Privacy Policy
Last updated August 2026
This Privacy Policy explains how Roam Rome, operated by Nexa Holdings LLC (“Roam Rome,” “we,” “us,” “our”), processes personal data when you use www.roamrome.net, contact us, or purchase our travel-planning services. We serve travelers planning trips to Rome, including residents of the EU, UK, and Italy. Trader identity: see our Imprint.
1. Who is responsible
Data controller: Nexa Holdings LLC (trading as Roam Rome), United States.
Privacy contact: contact@nexaholdings.net
EU representative (GDPR Art. 27): Ing. Gianluca De Vincentiis, Via Jacopone da Todi, 38 - 00137 Roma, Italy. Email: ing.devincentiis@gmail.com. This is our contact point in the Union for supervisory authorities and data subjects regarding our GDPR obligations. The controller remains Nexa Holdings LLC. A UK representative under UK GDPR Art. 27 has not been appointed at this time; we are in the process of arranging one. In the meantime, UK requests may use the same privacy contact.
2. Personal data we collect
- Identity & contact: name, email, phone number.
- Trip & booking details: travel dates, party size (including children), hotel area, flight numbers, pickup/drop-off addresses, preferences, free-text messages, questionnaire answers submitted after payment.
- Payment data: handled by Stripe (we receive confirmation metadata, amounts, and customer contact details attached to the checkout session — not full card numbers).
- Marketing preferences: whether you opted in to planning-tip emails on the checklist form; purchase records used for similar-service follow-ups where disclosed at checkout.
- Technical & security: IP address (contact-form owner notifications and rate limiting), browser user-agent, anti-spam timing signals, aggregate analytics after cookie consent, and operational logs from our hosting provider.
- Operational events: anonymised or redacted activity in our database (e.g. checklist download events with email fields redacted in stored payloads).
Our public feedback questionnaire does not store your email or answers in our database.
3. Legal bases (GDPR Article 6)
| Processing activity | Legal basis |
|---|---|
| Fulfilling bookings, itineraries, transfers, and concierge services | Contract (Art. 6(1)(b)) — necessary to perform the service you purchased or requested |
| Sending the free checklist PDF you requested | Contract / pre-contractual steps (Art. 6(1)(b)) |
| Optional marketing emails (checklist opt-in; similar-service emails after purchase where disclosed) | Consent (Art. 6(1)(a)) for checklist opt-in; legitimate interest / soft opt-in for existing customers where permitted and disclosed at checkout, with easy opt-out |
| Contact-form inquiries and operational email | Legitimate interest (Art. 6(1)(f)) — responding to your request; pre-contractual steps where you ask for a quote |
| Analytics (GA4, Vercel Analytics) after you accept cookies | Consent (Art. 6(1)(a)) |
| Rate limiting, fraud/abuse prevention, IP in owner alerts | Legitimate interest (Art. 6(1)(f)) — security of our site and staff |
| Tax, accounting, and legal retention | Legal obligation (Art. 6(1)(c)) |
4. How we use personal data
- Respond to inquiries and design or deliver itineraries.
- Coordinate drivers, guides, restaurants, and other local vendors.
- Process payments and send receipts and confirmations.
- Send optional marketing about Rome travel planning when you have opted in or where disclosed at purchase, with unsubscribe in every marketing email.
- Understand aggregate site usage (only after cookie consent) and prevent abuse.
- Meet tax, accounting, and regulatory requirements.
