How we handle your data
Notice under Article 13 of Regulation (EU) 2016/679 (GDPR). It is written to be read, not skipped: if something doesn't sit right, write to privacy@romextreme.com.
Last updated: 27 August 2026
Who handles your data
The data controller is Fabio Pasquali, a natural person, reachable at privacy@romextreme.com.
No Data Protection Officer has been appointed: the processing carried out by this site does not fall within the cases where the GDPR requires one.
What we collect
Only what you type into the form. Nothing else.
- Email address — the only required field, because without it we cannot reply.
- Name — optional, so we don't write to you like a stranger.
- What interests you — the option you pick among single experience, Split & Reunite, gift or group.
- Browsing language — Italian or English, so we answer in the right one.
- Date of contact — when you submitted the form.
Why we collect it
For one thing only: to get back to you with the dates of the first days out, prices, and the chance to book ahead of everyone else.
We do not sign you up to any newsletter, we do not send third-party advertising, and we neither share nor sell your address to anyone.
On what legal basis
Your consent, under Article 6(1)(a) GDPR: the box you tick before submitting the form.
Providing your data is optional. You may withdraw consent at any time by writing to privacy@romextreme.com, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Who processes it for us
Nobody outside the project reads your data. We do, however, store it on third-party infrastructure, acting as data processors under Article 28 GDPR:
- Railway Corporation — hosting of the site and of the database holding your email.
- SiteGround — the email service we reply from.
Where it physically sits
Data is stored on servers located in the European Union, in the Amsterdam region (Netherlands). It is not transferred outside the Union for storage.
Railway Corporation is nonetheless a US company: it cannot be excluded that, for technical support purposes, staff located outside the Union may access it. Any such access would rest on the standard contractual clauses approved by the European Commission, the safeguard provided for by Article 46 GDPR.
How long we keep it
Until you withdraw consent and, in any case, no longer than twenty-four months from the last meaningful contact.
After that the address is deleted from the database, without you having to ask.
Cookies and tracking
This site uses no cookies. None: not technical, not analytical, not for profiling.
There is no Google Analytics, no advertising pixels, no social buttons. Even the typefaces are served from our own domain rather than an external server, so your visit is not reported to anyone.
That is why you see no cookie banner: there would be nothing to make you accept.
No automated decisions
We do not profile you and we take no automated decisions about you within the meaning of Article 22 GDPR. The emails are written by a person.
Your rights
Articles 15 to 22 GDPR give you the right to:
- know what data of yours we hold and obtain a copy (access);
- have inaccurate or incomplete data corrected (rectification);
- have it deleted (erasure);
- ask us to suspend its use (restriction);
- receive it in a machine-readable format (portability);
- object to the processing;
- withdraw consent whenever you like.
How to exercise them
Write to privacy@romextreme.com. We reply within thirty days, as Article 12 GDPR requires.
If you ask for erasure, we erase: the row leaves the database, it is not merely hidden.
If you are not satisfied
You may lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it. That is your right and you need not come to us first, though we would rather put things right directly.