Skip to main content

Shakadabra App

Providers
Sign in
Sign up

Shakadabra Privacy Policy​

Last updated: 11 May 2026

This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree No. 196 of 30 June 2003 as amended by Legislative Decree No. 101 of 10 August 2018 (the “Italian Privacy Code”).

This is a courtesy English translation of the official Italian Privacy Policy. In case of discrepancies, the Italian version prevails.

1. Data Controller

The Data Controller is:

Shakadabra S.r.l.

  • Registered office: Via Velasquez 19, Palermo (PA), Italy
  • Tax Code and VAT Number: 07262490829
  • REA: PA-447581
  • Share capital: € 11,353.00 fully paid-up
  • Legal form: Limited liability company (S.r.l.) qualified as innovative startup pursuant to Italian Law Decree No. 179 of 18 October 2012
  • ATECO Code: 79.90.04
  • Legal representative: Gianluca Di Giorgio (CEO and Sole Director)

Controller contacts:

For any matter relating to the processing of personal data, please write to [email protected].

2. Scope

This Privacy Policy applies to the processing of personal data carried out by Shakadabra S.r.l. through:

  • the website https://shakadabra.com
  • the provider portal https://provider.shakadabra.com
  • the “Shakadabra” mobile app for iOS and Android
  • any other digital or physical channel attributable to Shakadabra

The Policy applies to all categories of users defined below.

3. Categories of Users and Definitions

For the purposes of this Policy, the following definitions apply.

Explorer: an adult natural person who registers on the platform to search for, book and review tourism experiences.

Provider: a natural person, sole trader or company that publishes and sells tourism experiences on the platform. Providers may include tour operators, artisans, chefs, fishermen, winemakers, local guides, master craftspeople, farmers, shepherds, outdoor operators or similar.

B2B2C Partner: an accommodation facility (hotel, B&B, guest house, agritourism), restaurant, car rental or other business that promotes Shakadabra to its own customers via QR code or personalized referral link.

Platform: the combination of the website, provider portal and mobile app.

Experience: a tourism service, activity, workshop, tour or event offered by a Provider on the Platform.

4. Categories of Personal Data Collected

4.1 Data collected from Explorers

We process the following data:

  • identification data: first name, last name, email address, password (stored in hashed form)
  • contact data: phone number (if provided)
  • geolocation data: device location, collected only with consent, used to suggest nearby experiences
  • navigation data: experiences viewed, booked, reviewed, session duration, video feed interactions
  • payment data: handled directly by the Stripe gateway in PCI-DSS compliant mode. Shakadabra does not store card data
  • PayPal account data: email address linked for the receipt of Earn from Review commissions
  • user-generated content: video reviews (max 30 seconds), text reviews, comments, profile images
  • preferences: language, currency, preferred experience categories
  • cookie data: technical, analytics and profiling cookies, managed under the Cookie Policy with granular consent
  • identity document: requested only in specific anti-fraud verification or legal compliance cases

4.2 Data collected from Providers

We process the following data:

  • identification and tax data: business name or full name, VAT number, tax code, registered office, billing address, SDI recipient code or PEC
  • contact data: email, phone, reference person
  • banking and payout data: IBAN, Stripe Connect account data
  • published content: experience descriptions, photos, videos, prices, availability calendars
  • transactional data: booking history, amounts, applied commissions, ratings received
  • integration credentials: links to third-party systems (Bokun, Regiondo or similar), processed only with the Provider’s explicit authorization
  • professional insurance and local regulatory compliance data, where required by law

4.3 Data collected from B2B2C Partners

We process the following data:

  • identification data of the business: trade name, address, type
  • tax data: VAT number, tax code, billing address, SDI code or PEC
  • contact data: email, phone, reference person
  • PayPal account data: email address linked for receipt of referral commissions
  • referral campaign data: unique QR code, referral link, usage statistics
  • referred guest data in anonymized form: unique identifier, number of bookings, cumulative amount. Personal data identifying referred Explorers is not shared with the B2B2C Partner

4.4 Automatically collected data

For each Platform interaction we automatically collect:

  • IP address
  • browser type and version
  • operating system
  • mobile device identifier
  • pages visited and time spent
  • referrer (source site)
  • crash and error data for security and service improvement purposes

5. Purposes of Processing and Legal Bases

Personal data is processed for the purposes listed below, each with its legal basis under Article 6 GDPR.

5.1 Performance of contract (Art. 6.1.b GDPR)

  • user account registration and management
  • booking management and experience delivery
  • payment processing via Stripe
  • management of the internal wallet and commission payouts via PayPal
  • service communications (confirmations, vouchers, reminders)
  • dispute and refund management
  • customer support

5.2 Compliance with legal obligations (Art. 6.1.c GDPR)

  • issuance and storage of invoices
  • tax obligations
  • anti-money laundering compliance (Italian Legislative Decree 231/2007)
  • accounting record retention (10 years pursuant to Art. 2220 of the Italian Civil Code)
  • responses to requests from judicial and administrative authorities

5.3 Consent of the data subject (Art. 6.1.a GDPR)

  • newsletters and promotional communications to Explorers
  • advanced profiling for offer personalization
  • precise device geolocation
  • third-party marketing and profiling cookies
  • publication of video reviews in the public feed (subject to acceptance of community guidelines)

The data subject may withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before its withdrawal.

