Privacy Policy

1. General Information

This Privacy Policy describes how we collect, use, and protect the personal data of users of the website www.ormebikexperience.com. Compliance with Regulation (EU) 2016/679 (GDPR) is our priority.

2. Data Controller

Sabatiello Carlo
Orme Bike Experience
VAT Number: IT04471100984

3. Collected Data

3.1 Voluntarily provided data

• WhatsApp Contacts: Name, phone number, messages (for bookings)
• Contact form: Name, email, message
• Bookings: Name, email, phone, dates, number of participants

3.2 Automatically collected data

• Google Analytics (GA4): Anonymous ID, pages visited, time spent, device, browser, approximate location
• Session cookies: For site functionality (language, preferences)
• Server logs: IP address, timestamp, request type

4. Legal Basis

• Execution of a contract: Tour/rental bookings (Art. 6(1)(b) GDPR)
• Legitimate interest: Analytics, site improvement (Art. 6(1)(f) GDPR)
• Consent: Marketing, non-essential cookies (Art. 6(1)(a) GDPR)

5. Purposes of Processing

• Management of bookings and tours
• Service communications
• User behavior analysis (Google Analytics)
• Improvement of user experience
• Compliance with legal obligations (invoicing, etc.)

6. Recipients of Personal Data

Your data may be shared with third parties exclusively for the purposes indicated and under the control of the Data Controller:

• Internal staff and collaborators: Authorized occasional collaborators (e.g., bike tour guides).
• Consultants and legal obligations: Accountant and electronic invoicing platforms for tax compliance.
• IT and Marketing Providers: Artificial intelligence tools for operational management and Social Networks (e.g., Meta, Google) for targeted advertising campaigns, managed directly and exclusively by the Data Controller.

7. Retention Period

• Tax and billing data: 10 years (accounting obligations).
• Analytics Data: 14 months (Google Analytics setting).
• Cookies: According to the methods indicated in the Cookie Policy.
• Server logs: 30 days.

8. Automated Processes and Minors' Data

No invasive profiling: We do not adopt automated decision-making processes that produce legal effects for the user. The use of AI and social platforms is limited to organizational optimization and the normal promotion of services.

Minors: By organizing bicycle tours, we may process the data of minors (e.g., age for bike sizing). This processing takes place exclusively through the consent provided by the parent or legal guardian during booking.

9. Your Rights

You have the right to:

• Access (Art. 15 GDPR): Request a copy of your data.
• Rectification (Art. 16): Correct inaccurate data.
• Erasure (Art. 17): Request deletion ("right to be forgotten").
• Restriction (Art. 18): Restrict processing.
• Portability (Art. 20): Receive data in a structured format.
• Objection (Art. 21): Object to processing.
• Complaint: Lodge a complaint with the Data Protection Authority.

Requests: info@ormebikexperience.com

10. International Transfers

Google Analytics and social/AI platforms transfer data to the USA under Standard Contractual Clauses (SCC) or Data Privacy Framework. You can opt-out of Google Analytics here.

11. Technical Infrastructure - Firebase Hosting

The site is hosted on Firebase Hosting (Google Cloud). This means that:

• Google acts as a Data Processor for technical data (IP address, server logs).
• Your access logs are kept for 30 days for security purposes.
• Firebase has a Data Processing Addendum (DPA) that ensures GDPR compliance.
• For more details: Google Cloud Data Processing Terms.

12. Contact

Data Controller: Sabatiello Carlo, VAT IT04471100984
Email: info@ormebikexperience.com