5. Processors & subprocessors
We use vetted service providers who process data on our instructions. We do not sell personal data.
| Provider | Purpose | Typical location |
|---|---|---|
| Stripe | Payment processing | US / global |
| Resend | Transactional and marketing email, contact audiences | US |
| Neon (PostgreSQL) | Orders, receipts, submissions, operational events | US (AWS us-east-1) |
| Vercel | Hosting, CDN, Web Analytics (if accepted) | US / global edge |
| Google (Analytics 4) | Aggregate traffic analytics (if accepted) | US / global |
| Upstash Redis | IP-based rate limiting (when configured) | US / EU |
| GetYourGuide | Affiliate widget (script loads only after cookie consent) | EU |
| Tiqets | Partner checkout links, server-side availability API, and Availability/Discovery widgets (widget script only after cookie consent) | EU (Netherlands) |
| Local vendors (Italy) | Drivers, licensed guides, restaurants — fulfillment only | Italy / EU |
Internal DPA tracking: see docs/compliance/DPA_REGISTER.md in our repository (maintained by our team). Data subject request procedures: docs/compliance/DSR_RUNBOOK.md.
6. Cookie notice (in line with Garante guidelines)
Under Italian Garante guidance on cookies and other tracking tools, we classify technologies below and ask for your free, informed consent before loading non-essential analytics or marketing scripts. You can Accept all, Reject all, or Customize analytics vs marketing/partner widgets separately in the banner. Change your mind anytime via Cookie preferences in the site footer (equal to withdrawing consent).
Rejecting or withdrawing consent does not block browsing, contact, or checkout. Strictly necessary tools (e.g. payment on stripe.com) still run when you choose to pay.
| Technology | Provider | Category | Purpose | Consent? | Duration |
|---|---|---|---|---|---|
| rr-cookie-consent (localStorage) Legacy values accepted/true/rejected still recognized; new choices store JSON preferences. | Roam Rome (first party) | Preferences | Stores analytics and marketing cookie preferences (accept, reject, or customize). | No | Until you clear site data or change preferences via Cookie preferences in the footer |
| Google Analytics 4 (_ga, _ga_*, _gid, …) Loads only after Analytics consent. Google Consent Mode v2 defaults deny until then. | Google Ireland Ltd. | Analytics / statistics | Aggregate visit statistics (pages viewed, referral source). No advertising cookies from our GA4 tag. | Yes — before load | Up to 24 months (_ga); session cookies shorter — see Google’s policy |
| Vercel Web Analytics Loads only after Analytics consent. | Vercel Inc. | Analytics / statistics | Aggregate page-view and performance metrics without third-party ad profiling from this tag. | Yes — before load | Session / short-lived identifiers per Vercel documentation |
| GetYourGuide partner widget Script loads only after Marketing consent. | GetYourGuide Deutschland GmbH | Marketing / third-party content | Embeds affiliate tour listings on selected pages. | Yes — before load | Per GetYourGuide partner cookie policy when you interact with the widget |
| Tiqets Availability / Discovery widget Script (widgets.tiqets.com/loader.js) loads only after Marketing consent. | Tiqets International B.V. | Marketing / third-party content | Embeds live availability calendars and product discovery cards on selected experience and insight pages. | Yes — before load | Per Tiqets cookie policy when you interact with the widget |
| Tiqets partner checkout (tiqets.com) Outbound partner links and server-side availability API do not load a Tiqets script by themselves. Cookies and booking data apply on tiqets.com after you leave our site. | Tiqets International B.V. | Marketing / third-party content | Attraction and experience product pages and partner checkout when you choose a Tiqets booking link. | No | Per Tiqets cookie policy on tiqets.com |
| Stripe Checkout (stripe.com) Third-party domain during payment only. | Stripe Payments Europe Ltd. / Stripe Inc. | Strictly necessary | Secure payment processing on Stripe-hosted checkout pages you open voluntarily. | No | Per Stripe cookie policy for the checkout session |
We use Google Consent Mode v2 defaults that keep ad-related storage off until you accept analytics. For more on Italian rules, see the Garante per la protezione dei dati personali.
7. Marketing communications
For Italian recipients, promotional email follows Art. 130 of the Codice Privacy (see internal audit docs/compliance/ART130_MARKETING_AUDIT.md).
- Checklist: we send the PDF you requested regardless of marketing choice. Promotional follow-ups (day 2 and day 7) go only to people who tick the optional opt-in checkbox.