5.4 Legitimate interest of the Controller (Art. 6.1.f GDPR)

  • Platform security and fraud prevention
  • legal defense of Shakadabra
  • aggregate statistical analysis for service improvement
  • B2B commercial communications to accommodation facilities, restaurants, tour operators and other professional entities in the hospitality and tourism sector, as further specified in Section 11 below

6. Specific Features and Data Processed

6.1 B2B2C Referral System

When an Explorer registers with Shakadabra after scanning a QR code or following a referral link from a B2B2C Partner, the acquisition source is tracked. For 24 (twenty-four) months following registration, every Experience booked and completed by the Explorer in any city or country worldwide and of any category generates a referral commission equal to 30% of the Marketplace Commission collected by Shakadabra (corresponding, as of the effective date of these Terms, to 6% of the transaction value, calculated on the 20% Marketplace Commission), credited to the B2B2C Partner.

Personal data of the Explorer is never shared with the B2B2C Partner. The Partner receives only aggregated or pseudonymized statistical data on its campaigns (number of registrations generated, number of bookings, cumulative amount, accrued commissions).

6.2 Earn from Review System

Explorers may upload video reviews (maximum 30 seconds) of experiences they booked and lived. Such videos, after community-guidelines moderation, are published in the Platform’s public feed.

When another Explorer views the video, books the same Experience and completes payment, the Explorer who authored the video review receives a commission, according to the following tiers:

  • 0 to 5 video reviews uploaded: 3% of the transaction value
  • 6 to 20 video reviews uploaded: 4% of the transaction value
  • 21 or more video reviews uploaded: 5% of the transaction value

The commission is credited to the Explorer’s internal wallet and is permanent: the right to receive the commission lasts for the entire duration of the video’s publication on the Platform.

Earn from Review data (videos, view statistics, generated bookings, accrued commissions) is processed for contract performance and program management.

The Explorer is solely responsible for tax compliance on commissions received, which constitute taxable income under Italian law applicable to the relevant person’s situation.

6.3 Earn from Coupon System

B2B2C Partners and partnered influencers may create coupon campaigns. When an Explorer uses a coupon associated with a Partner, the Partner receives a commission on the relevant booking. Tracking is similar to the B2B2C referral system and does not involve sharing personal data identifying Explorers.

6.4 Payments and financial flows

For Explorer-to-Provider bookings:

  • the Explorer pays via Stripe, a PCI-DSS Level 1 certified gateway
  • Shakadabra acts as intermediary platform via Stripe Connect
  • the Provider receives the net amount in its Stripe Connect account, after deduction of the 20% Marketplace Commission
  • payout times follow Stripe standard (typically 2 to 7 business days)

For Earn from Review and B2B2C referral commission payouts:

  • commissions accumulate in the user’s internal wallet
  • payment is made via PayPal, subject to account linking
  • payment occurs upon reaching the minimum threshold of € 100.00
  • frequency: monthly, by the 15th of the month following threshold accrual

7. Methods of Processing

Personal data is processed lawfully, fairly and transparently, by electronic means, with technical and organizational measures appropriate to the risk, pursuant to Art. 32 GDPR.

Main measures include:

  • encryption in transit (TLS 1.2 or higher) and at rest
  • password hashing with strong algorithms
  • role-based access control and least-privilege principle
  • security logging and continuous monitoring
  • regular backups and disaster recovery procedures
  • training of authorized personnel
  • Data Protection Impact Assessments (DPIAs) where required by law

8. Data Retention

Personal data is retained for the time strictly necessary for the purposes of collection, according to the following criteria:

  • user account data: for the duration of the account plus 10 years after deletion, for tax and civil-law obligations
  • transaction and invoicing data: 10 years from issuance, pursuant to Articles 2214 and 2220 of the Italian Civil Code and tax laws
  • video reviews: for the duration of the account plus 5 years after deletion, unless earlier removal is requested by the author
  • navigation data and logs: 12 months, save for security or legal-defense needs
  • marketing and profiling cookies: maximum 12 months, subject to consent renewal
  • marketing communications data: until consent withdrawal or objection

Once retention periods expire, data is deleted or irreversibly anonymized.

9. Data Recipients

Personal data may be communicated to the following recipients, each appointed external processor under Art. 28 GDPR where applicable:

  • Shakadabra employees and collaborators authorized to process data
  • technical service providers (hosting, email, customer support, analytics)
  • payment gateways (Stripe, PayPal)
  • accounting, tax and legal advisors
  • audit and certification firms
  • public authorities and judicial bodies, where required by law
  • parties involved in extraordinary transactions (business transfers, mergers), in compliance with applicable law

The Provider receives only data strictly necessary for delivering the booked Experience (name, number of participants, specific requirements communicated by the Explorer).

B2B2C Partners do not receive personal data identifying referred Explorers.

An updated list of external processors is available upon request to [email protected].

