Data Protection Notice

Information pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree no. 196/2003

NEXTGIANT S.r.l., as the owner of the Zenith Cruise brand, provides users of www.zenithcruise.com with information regarding the processing of personal data collected through the website, contact channels, and booking services. Cookie-related information is supplemented by the website’s Cookie Policy.

PURPOSES OF DATA PROCESSING

Data is used to respond to inquiries and quotation requests, manage bookings and excursions, handle relations with agencies and suppliers, process payments, issue invoices, and provide customer support. Depending on the specific case, the legal bases for processing are: the performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c)); legitimate interest in ensuring service security and management (Article 6(1)(f)); and consent for newsletters, marketing, or promotional use of images when required (Article 6(1)(a)). Data is retained for the time necessary to fulfill the respective purpose. As a rule, tax and accounting documents are kept for 10 years, while marketing data is retained until consent is revoked, without prejudice to any retention required to document such consent.

DATA DISCLOSURE

Data is not disclosed publicly. Within the necessary limits, it may be communicated to authorized personnel, IT and hosting providers, booking and payment operators, administrative consultants, and competent authorities. Depending on the context, these parties operate either as data processors or as independent data controllers.

YOUR DATA PROTECTION RIGHTS

You can find out which data we process and request access, rectification, or erasure in the cases provided for by law. You may also restrict or object to certain processing activities and withdraw any consent previously given. The procedures for exercising these rights are outlined in the sections “Rights of Data Subjects” and “Where to Send Requests.”

DATA PROCESSING LOCATION

Data is processed at the company’s offices and by designated providers, including through infrastructures located within the European Economic Area (EEA). Any transfers to third countries take place solely in compliance with the safeguards provided by the GDPR: adequacy decisions (including, where applicable, the EU–US Data Privacy Framework for certified recipients) or standard contractual clauses coupled with necessary supplementary measures.

TYPES OF DATA PROCESSED: BROWSING DATA

During navigation, systems may acquire IP addresses, date and time of access, requested pages, device and browser information, and technical logs. These are used for website functionality, security, and diagnostics, with retention limited strictly to technical necessities and the protection of legal rights. Cookies and other tracking technologies are described in the Cookie Policy; non-technical trackers require prior consent where mandated by law.

OPTIONAL NATURE OF DATA PROVISION

Providing data is optional, except for information necessary to respond to a request, conclude and execute a booking, or fulfill statutory obligations. Without such data, the service may not be deliverable. Consent for newsletters and promotional communications is always optional.

DATA PROVIDED VOLUNTARILY BY THE USER

When you write, call, or fill out a form, we process the data you communicate (e.g., name, contact details, message content, and information required for bookings) solely to handle your request and manage related subsequent steps.

DATA PROCESSING METHODS

Data processing is carried out using electronic tools and, where necessary, paper-based records, utilizing authorized access and appropriate technical and organizational security measures. There are no automated decision-making processes, including profiling, that produce legal effects or similarly significant impacts on the user.

RIGHTS OF DATA SUBJECTS

Pursuant to Articles 15–22 of the GDPR, you have the right to request access, rectification, erasure, restriction, data portability (where applicable), and to object to processing, specifically targeting direct marketing at any time. You may withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal. The company typically responds within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it).

Statistics

The website may use tools to measure visits and performance. Statistical tracking that requires consent is activated only after a positive choice by the user, in compliance with cookie regulations.

Google Analytics (Google LLC)

If active, Google Analytics 4 may process browsing data and identifiers to provide visit statistics. Any use of cookies or non-technical identifiers is subject to user consent where required; further details and preferences are available in the Cookie Policy and Google’s privacy policy.

Facebook Like Button and Social Widgets (Meta)

Any Facebook/Meta buttons or widgets enable interactions with the platform and may entail data collection by Meta. Where necessary, their loading is subject to user consent and preferences.

Akismet (Automattic)

If enabled for forms or comments, Akismet processes technical data and submitted content to detect spam, based on the legitimate interest of ensuring website security. Further information is available in Automattic’s privacy policy.

YouTube Video Widget (Google LLC)

Pages may embed YouTube videos. Playing them may result in data transmission to Google and the use of trackers; where necessary, these contents are activated only following user consent or choice.

Newsletter

Subscription is voluntary and based on consent, which can be revoked at any time via the link provided in communications or by contacting the company. If utilized, the Mailchimp (Intuit) service manages dispatches and subscriptions under specific data processing agreements and safeguards for any data transfers.

MINORS

Bookings must be made by adults or persons exercising parental responsibility. Data concerning minors is requested only when necessary to organize the service. For any online services based on consent, the age threshold of 14 established by Article 2-quinquies of the Italian Privacy Code also applies.

USER COMMENT MANAGEMENT

If comments are enabled, the website may collect the author’s name, email, comment text, date, time, and IP address for publication, moderation, and abuse prevention. Only information designated as public is visible to other users; comments are retained as long as they remain published or until a removal request is evaluated in accordance with the law.

WEBSITE MODIFICATIONS

Website content and features are subject to change. Any new personal data processing activities will be accompanied, when necessary, by an updated privacy notice and the collection of required consents.

MODIFICATIONS TO THIS PAGE

This privacy notice may be updated to reflect changes in services or legislation. The current version, complete with its revision date, will always be available on this page; substantial modifications will be communicated through appropriate channels.

WHERE TO SEND REQUESTS

To exercise your privacy rights or request clarification, you can write to the data controller using the contact details below. For information regarding services, you may also use the standard contact channels available on the website.

Data Controller

NEXTGIANT S.R.L. | Piazza Diaz 1, 20900 Monza (MB) | VAT / Tax ID: 11747000963

Privacy E-mail: [email protected] | Certified E-mail (PEC): [email protected]

Revision: October 2026