When this Privacy Policy applies

This Privacy Policy applies to personal data processed through www.undergroundrome.com, including information submitted through contact forms, information sent by email and limited technical data generated when the website is visited.

It does not apply to third-party websites that may be linked from Underground Rome. Those websites operate under their own privacy policies and terms.

What information we may process

Information provided voluntarily

When you contact Underground Rome by email, through a contact form, telephone, WhatsApp or another available communication channel, we may receive information such as:

• name and surname;
• email address;
• telephone or WhatsApp number;
• company or organisation name, where relevant;
• travel dates or preferred dates;
• number and profile of participants;
• preferred language;
• archaeological interests or places of interest;
• accessibility or organisational requirements;
• the content of your message and subsequent correspondence.

Technical and browsing data

The website infrastructure may automatically process technical information such as IP address, browser type, operating system, requested pages, date and time of access, response codes and security logs.

Such information is normally generated by web servers and related infrastructure and may be used to operate, secure, maintain and troubleshoot the website.

Special-category data

Please do not send health information or other sensitive personal data unless genuinely necessary to organise an accessible and safe service. Where such information is voluntarily provided and its processing is necessary, it will be handled only for the relevant purpose and with appropriate care.

Why we use personal data

Mandatory and optional information

Information identified as required is necessary to assess and respond to the relevant request. Without it, it may not be possible to answer an enquiry, prepare a proposal or organise the requested service.

Additional information is optional and should be supplied only when relevant to the enquiry.

How personal data are handled

Personal data may be processed electronically and, where necessary, in paper form. Appropriate organisational and technical measures are used to reduce the risks of unauthorised access, accidental loss, improper disclosure, alteration or unlawful use.

Access is limited to the Data Controller and to persons or service providers who need the information for the purposes described in this Privacy Policy.

Who may receive personal data

Personal data are not sold. Where necessary for the purposes described in this notice, information may be disclosed to:

• hosting, email, website-maintenance and security providers;
• providers involved in operating website contact forms;
• licensed guides, archaeological sites, museums, cultural institutions, venue managers, transport providers, ticketing providers or other suppliers necessary to assess or deliver a requested service;
• accountants, legal advisers and other professional consultants;
• public authorities or other entities where disclosure is required by law or necessary to protect legal rights.

Where required by law, external providers act as processors under Article 28 GDPR or as independent controllers for their own activities. Only information reasonably necessary for the relevant purpose is shared.

Processing outside the European Economic Area

The Data Controller seeks to use service providers located within the European Economic Area where appropriate.

Where a service provider processes personal data in a country outside the European Economic Area, any transfer will take place only where permitted by Chapter V of the GDPR, for example on the basis of an adequacy decision, Standard Contractual Clauses or another applicable safeguard.

How long personal data are kept

• Unconverted enquiries: normally up to 12 months from the last meaningful communication, unless a longer period is justified by an ongoing request or legal need.
• Pre-contractual and booking correspondence: for the period necessary to manage the request and, where a service is confirmed, for the duration of the contractual relationship.
• Invoices and accounting records: for the period required by applicable Italian tax and civil-law obligations, normally 10 years.
• Security and server logs: for the period necessary to ensure website security, investigate incidents and comply with legal requests, normally for a limited period unless an incident requires longer retention.
• Special-category or accessibility information: only for as long as necessary to organise and deliver the relevant service, unless further retention is required by law.

Information may be retained for a longer period where necessary to establish, exercise or defend legal claims.

Cookies and similar technologies

Underground Rome may use cookies or similar technologies that are strictly necessary for website security, session management, functionality and basic operation.

Strictly necessary technical cookies do not normally require consent, but information about them is provided transparently through the website's cookie information and settings.

The website uses a cookie consent management system that allows visitors to accept, reject or manage non-essential cookies where applicable. Technologies requiring prior consent are not intended to be activated before the visitor has made the relevant choice.

Visitors can review or change their choices through the cookie settings available on the website. For further details, read our Cookie Policy.

Detailed and updated information about cookies and similar technologies detected or used by Underground Rome, their purposes and the available consent choices is provided in the Cookie Policy.

Information submitted through forms or email

Contact forms and email addresses available through Underground Rome are used to receive and manage enquiries concerning the website, archaeological places, private journeys and related services.

Information submitted through a form may also be processed by the website hosting, email or form infrastructure necessary to deliver and manage the message.

Where users are asked to acknowledge this Privacy Policy before submitting a form, that acknowledgement confirms that the privacy information has been made available. It does not constitute consent where processing relies on another legal basis.

Users should provide only information relevant to their request and should avoid including unnecessary confidential or sensitive information.

Measures used to protect information

The Data Controller adopts measures appropriate to the nature of the personal data and the risks involved, including access controls, software updates, secure credentials, encrypted connections where available, backups and limited disclosure to authorised recipients.

No method of electronic transmission or storage can be guaranteed to be completely risk-free. Users are therefore encouraged not to send unnecessary sensitive information through ordinary email or website forms.

Rights under the GDPR

Subject to the conditions established by the GDPR, you may request:

• confirmation as to whether your personal data are processed;
• access to your personal data and related information;
• correction of inaccurate or incomplete personal data;
• erasure where the applicable legal conditions are met;
• restriction of processing;
• data portability where applicable;
• objection to processing based on legitimate interests;
• withdrawal of consent at any time where processing is based on consent, without affecting processing lawfully carried out before withdrawal;
• information concerning safeguards used for applicable international transfers.

Requests may be sent to info@undergroundrome.com .

The Data Controller may request reasonable information where necessary to verify the identity of the person making the request.

No automated decisions or profiling

Personal data submitted through Underground Rome are not used for automated decision-making that produces legal or similarly significant effects and are not intentionally used for behavioural profiling.

Information concerning children

Underground Rome is primarily intended for adults researching or arranging visits and private services in Rome.

Any personal information concerning minors should be supplied only by a parent, guardian or authorised adult and only where necessary for the organisation of the requested service.

Right to contact the supervisory authority

If you believe that your personal data have been processed unlawfully, you may lodge a complaint with the Italian Data Protection Authority — the Garante per la protezione dei dati personali — without prejudice to any other administrative or judicial remedy available to you.

Further information is available from the official website of the Italian Data Protection Authority.

Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes to Underground Rome, its services, website functionality, suppliers or applicable law.

The latest version will be published on this page together with the revision date.