Privacy policy

Controller

National Processing Center LLC, 8 The Green, Suite A, Dover, DE 19901, United States (Delaware File Number 10417678), trading as National Park EU, is the controller for the processing described here. Contact for privacy questions: info@national-park.eu.

What we process

• Booking data: your name, email address, phone number (required for Plitvice Lakes bookings, because the park organisation may need it), the park, ticket type, ticket categories and quantities, visit date and — for Cinque Terre — the Via dell'Amore time slot.
• Language preference: the site language you used, so that we write to you in that language.
• Payment data: the payment identifier and payment status we receive back from our payment provider. We never receive or store your full card number.
• Email data: the delivery status of the confirmation and ticket emails we send you.
• Technical data: server log data such as IP address, browser type and time of the request, generated automatically when you visit the site.

Why we process it, and on what legal basis

• To perform your order — purchasing your official tickets, delivering them by email and answering your questions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To meet legal and accounting obligations regarding orders and payments. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
• To keep the website secure and to detect misuse. Legal basis: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Who receives your data

• The park organisations — Parco Nazionale delle Cinque Terre and Plitvice Lakes National Park — receive the data needed to issue your official tickets (typically name, visit date, ticket categories and, where required, a phone number or time slot).
• Whop — payment processing. Whop receives the payment data you enter and confirms the payment result to us.
• Resend — transactional email. Resend sends your confirmation and ticket emails and processes your name and email address for that purpose.
• Supabase — hosting of our database and application backend, where your booking data is stored.
• We do not sell your data and we do not use it for advertising.

International transfers

Some of our processors are established in, or process data in, the United States. Where personal data leaves the European Economic Area, the transfer is based on the European Commission's standard contractual clauses or another valid transfer mechanism under Chapter V of the GDPR.

How long we keep it

• Order and payment records: retained for the statutory accounting retention period of seven years.
• Incomplete or abandoned bookings: deleted after 7 days.
• Technical and error logs: deleted after 90 days.
• Support correspondence: kept for as long as needed to handle the matter and then deleted.

Cookies and local storage

We do not use analytics, advertising or tracking cookies. The site stores your chosen language in your browser's local storage so that it is remembered on your next visit; this is strictly necessary for the functioning of the site you requested.

If we add analytics or advertising technology in future, we will ask for your consent first and update this page before doing so.

Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21).

To exercise any of these rights, email info@national-park.eu with your booking reference. You also have the right to lodge a complaint with the data protection authority of the EU member state in which you live.

Security

All traffic to this website is encrypted with TLS. Access to booking data is limited to the staff members who need it to purchase and deliver your tickets, and is protected by individual accounts and database-level access rules.