10. Extra-EU Data Transfers

Some of our suppliers operate outside the European Union. In such cases, Shakadabra adopts appropriate safeguards under Articles 44 et seq. of the GDPR.

Main transfers concern:

  • Stripe, Inc. (USA): payment gateway. Transfer based on Standard Contractual Clauses (SCC) and Data Processing Addendum
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. and PayPal Holdings, Inc. (USA): payment services. Transfer based on Standard Contractual Clauses
  • Amazon Web Services (Ireland): cloud and infrastructure services. Servers located in the European Union (Ireland data center)
  • Google Cloud / Google Workspace (Ireland): email and productivity services. Servers located in the European Union
  • Anthropic, PBC (USA): AI services for suggestions and AI features of the Platform. Transfer based on Standard Contractual Clauses

Copies of safeguards are available upon request to [email protected].

11. B2B Commercial Communications and Legitimate Interest

Shakadabra sends commercial communications to accommodation facilities, restaurants, tour operators, car rentals and other professional entities in the hospitality and tourism sector, aimed at presenting the marketplace and proposing commercial partnerships.

Such communications rely on Shakadabra’s legitimate interest in promoting its services, pursuant to Art. 6.1.f GDPR, in compliance with Italian Data Protection Authority Decision No. 372 of 4 July 2019 and applicable guidelines on B2B “soft opt-in” marketing.

The legitimate interest basis was verified through a balancing test (Legitimate Interest Assessment), which considered:

  • the strictly professional nature of the recipient (no private individuals, no consumers)
  • relevance of the message to the recipient’s professional activity
  • the limited intrusiveness of the initiative
  • a simple and effective opposition channel

The recipient may object at any time to further communications by:

The protections of Art. 130 of the Italian Privacy Code apply.

12. Data Subject Rights

The data subject may exercise the following GDPR rights at any time:

  • Right of access (Art. 15): obtain confirmation of whether data is being processed and receive a copy thereof
  • Right to rectification (Art. 16): obtain correction of inaccurate data or completion of incomplete data
  • Right to erasure (Art. 17): obtain deletion in cases provided by law, save retention obligations
  • Right to restriction of processing (Art. 18): obtain restriction in specific cases
  • Right to data portability (Art. 20): receive data in a structured, commonly used format and transmit it to another controller
  • Right to object (Art. 21): object to processing for reasons related to particular situation, including direct marketing
  • Right to withdraw consent: withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before withdrawal
  • Right to lodge a complaint (Art. 77): lodge a complaint with the competent supervisory authority

12.1 How to exercise rights

To exercise rights, the data subject may send a written request to [email protected], attaching a copy of a valid identity document for proper identification.

Shakadabra will respond within 30 days from receipt of the request. In particularly complex cases, the term may be extended by 60 days, with timely notice and reasons.

Exercise of rights is free of charge. Only in cases of manifestly unfounded or excessive requests may Shakadabra charge a reasonable fee or refuse the request.

12.2 Complaint to the supervisory authority

A data subject who believes their data is processed in violation of the GDPR may lodge a complaint with the Italian Data Protection Authority:

13. Cookies and Similar Technologies

The Platform uses cookies and similar technologies (pixels, SDKs, local storage) to ensure service functioning, analyze use and personalize the experience.

Categories of cookies used:

  • Technical cookies: necessary for Platform functioning, no consent required
  • Analytics cookies: used in aggregated form or with adequate pseudonymization measures
  • Profiling and marketing cookies: used only with explicit consent via the cookie banner

Consent is collected granularly and may be withdrawn at any time via the cookie management panel at the bottom of the Platform.

For full details on cookies, durations and third parties, see the dedicated Cookie Policy.

14. Minors

Shakadabra services are reserved to adults (18 years). We do not intentionally collect personal data of minors under 18.

If we become aware that a minor has provided personal data in breach of our Terms, we will promptly delete such data, save legal obligations.

Parents or guardians who believe a minor has provided personal data should contact [email protected].

15. Data Security

We adopt technical and organizational measures appropriate to protect personal data from unauthorized access, loss, destruction, alteration, disclosure or unlawful use.

In case of a personal data breach posing a risk to the rights and freedoms of data subjects, Shakadabra will notify the Italian Data Protection Authority within 72 hours of becoming aware of it, pursuant to Art. 33 GDPR. Where the risk is high, data subjects will also be notified pursuant to Art. 34 GDPR.

16. Automated Decision-Making and Profiling

The Platform uses recommendation algorithms and AI features (including solutions provided by Anthropic) to suggest experiences, sort search results, personalize the video feed and improve user experience.

Such processing does not produce legal effects significantly affecting the data subject under Art. 22 GDPR. The user may object to profiling and request human intervention by writing to [email protected].

17. Changes to this Policy

Shakadabra may update this Privacy Policy at any time, including for regulatory or organizational changes.

Changes will be communicated through:

  • publication of the new version on the Platform with the update date
  • email to the registered address, in case of material changes
  • in-app notification, where technically available

Users are invited to review this Policy periodically.

18. Privacy Contacts

For any privacy-related request or query, please contact: