PRIVACY POLICY
Last updated: 21 October 2026
1. About this policy
This Privacy Policy explains how KEFI processes personal data when you browse this website, contact us, purchase a self-guided walk or use its WhatsApp chatbot.
The sections about purchases and customer access apply from the launch of sales. Reading this policy or using the website does not constitute consent to optional processing.
2. Data Controller
The controller responsible for the processing described in this policy is:
Olga Gorenko, a sole trader operating as KEFI
Via dei Biscottari 4, Palermo (PA), Italy
Partita IVA: 07413090825
Email: ogorenko@gmail.com
In this policy, “we” and “us” refer to the controller.
3. Personal data we process
Depending on how you use KEFI, we process:
- Enquiries and support: your email address or WhatsApp number, name if provided, the content of your enquiry and information needed to resolve it
- Purchases: your email address, name where supplied through checkout, the walk purchased, transaction reference, payment status, date and amount, and information needed to manage delivery, refunds or payment disputes
- Chatbot access: WhatsApp numbers used to activate access, customer email addresses, access codes and records needed to administer access
- Website use: technical information such as IP address, browser and device information, access times and requested pages; with your consent, analytics information about visits and interactions with the website
- Consent records: information needed to record and respect your cookie choices and, where applicable, confirmations given during checkout
Payments are processed by Stripe. We do not receive or store your full card number or card security code.
4. Why we use your data and our legal bases
| Purpose | Legal basis under the GDPR |
| Process a purchase, deliver the PDF and links, administer chatbot access and provide purchase-related support | Performance of a contract — Article 6(1)(b) |
| Answer a pre-purchase enquiry | Steps requested before entering into a contract — Article 6(1)(b) |
| Answer other enquiries | Our legitimate interest in responding to people who contact us — Article 6(1)(f) |
| Meet applicable accounting, tax and other legal duties | Compliance with legal obligations — Article 6(1)(c) |
| Protect the website, prevent misuse and fraud, and establish, exercise or defend legal claims | Our legitimate interests in security, protecting the service and protecting our rights — Article 6(1)(f) |
| Use optional analytics cookies and measure website visits and interactions | Your consent — Article 6(1)(a), together with applicable cookie rules |
We do not use purchase or support contact details to send marketing messages.
Your email address is needed to deliver your purchase. A WhatsApp number is needed to use the WhatsApp version of the walk. Without the relevant information, we cannot provide that part of the service. Optional analytics consent is not required to browse the website or buy a walk.
5. Cookies and website analytics
We use Complianz to manage cookie preferences. Cookies necessary for website operation, security or remembering your consent choices do not require optional analytics consent.
Google Analytics is used with your consent to understand website visits and interactions, including clicks on buttons and links. Analytics information can include pages viewed, traffic sources, device information, approximate location and online identifiers. It is not treated as inherently anonymous simply because it does not contain a name.
We do not intentionally send customer names, email addresses, WhatsApp numbers or access codes to Google Analytics. We do not currently use analytics to track progress through the chatbot.
You can reject optional analytics or change your choice through the website’s cookie preferences. Further details about cookies are provided in our Cookie Policy.
6. Purchases, delivery and chatbot access
Stripe: Checkout and card processing take place through Stripe. Stripe provides us with information needed to confirm the purchase and manage the transaction. Stripe also processes information for its own purposes, including payment security, fraud prevention and legal compliance, as described in its Privacy Policy.
Email delivery: We use your purchase email address to send the PDF, chatbot link and other links included with the walk, and to handle delivery or access problems. WP Mail SMTP is used to send website emails through our mail server. We do not retain copies of email contents in WP Mail SMTP logs.
WhatsApp chatbot: If you use the chatbot, your WhatsApp number and the information needed to activate and administer access are processed through the WhatsApp Business Platform provided by Meta. WhatsApp also processes information under its own Privacy Policy. People using shared access have their own WhatsApp numbers processed when they activate or use the chatbot.
Customer records: From the launch of sales, the Google Sheets tables used to administer customer access are maintained through Google Workspace under its applicable data processing terms. Access to these tables is restricted to the controller.
7. Who receives personal data
Personal data is shared only as necessary for the purposes described above with:
- Stripe, for checkout, payment processing and transaction management
- Google, for consent-based website analytics, customer access tables through Google Workspace, and email correspondence handled through our contact email account
- Meta/WhatsApp, when you use the WhatsApp chatbot or contact us through WhatsApp
- Professional advisers or public authorities, where necessary to meet legal obligations or handle a specific legal matter
The website and our outgoing mail server are hosted on infrastructure administered by the controller within the European Union.
Service providers may act as processors under our instructions or as independent controllers for their own processing, depending on the service and purpose. We do not sell personal data.
Links to Google Maps and other external websites take you to services governed by their own privacy notices. A link alone does not embed a Google Maps service in the page.
8. International transfers
Although our own server infrastructure is in the European Union, using Google, Stripe and Meta/WhatsApp can involve processing outside the European Economic Area.
Where required, transfers are protected by an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework for covered transfers to certified organisations, or by Standard Contractual Clauses and any necessary supplementary safeguards.
Provider information is available in Google’s transfer framework information, Stripe’s Data Transfers Addendum and the WhatsApp privacy information linked above. You can contact us for information about the safeguards applicable to your data and how to obtain a copy, subject to necessary redactions.
9. How long we keep data
We retain personal data for the following periods or according to the following criteria:
- Customer access records: for as long as needed to administer the access actually available to you, including any free extension beyond the period included with your purchase. When access permanently ends, the records are deleted unless particular information must be retained for a legal obligation or a specific claim
- Enquiries and support correspondence: normally for up to 24 months after the enquiry is resolved. Relevant records may be retained longer where needed to provide ongoing support, comply with a legal obligation or handle a specific dispute
- Transaction and accounting records: for the retention period required by applicable Italian tax and accounting law, calculated according to the type of record and relevant financial year. Records needed for an ongoing dispute or investigation may be retained until it is resolved and the applicable legal requirements have been met
- Google Analytics user-level and event-level data: up to 14 months under the configured retention setting. This setting does not necessarily apply to aggregated standard reports. Cookie lifetimes are explained in the Cookie Policy
- Security and consent records: only for as long as necessary to protect the service, respect and demonstrate consent choices, or meet an applicable legal requirement
We review retained data and delete or anonymise information when it is no longer needed. The contractual period of chatbot access does not automatically determine the retention period for every category of data.
10. Your rights
Subject to the conditions of the GDPR, you can request access to your personal data, correction, erasure or restriction of processing. You can also request data portability where applicable.
You can object to processing based on legitimate interests on grounds relating to your particular situation. Where processing is based on consent, you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
To exercise your rights, email ogorenko@gmail.com. We normally respond within one month. If a lawful extension is necessary, we will explain why within that month. We may request information reasonably necessary to verify your identity.
You also have the right to lodge a complaint with a competent supervisory authority, including the Italian Garante per la protezione dei dati personali: www.garanteprivacy.it. You do not have to contact us before making a complaint.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
11. Security
We use technical and organisational measures appropriate to the risks, including restricting access to customer records. No system can eliminate every security risk; this does not limit our obligations under data protection law.
12. Children
This website is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has provided personal data to us, please contact us so that we can take appropriate action.
13. Updates and contact
We may update this policy to reflect changes to the service or applicable requirements. The current version and its update date will be published on this page. Where required, we will provide further notice of material changes.
For privacy questions, contact ogorenko@gmail.com.