Privacy Policy
How we protect your personal data in accordance with GDPR
1. General Information
This Privacy Policy describes how we collect, use, and protect the personal data of users of the website www.ormebikexperience.com. Compliance with Regulation (EU) 2016/679 (GDPR) is our priority.
2. Data Controller
Sabatiello Carlo
Orme Bike Experience
VAT IT04471100984
Email: carlo@ormebikexperience.com
We have not appointed a Data Protection Officer (DPO): appointment is not mandatory under Art. 37 GDPR, as our activities do not involve regular and systematic large-scale monitoring of data subjects, nor large-scale processing of special categories of data.
3. Collected Data
Data provided voluntarily: Name, email, phone number, and messages sent via WhatsApp or contact form for bookings. Legal basis: performance of pre-contractual measures requested by you or of the rental/experience contract (Art. 6(1)(b) GDPR).
Data collected automatically: Google Analytics (GA4) for anonymous statistics (with IP anonymization active), server logs for security, and session cookies. We also collect page performance measurements (loading and response times, including which element or script was slowest): these concern how the site behaves, not you as a person. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time — see the Cookie Policy.
4. Recipients and Transfer of Data
Your data is processed by providers acting as data processors on our behalf: Google Ireland Limited (Google Analytics, Google Workspace) and Google LLC (Firebase Hosting), for website hosting, email management and anonymous statistics. These providers may also process data in the United States: the transfer is covered by the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission with its decision of 10 July 2023, where the provider adheres to it — check the current certification status on the official registry (dataprivacyframework.gov). We do not sell or share your data with third parties for marketing purposes.
5. Data Retention Period
We keep contact and booking data for as long as necessary to handle your request and, if a rental or experience contract is concluded, for the duration of the relationship and afterwards for 10 years, in accordance with administrative and accounting record-keeping obligations (Art. 2220 of the Italian Civil Code) and the ordinary statute-of-limitations period (Art. 2946 of the Italian Civil Code). Google Analytics data is retained as described in the Cookie Policy.
6. Your Rights
You have the right to access, rectify, or delete your data, to restrict its processing, to object to processing, and to data portability. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To exercise your rights, write to: carlo@ormebikexperience.com
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) — Piazza Venezia 11, 00187 Rome, Italy, email garante@gpdp.it, website www.garanteprivacy.it — if you believe that the processing of your data infringes Regulation (EU) 2016/679.