Privacy Policy and Consent

Privacy Policy and Consent

In their capacity as data controllers under Article 13 of the European General Data Protection Regulation 2016/679 (“GDPR”), WPS Consulting S.A. and Wps Places S.r.l. (collectively, “WPS” or “we”) provide the following information on the protection of personal data that you may provide or that may be collected and/or provided by other parties to which they were disclosed for:

  1. organizing a tourist package;
  2. facilitating the purchase of related tourist services;
  3. liaising in the purchase of a tourist package provided by third parties or individual tourist services provided by third parties (e.g. hotels, transport);
  4. brokering the purchase of financial/insurance products that are ancillary and related to the tourist packages/services included or purchased individually (health and luggage insurance; cancellation; assistance to a traveller in difficulty; consumer credit):
  5. complying with obligations related to obtaining visas;
  6. contacting you after filling out the “contact us” form on the website and (“Websites”).

Processing of Personal Data

Your personal data that may be processed, includes, inter alia, your first and last name, place and date of birth, address, tax code, nationality, telephone number and email, as well as all information related to the services you requested (“Data”).

Furthermore, among Data provided by You, there may also be “special categories of data” as defined by the GDPR (e.g. data concerning health). The sensitive/special data shall be processed in compliance with the purposes below and only with your express consent.
If no consent is provided, WPS will not be able to comply with certain contractual obligations that necessarily require the processing of such Data.

Purposes and legal basis for processing

  1. Purposes related to performing the contract. Your Data shall be processed to comply with the obligations deriving from the negotiation and the contract related to organizing the tourist package and to allow WPS to provide optimal services, specifically for:
    1. Executing, managing and performing the contractual obligations towards you;
    2. Responding to your requests;
    3. Informing you of notices concerning the tourist packages or services purchased or additional and ancillary services (e.g. information notices on the tourist service purchased; amendment of contract terms; cancellations; delays).

The processing of your Data for the above purposes shall be carried out based on the existing contract or compliance with pre-contractual measures in relation to you. If you deny providing such Data, we cannot enter into a contract with you, nor can we respond to your requests sent through the “contact us” form on the WPS Websites.

  1. Purposes of law. Your Data shall also be processed to:
    1. carry out obligations under national, EU and international law and regulations or deriving from measures issued by Authorities having lawful jurisdiction;
    2. comply with tax and accounting laws;
    3. comply with obligations concerning the health and safety of travellers;
    4. comply with obligations concerning transportation of people and goods.

The processing of your Data for the above purposes shall be carried out based on obligations under law and, therefore, is necessary in order to use the services offered by WPS.

  1. Other purposes. Your data may be processed for promotional purposes, to inform you of tourist packages and services:
    1. which we believe may be of interest to you, through non- automated methods (e.g. by post, email, telephone operator, etc.);
    2. dedicated to all WPS clients, through newsletters.

The processing of your Data for the above purposes is carried out based on our legitimate interest, as a result of an assessment that such activities are in compliance with the expectation of our clients and do not prevail over the rights and fundamental freedoms of the data subjects. You may object to the processing of your Data at any time by:

writing an email to or or calling the following number +39 0248517195, if you are an Italian citizen; or not.

Your Data may also be processed in case of any company changes (e.g. sale of a business unit), due diligence, legal defence, and in relation to any preliminary activities. Such processing shall be carried out based on our legitimate interest to pursue commercial activity and protect our rights.

Categories of Data Recipients

Your Data shall not be disseminated. Your Personal Data shall be made available to persons authorized to process data for WPS only where necessary and for the purposes provided for processing. Your Data may be disclosed, only for the above purposes, to the following categories of recipients which, depending on the case, may act as processors or controllers:

  • suppliers of tourist services included in the package;
  • insurance providers that offer the ancillary and related insurance to the purchased tourist packages and services;
  • persons, companies, associations, professional firms that provide services or advice to WPS (e.g. accountants, lawyers, tax consultants, auditors, auditing or due diligence consultants etc.);
  • providers of IT services and email;
  • persons whose authority to access your Data is recognized by law or regulation or measures issued by Authorities lawfully having jurisdiction, such as airport, port, customs and border authorities;
  • where required, Courts;
  • where required, public administration bodies and authorities of supervision and control. Transfer of Personal Data outside the European Union.We may transfer your Data to third Countries. The transfer of data outside the European Economic Area is subject to a special regime under the GDPR. They shall be transferred only to Countries that ensure an adequate level of personal data protection based on an adequacy decision by the European Commission or where adequate safeguards have been established (including the standard contractual conditions provided by the European Commission), provided that the data subjects have enforceable rights and effective judicial remedies. In any case, your Data may be transferred outside the European Economic Area to complete or perform the services included in the purchased tourist package or the related pre-contractual measure (e.g. reservations).

Storage of Personal Data

Your Data shall be stored, in compliance with the applicable law in force, for a term not exceeding what is necessary to pursue the purposes for which they were processed. The criteria for determining the storage period of the Data takes into account the allowed processing period and the applicable law on tax, limitation of rights and legitimate interests of the data subject that are the legal basis for processing. Regarding the processing of your Data for promotional purposes, due to the absence of laws specifying a different storage period, we shall use your Data to inform you of tourist packages or services that may be of interest to you for a period that is consistent with the interest you have expressed in the promotional incentives by WPS. In any case, we shall establish every measure to avoid the use of Data for an indeterminate period, by periodically, at least every three years, checking whether you are still interested in receiving such promotions

Data Controllers

The Data Controllers are:

  • WPS Consulting S.A., with registered office at Via Calgari, 2, 6900 – Lugano, VAT No.CHE- 370.631.236 and
  • WPS Places S.r.l., with registered office at P.le Giulio Cesare, 14, 20145 – Milan (MI), VAT No. 08531050964 registered with the Companies Registry of Milano MI2031800, Certified Email:

Data Subject’s Rights

The GDPR provides you the right to exercise specific rights, such as asking WPS, where applicable, for:

– confirmation as to whether your data is being processed, and where that is the case, access to the personal data (right of access);

– rectification of inaccurate personal data or to have incomplete personal data completed (right to rectification);

– erasure of the same Data, where one of the grounds under Article 17 of GDPR applies (right to erasure);

– restriction of processing of your data, where one of the cases under Article 18 of GDPR applies (right to restriction of processing);

– receipt of Data you have provided in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller (right to data portability).

You also have the right to withdraw your consent to the processing of your data at any time. The withdrawal of your consent shall not affect the lawfulness of processing based on your consent before its withdrawal.

To exercise your rights, you may:

  • Write an email to or or calling the following number +39 0248517195, if you are an Italian citizen; or not.

In accordance with the GDPR, WPS may not charge for complying with any of the requests mentioned in this section, unless they are clearly unfounded or excessive, and are repetitive. Should you request more than one copy of your data or in cases of excessive or unfounded requests, WPS may: (i) charge a reasonable expense, considering the administrative costs incurred to fulfil the request; or (ii) refuse to fulfil the request. In these cases, WPS shall inform you of the costs before fulfilling the request.

WPS may ask for further information before fulfilling the requests if it needs to verify the identity of the person who has made them.

Without prejudice to any administrative or legal remedy, you also have the right to lodge a contact to the supervisory Authority – the Italian Data Protection Authority for Italy and The Federal Data Protection and Information Commissioner (FDPIC) for Switzerland – if you believe that processing of your data breaches the GDPR. More information is available on the website (concerning the Italian authority) and on the website (concerning the Swiss authority).

In any case, WPS is interested in knowing the reasons for the complaint. Please use the above contact methods before turning to the authorities, in order to prevent and resolve any disputes amicably and promptly, with the greatest courtesy, professionalism and discretion.

Consent to Processing

A) Having read the above privacy policy, I consent to the processing of my “special categories of data” (e.g. data concerning health), in accordance with the indicated methods, for the purposes under paragraphs a) and b) (purposes of complying with the contractual obligations and the law).