policy |
| Analysis, for information purposes, of the data collected through the website using artificial intelligence tools | Legitimate interest of the controller in understanding how the website is performing and improving its services (Art. 6(1)(f) GDPR) | The same periods that apply to the data processed |
When the stated periods expire, the data is deleted or anonymised. Data may be retained for longer only where necessary to comply with legal obligations or to establish, exercise or defend legal claims.
5. Google services
The website uses services provided by Google (Google Fonts (loaded from a remote server), Google Analytics 4, Google reCAPTCHA, Google Tag Manager / Google tag, Google Signals (Google Analytics)), which are activated only with the user’s consent when they are not strictly necessary. How these services work, including any advertising functions, is described in the Cookie Policy. To find out how Google uses information from sites that use its services, you can visit the page policies.google.com/technologies/partner-sites.
Google Signals. The Google Signals feature is enabled in the website’s Google Analytics property. For users who are signed in to a Google account and have enabled ads personalisation, Google associates the browsing data collected on the website with their account. The controller receives only aggregated data, which is used to measure the use of the website across multiple devices, estimate demographic data and interests, and build audience segments for advertising campaigns. The processing is based on the user’s consent (Art. 6(1)(a) GDPR), given through the cookie banner and revocable at any time; for these functions Google also acts as an independent controller. Users can also turn off ads personalisation in their Google account settings (My Ad Center). The cookies used are listed in the Cookie Policy.
6. Methods of processing
Data is processed using IT tools and, where necessary, paper-based tools, adopting technical and organisational measures appropriate to ensure its security and confidentiality, pursuant to Article 32 GDPR. Data is processed by persons authorised and instructed by the controller.
7. Recipients of the data
Data may be disclosed to the following parties, which normally act as data processors under a contract with the controller (Art. 28 GDPR) or, in the cases indicated in their respective notices, as independent controllers:
| Service | Provider | Provider’s privacy notice |
|---|---|---|
| Provider of the website hosting service | Vercel Inc. | Privacy · Cookie |
| Hosting of the content management system (WordPress) | SiteGround Hosting Ltd | Privacy · Cookie |
| Cookie-Script (consent management) | Objectis Ltd | Notice |
| Meta Pixel (Facebook and Instagram) | Meta Platforms Ireland Limited | Privacy · Cookie |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Notice |
| Adobe Fonts (typefaces) | Adobe Systems Software Ireland Limited | Notice |
| Google Analytics 4 | Google Ireland Limited | Notice |
| Google reCAPTCHA | Google Ireland Limited | Notice |
| Google Tag Manager / Google tag | Google Ireland Limited | Notice |
| Google Signals (Google Analytics) | Google Ireland Limited | Notice |
| Gemini (artificial intelligence system) | Notice |
Data may also be received by the consultants and providers that assist the controller (for example for website maintenance or accounting obligations), as well as by public authorities in the cases provided for by law. An up-to-date list of the data processors can be requested from the controller.
8. Transfer of data outside the European Economic Area
Some of the providers listed may process data outside the European Economic Area. In these cases the transfer takes place on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified US providers, or other appropriate safeguards under Articles 45-46 GDPR, such as the Standard Contractual Clauses.
| Service | Provider | Transfer and safeguards |
|---|---|---|
| Gemini | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. | |
| Meta Pixel (Facebook and Instagram) | Meta Platforms Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Fonts (loaded from a remote server) | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Adobe Fonts (typefaces) | Adobe Systems Software Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Analytics 4 | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework (certified provider) and by the Standard Contractual Clauses. |
| Google reCAPTCHA | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Tag Manager / Google tag | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Google Signals (Google Analytics) | Google Ireland Limited | Possible transfer to the USA, covered by the EU-US Data Privacy Framework. |
| Hosting | Vercel Inc. | Servers in the United States: EU-US Data Privacy Framework (certified provider) |
9. Nature of the provision of data
The provision of browsing data is necessary to use the website. The provision of the data requested in the forms is optional, but the fields marked as mandatory are necessary to follow up on the request: without them it will not be possible to reply. Consent for marketing purposes and for non-technical cookies is always optional and refusing it has no consequences for the use of the website.
10. Minors
The website and the services offered are not aimed at minors under 14, the minimum age provided for in Italy to give consent to data processing autonomously in the context of online services (Art. 8 GDPR and Art. 2-quinquies of the Privacy Code). Minors under 14 must not provide personal data through the website. If the controller becomes aware of having collected data of a minor under 14 without the consent of the holder of parental responsibility, it deletes it without delay. Parents or guardians who believe this has happened can write to info@heysole.travel.
11. Rights of the data subject
At any time the data subject may exercise the rights provided for in Articles 15-22 GDPR:
- access: to know whether and which data is processed and to receive a copy of it;
- rectification: to correct or complete inaccurate or incomplete data;
- erasure: to obtain the deletion of the data, in the cases provided for;
- restriction: to ask that the data is only stored, without any other use, in the cases provided for;
- portability: to receive the data provided in a structured format or to have it transmitted to another controller;
- objection: to object to processing based on legitimate interest and, always, to direct marketing;
- withdrawal of consent: to withdraw consent given at any time, without affecting the lawfulness of the processing carried out before.
Requests can be sent to info@heysole.travel. The controller replies within one month of receipt, a period that may be extended by two months in cases of particular complexity, as provided for in Article 12 GDPR.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the Member State where they reside or work.
12. Automated decision-making
Data is not subject to solely automated decision-making, including profiling, that produces legal effects or similarly significantly affects the data subject (Art. 22 GDPR).
13. Artificial intelligence
The controller uses artificial intelligence systems for the purposes described below.
Analysis of data for information purposes
The controller uses artificial intelligence tools to analyse the data collected through the website, such as browsing statistics and the content of the requests received, solely for the controller’s information: for example to understand how the website is performing and to improve its services. Where possible the data is analysed in aggregated form or stripped of identifying elements, and is not used to make decisions that produce legal effects on data subjects or similarly significantly affect them.
The tool used is Gemini, provided by Google, which acts as data processor under the contractual terms of the service.
For processing based on legitimate interest, the data subject may object at any time, on grounds relating to their particular situation, by writing to the controller (Art. 21 GDPR).
14. Changes to this notice
The controller may amend this notice, including as a result of changes in legislation or in the services used. You are invited to consult this page periodically.
Last updated: 03/11/2026