- Purchases: airport transfers and itinerary purchases may enroll you in similar-service planning emails as disclosed on the checkout page and in Stripe. Every marketing email includes an unsubscribe link.
- Contact form: we do not add general inquiries to marketing lists.
8. Retention
| Data category | Typical retention |
|---|---|
| Inquiries & trip planning records | Up to 3 years after last contact |
| Paid orders, receipts, submissions | Duration of service + up to 7 years for tax/accounting |
| Marketing audience (Resend) | Until you unsubscribe or we delete your contact |
| Site events (redacted payloads) | Up to 24 months |
| Rate-limit counters (IP) | Minutes to hours (rolling windows) |
| Analytics (Google / Vercel) | Per provider settings (aggregate) |
9. Your rights
If you are in the EU, UK, or Italy, you may have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase data (subject to legal retention exceptions)
- Restrict or object to certain processing
- Data portability where applicable
- Withdraw consent at any time (without affecting prior lawful processing)
- Unsubscribe from marketing via the link in any marketing email or by emailing us
To exercise these rights, email contact@nexaholdings.net. We respond within 30 days (extendable to 90 days for complex requests, as permitted by GDPR).
10. Right to complain to a supervisory authority
- Italy (Garante): garanteprivacy.it
- EU/EEA: your national data protection authority — list of EU authorities
- United Kingdom (ICO): ico.org.uk
11. International transfers
Nexa Holdings LLC is based in the United States. Personal data may be processed in the U.S. and by providers globally. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement, and/or the EU–US Data Privacy Framework (where the provider participates). Stripe, Google, Resend, Vercel, Neon, Upstash, GetYourGuide, and Tiqets publish their own transfer mechanisms in their data processing terms.
12. Children
Our services are directed at adults booking travel. We do not knowingly collect data from children under 16 without parental authority. Trip forms may include the number of child travelers in your party for logistics (e.g. child seats) — this is information you provide about your booking, not direct marketing to children.
13. Security
We use HTTPS, access controls on admin areas, signed unsubscribe tokens, rate limiting, and provider security features. No method of transmission or storage is completely secure.
14. Changes
We may update this policy. The “Last updated” date above reflects the current version. Material changes will be posted on this page.
Riepilogo in italiano
Sintesi in italiano dei punti principali. In caso di discrepanza fa fede la versione inglese sopra.
Titolare del trattamento
Nexa Holdings LLC (Roam Rome), Stati Uniti. Contatto privacy: contact@nexaholdings.net
Dati che trattiamo
Nome, email, telefono, dettagli di viaggio e prenotazione, dati di pagamento tramite Stripe (non conserviamo i numeri di carta), preferenze marketing e dati tecnici (es. indirizzo IP per sicurezza e anti-spam).
Base giuridica
Esecuzione del contratto o richiesta di servizi; consenso per analytics e cookie non essenziali; consenso esplicito per email promozionali dopo il download della checklist; soft opt-in dopo un acquisto per servizi simili, con informativa al checkout e possibilità di opposizione; obblighi di legge per contabilità.
Cookie e tracker
Prima di caricare Google Analytics, Vercel Analytics, il widget GetYourGuide o i widget Tiqets chiediamo il tuo consenso (Accetta / Rifiuta / Personalizza per categoria). Puoi modificare la scelta in qualsiasi momento con Cookie preferences nel piè di pagina. Vedi la tabella nella sezione 6.
Email promozionali (Art. 130)
- Checklist gratuita: solo email di servizio; promozioni solo se spunti la casella opzionale.
- Dopo un acquisto (transfer, itinerario): possiamo inviare email su servizi simili, con informativa al pagamento e link di disiscrizione.
- Modulo contatti: non ti iscrive a newsletter.
I tuoi diritti
Accesso, rettifica, cancellazione, limitazione, portabilità, opposizione e revoca del consenso. Rispondiamo entro 30 giorni a contact@nexaholdings.net.
15. Contact
Privacy questions or data subject requests: contact@nexaholdings.net
See also our Terms & Conditions.