General terms and conditions are the fundamental part of this booking agreement, concluded between the:

DERIAL SRLS con sede in Via Ghibellina 133rosso, 50122 Firenze. 

 P. Iva 06615420483

Amministratore unico: Dejan Djordjevic

Direttore tecnico agenzia di viaggi: Dejan Djordjevic

PEC: derialsrls@pec.it

NUMERO REA FI – 642488

Europ Assistance, insurance number 9227263

 (hereinafter referred to as “Company”) and customers. Once the customer completes the booking is presumed that he accepts these General Terms and Conditions. The booking the customer makes is obligatory and therefore it is possible for a customer to cancel his booking exclusively according to these General Terms of Conditions. The customer is responsible for all the costs and consequences, which may occur due to the incorrect information he has provided when making a booking.

The customer agrees to these Terms and Conditions by ordering services from the Company either over website, email, telephone, by making a payment without preorder or by any other way.

The Company brand and the website as well as all its components (programming code, design, photographs, text, etc.) and all subpages are the intellectual property of creators of the brand and thus protected by copyrights. Any copying, usage or abuse of the brand and/or website and its components is subject to litigation according to local law.

RESERVATION The reservation will be considered valid as soon as DERIAL has received a booking along with a payment with which the guest has agreed of the present General Terms and Conditions of Sale. For the on-line bought and paid services on the web sites www.tuscanycycle.com, www.florencewinetour.com, www.florence-cooking-class.com, The reservation is definitively booked by Derial with the confirmation of the payment. After payment, a voucher / invoice is automatically generated and sent by email. It is absolutely necessary that the client verifies the validity of his/her email address. Derial cannot be held responsible for problems if the client doesn’t receive or read the voucher carefully. In case the voucher has not been received, please notify Derial by email and it will be resent. The confirmation – voucher should be in the possession of the client at the beginning of the tour (printed or saved on electronic device) and presented to the different service provider. We are committed to do our best to provide current and accurate information on the Company website

The site may contain links to other sites that we do not use. We can in no way be held responsible for the provision of these links to access these sites and external sources, and can not accept any responsibility for the content, advertising, products, services or other materials on or available from these external sites or sources that are neither approved nor verified by our team.

All the photos are symbolic.

All information submitted by the customer at any time will be kept private and confidential, except if there is a good reason for that.

The Company reserves the right to cancel, change or modify any facilities without notice, including changing or altering venues, routes and prices. In the event of a change, the Company will endeavour to substitute alternative arrangements of comparable monetary value without compensation and accepts no liability for loss of enjoyment as a result of these changes. All this is done for the best possible experience of our clients.

In some cases, the Company is an intermediary between the customer and the end performer of service. Although our team is devoted to finding and providing only the best services for you, we cannot be held accountable for mistakes, mishaps or negligence made by third persons.

In case the client is late to an activity, he could be obliged to pay extra for costs caused for arriving late. It is your responsibility to inform the members of your group of the itinerary and make sure everybody shows up on time. We will always try to provide you with the activity later than originally planned, but if we couldn’t do it, you are not eligible for a refund. If you know you will be late, please inform us as soon as possible.

In case of any issues with any of the service conducted by our supplier/partner, we will help you resolve it, but in case that wouldn’t be possible, you have to solve it directly with them.

If for any reason you wish to finish any activity early, you are not entitled to a refund or any discount.

The Company reserves the absolute right to decline a booking at our discretion for any reason and at any time. Clients agree to accept the authority and decisions of our employees, guides and affiliates.

The Company reserves the right to cancel a tour or tasting in any circumstances but will endeavour to avoid this unless absolutely necessary.

All clients are responsible for their own safety and well-being. We don’t encourage any of our clients to engage in any dangerous activity or to drink excessively. The Company cannot accept any responsibility if the client drinks too much or engages in dangerous activities and suffers injury, illness, death, loss or damage as a result.

Some programs include alcohol consumption and are suitable only for participants aged 18 years or older. Unless stated otherwise, participation is possible only for participants over 18 years. Proof of age must be provided at the time of participation. As proof of age, we only accept official identification such as Passport, driver license and other proof of age (18 plus) cards. Unacceptable identification includes photocopies, student cards and other non-government issued identification. All customers ensure that they are fit and able to complete the itinerary of the tour and that they are in good physical and mental shape.

By making a booking every customer agrees that the Company has the right to publish all the photos and videos that were made during the program (the photos and videos could include every customer) in promotional and commercial intentions.

Our team is devoted to organize great experiences. Despite all our efforts we urge you to give us feedback in any form. If the client has a complaint he/she must bring it to the attention of the tour guide right away. That way our team has the chance to rectify the situation upon evaluation of the complaint. Possible amendments to the tour in the interest of satisfaction of a client can be made only if the complaint is presented during the tour. Complaints made at a later time will not be taken into consideration. Should the complaint be presented during the tour and the problem remained unresolved another complaint must be made in writing to the Company within 3 days of the completion of the tour.

The Company reserves the right to cancel the program at any time if the customer does not obey the instructions of the tour guide and appears likely to endanger the safe and comfortable progress of the tour, that client may be excluded from all or part of the tour. In this case, the customer does not have the right to any refund or cover any additional costs incurred by customers as a result.

All clients are expected to obey local laws and regulations and any failure to do so will relieve the Company of all obligations that they may otherwise have under these booking conditions. Any damage or losses caused by a client is the responsibility of the client. Full payment for any such damage or loss must be paid at the time directly to the supplier. If the client fails to do so, the Client will be responsible for meeting any claims (including legal costs) subsequently made against the Company as a result of the client’s actions.

The General Terms and Conditions and the relationship between a customer and the Company shall be governed by the local laws without regard to its conflict of law provisions. A customer and the Company agree to submit the exclusive jurisdiction of the competent court located in Florence, Italy.

General Terms and Conditions shall take effect on the date of 




Right to privacy is one of the most important human rights. In DERIAL SRLS (hereinafter referred to as the Company), we are very well aware of this and we, therefore, respect the privacy of our customers and treat their personal data responsibly, carefully and according to the applicable legislation. The access to personal data is permitted only to authorised Company personnel and contracted processors, to the extent and with the purpose strictly necessary for the smooth implementation, assurance and fulfilment of rights and obligations arising from concluded contractual relations.

By taking proper measures, we ensure that unauthorised persons do not access personal data, protect its confidentiality and integrity, and prevent its loss or unintentional destruction throughout the entire time of being processed. We will not be held responsible for any “hacking” into a computer system!

Company and its processors fully respect the general principles regarding the processing of personal data, which are:

  1. We process user personal data legally, fairly and transparently.
  2. We collect personal data for purposes that are pre-determined, explicit and legal; we do not process personal data for any other purpose, except in the case of processing for scientific or historical research purposes and for statistical purposes, under certain conditions.
  3. Personal data is processed to the minimum extent for the purposes for which it is processed.
  4. We ensure that the personal data we process is accurate and regularly updated; incorrect data is corrected or deleted.
  5. We store personal data only as long as it is necessary for the purposes for which they are processed.
  6. We ensure appropriate security of personal data, which includes prevention of unauthorised or unlawful processing and accidental loss, destruction or damage by appropriate technical and organisational measures.


For questions related to the processing and use of personal data, information, corrections, blocking, deletion of personal data or cancellation of notification consent, cancellation of consent, please contact tuscanycycle@gmail.com(hereinafter referred to as email address under point 1). 


  • Basic personal data (e.g. name and surname);
  • communication data (e.g. address, mail, telephone no.);
  • information on communication between the Company and you;
  • payments data;
  • any other data obtained based on the consent.


We can treat personal data in accordance with valid legislation from the field of protection of personal data:

  • if this is necessary for the conclusion and/or fulfilment of a contract (application on an event, workshop, etc.)
  • if required by law;
  • if consent is given (which can be cancelled at any time);
  • if the processing is necessary for the legitimate interests pursued by the Company or a third party.


The company processes personal data of individuals to fulfil its obligations under a contractual relationship for the organisation of events, workshops or other services agreed between the contractual parties. In the context of the exercise of rights and the fulfilment of contractual obligations, Company processes personal data of individuals for the following purposes:

  • identification of an individual;
  • preparation of the offer and conclusion of the contract;
  • providing services, whereby Company can give the data to contract partners that will implement an individual service (e.g. a provider of overnight stays, etc.)
  • sending notifications to individuals regarding the implementation of the contractual relationship;
  • informing about changes in legislation in a particular field or changes in terms of sale;
  • invoicing services;
  • resolving objections or complaints;
  • implementation of any recovery procedures, a sale of receivables;
  • for other purposes, necessary for the conclusion or implementation of a contractual relationship.

To the extent strictly necessary for authentication and identification of transactions, Company processes data for the purpose of preparing reports and planning further activities.

For the purposes of organising events and related services or other services ordered by an individual, Company processes all information needed. This includes in particular, but not exclusively: name, first name, surname, birth date, address, place, country, telephone number, email, etc.

At events or workshops that are strictly connected with photographing and publication of pictures (on Facebook, Twitter, YouTube in Instagram), it is numbered that photographing and publication of pictures are part of an event or workshop. In spite, that photographing and publishing of pictures is a contractual relationship, Company will still gain explicit consent of an individual. In a case where explicit consent for photographing and publication of pictures will not be given and Company will not be able to assure that an individual will not be on photograph, Company is justified to rejects application on such event or workshop.

If the individual does not provide all personal data that the Company needs to fulfil the contractual relationship, the Company cannot execute the individual’s order. Hereby, Company always acquires and further processes only the personal data that is needed to fulfil the contractual relationship.


The legal basis means that the Company processes personal data of an individual to fulfil the applicable legal obligations imposed by the legislation. In the Republic of Italy, legal obligations to process certain personal data are determined in particular by:

According to the GDPR 679/16; European regulation on the protection of personal data given on our contact

forms will be handled as strictly confidential and will not be traded or shared with any organization, company, board or others


Company may process data on the basis of a legitimate interest which Company or a third party pursues, except when such interests are prevailed by the interests or fundamental rights and freedoms of an individual, to whom the data that requires the protection of personal data is related, in particular when the data relates to a child. In the case of further use of collected data on an individual, the Company implements the assessment according to the General Data Protection Regulation. Such further use of data in a pseudonymised or aggregated form, for example, represents the lawful use of data for marketing and other business or technical analyses of Company.

According to the General Data Protection Regulation, direct marketing also belongs to legitimate interests. For the purposes of direct marketing, Company may create individual profiles without any consent on the basis of basic information on selected services, such as e.g. the type or specific characteristics of the selected service, time of selection or past marketing contacts with the individual, in particular with respect to the expressed interest or lack of interest in certain services. Such basic profiling shall never include sensitive data. An individual may object to the processing according to the right to the restriction (item 7.4).

Based on legitimate interest, the Company may contact the individual to improve the service or determine his satisfaction with the services, even when this is not strictly necessary for the implementation of the contract. Due to the individuals’ interest, the Company does not contact those individuals who have objected to this.

The company has a legitimate interest to keep and further use data for analyses and research for marketing, business planning and similar until the expiration of the legally prescribed retention period.


Explicit consent is the basis for personal data processing for which Company does not have a legal or contractual legal basis. For example, consent may relate to:

  • informing about other Company offers and services, which is implemented exclusively through the communication channel selected by the individual;
  • photographing and recording an event or workshop for the purpose of presenting Company activities and publishing photos, videos and sound recordings on the Company website and on Facebook, Twiter, YouTube and Instagram profiles.

The individual gives the consent for himself, in the case of a child, consent is given by one of the parents or a legal representative.

In these cases, the processing of personal data is implemented to the extent and for purposes allowed by the individual’s statement and through agreed communication channels, until cancellation.

If the individual does not consent to the personal data collection and processing for one or more purposes specified in an individual consent, this does not have any consequences for the data the processing of which is implemented based on other legal bases.

Personal data collected on the basis of consent will be processed only within the framework and for the purpose of the given consent and will not be transmitted to third parties unless this is explicitly stated in the consent and the individual agrees that personal data may be transmitted to the processor specified in the consent.

The individual can cancel the consent to process personal data at any time by contacting our data protection point (point 8). The consent can be cancelled by an email sent to the email address under point 1.


Personal data shall be stored in accordance with the applicable regulations governing the protection of personal data. It shall be stored only as long as necessary for the purposes for which it is processed or according to the law. We store personal data, which we process based on the personal consent of the individual, permanently, until cancellation. Personal data, which we process based on the law or contractual relationship, is kept for as long as the law determines.

If the data is processed based on an individual’s consent due to the marketing of Company, the data may be processed to the necessary extent for as long as necessary for such marketing or services.

After the expiry of the retention period, the personal data is effectively and permanently deleted or anonymised so that it can no longer be linked to an individual.


We use technical and organisational security measures to protect personal data against unlawful or unauthorised access or use and also against unintentional loss or impairment of their integrity. We have designed these measures with regard to our IT infrastructure, possible impact on an individual’s privacy and costs and according to current industry standards and practices. Our contractual processors shall process your personal data only if they comply with these technical and organisational security measures.

Maintaining data security means protecting the confidentiality, integrity and availability of personal data:

  • confidentiality and integrity: individuals’ personal data shall be protected against unauthorised or illegal processing and against unintentional loss, destruction or injury;
  • availability: we shall ensure that authorised processors can access personal data only when necessary.

Our security procedures include access security, backup copies, monitoring, revision and maintenance, security incident management, etc.


Depending on the purposes for which we process individuals’ personal data, we can disclose this data to the following categories of processors:

  1. a) Within Company an employee.
  2. b) Our business partners of which we demand to comply with the applicable laws and personal data protection policy and to pay great attention to the confidentiality of the personal data:
  • advertising, marketing and promotional agencies and providers, e.g. MailChimp, Google (Google – only cookie identifier for remarketing, e-mail address for displaying ads in Google AdWords, cookie identifier for analysis in Google Analytics; Facebook – only cookie identifier for remarketing, e-mail address for displaying ads in Facebook Custom Audiences), that help us implement and analyse the effectiveness of our campaigns and promotions.
  • companies that perform services for Company, i.e. accounting service provider
  • natural and legal entities who are our contractual partners and provide consulting or individual services for Company with the purpose of executing a contractual relationship between Company and an individual (e.g. partner agencies, hotels, airlines, carriers, etc.);
  1. c) Other third persons when required by law or legally required for the protection of:
  • Company (compliance with laws, authority requirements, court orders, legal procedures, reporting obligations and obligations to inform the authorities, etc.), verification or enforcement of compliance with Company policy and agreements;
  • rights, property or security of Company and/or its clients in relation to corporate transactions: in the context of transfer or disposal of all or part of its business or otherwise in connection with mergers, consolidations, changes of control, reorganisation of Company.

Our business partners listed above under item b), may only process individuals’ personal data in the framework of our instructions and may not use personal data to pursue any of their own interests. Each individual must bear in mind that the processors listed in items b) and c) above, in particular, service providers that offer services within the framework of applications and/or through their own channels may separately collect your personal data. In this case, they are solely responsible for its control and their cooperation with individuals must take place according to their terms.


The Company ensures that individuals exercise their rights without undue delay, but in any case, no later than one month after receiving the request. The Company may extend the deadline for exercising the rights of the individual for a maximum of two months, considering the complexity and number of requests. If extending the deadline, Company shall notify the individual about the extension within one month of receipt of the request, stating the reasons for the delay.

When the individual, to whom the personal data is related, sends the request by e-mail, the information shall, when possible, be provided by electronic means, unless the individual requests otherwise.


Each individual can contact us to the email address E-mail address under point 1. to find out which personal data we process. Each individual has the right to access personal data and additional information concerning the processing of personal data, including:

  • the purpose of the processing;
  • the categories of personal data;
  • users and legal entities, to whom personal data have been or will be disclosed;
  • when possible, the estimated retention period of personal data or, if that is not possible, the criteria used to determine the retention period;
  • the existence of the right to require from the administrator to correct or delete personal data or to restrict personal data in relation to the individual, to whom the personal data relates, or the existence of the right to object to such processing;
  • the right to lodge a complaint with a supervisory body;
  • when personal data is not collected from an individual, all available information related to its source.


If an individual finds any error in his personal data or if he finds it incomplete or wrong, he may request Company to correct or supplement inaccurate or incomplete personal data without undue delay.


An individual may request to delete his personal data without undue delay. The Company is obliged to delete personal data without undue delay:

  • when personal data is no longer required for the purposes for which it was collected or otherwise processed;
  • if the individual cancels the consent that is the basis for the processing of personal data and if there is no other legal basis for the processing;
  • if the individual objects to the processing on the basis of the legitimate interest of Company, while there are no prevailing legal reasons for the processing of personal data;
  • if the individual objects to the processing for direct marketing purposes;
  • when personal data should be deleted for the fulfilment of a legal obligation according to EU law or the Slovenian legal order;
  • in the case of data incorrectly collected from a minor for the use of information society, who, according to the applicable law, cannot provide such data.

(except in some cases, for example, to prove the transaction or if required by law).


Each individual may request a restriction of the processing of his personal data when:

  • he challenges the correctness of the data, for the period which enables Company to verify the correctness of the personal data;
  • the processing is unlawful and the individual objects to the deletion of the personal data and instead requests their use to be limited;
  • The Company no longer needs the personal data for the purposes of the processing, but the individual, to whom the personal data relates, needs it to exercise, implement or defend legal requests;
  • the individual has filed an objection regarding the processing until it is verified whether legitimate reasons of Company prevail over the individual’s reasons.


Each individual shall have the right to receive the personal data concerning him or her, which he or she has provided to Company, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company, where the processing is based on consent pursuant or on a contract pursuant and the processing is carried out by automated means.


On the basis of reasons related to their special circumstances, each individual has the right to object at any time to the processing of their personal data based on the legal interests pursued by Company or a third person. In this case, Company ceases to process personal data, unless it proves necessary processing reasons that prevail over the individual’s interests, rights and freedoms, or for the enforcement or defence of legal claims. When personal data is processed for the purpose of direct marketing, each individual has the right to object at any time to the processing of personal data related to him for the purposes of such marketing, including profiling, if it relates to such direct marketing. If direct marketing is based on consent, the right to object can be exercised by cancelling the given consent.


We have organised a contact point that will address your questions or requirements regarding your personal data (and their processing) and the exercise of your rights. You can send us an email address under point 1.

For the purposes of reliable identification when exercising the rights connected to personal data, we may require additional data from you and we can deny action only if we can prove that we cannot identify you reliably.


Everyone has the right to file the complaint related to processing of personal data Complaints should be sent to the e-mail address under point 1. You also have the right to file a complaint directly to the Information Commissioner if you believe that the processing of personal data related to you violates Slovenian or EU regulations on the protection of personal data. If you have exercised the right to access the data and, after receiving the decision, you believe that the personal data that you have received is not the personal data you requested or that you did not receive all the personal data required, you can lodge a reasoned complaint to Company within 15 days, before submitting a complaint to the Information Commissioner. The Company will decide on the complaint as on a new request, within five working days of receiptGDPR shall take effect on the date of 01.04.2019

Leave a Comment