Privacy Policy

This policy explains how A.S.D. CIEMME processes the personal data of anyone who visits the Cycling Experience website, requests a quote or joins a guided bike experience. It is provided under Article 13 of Regulation (EU) 2016/679 (the "GDPR") and it is written to actually be read: if anything is unclear, write to us and we will explain it.

1. Data controller

The data controller, that is, the party who decides why and how your data is used, is:

• Name: A.S.D. CIEMME
• VAT number: 01535700551
• Tax code: 91069070554
• Registered office: Via Cavour 1, 05100 Terni, Italy
• Legal representative: Luca Moretti
• Email: info@cyclingexperience.it
• Telephone: +39 329 204 0821

2. Data protection officer

We have not appointed a Data Protection Officer (DPO) because the conditions set out in Article 37 of the GDPR do not apply: the association is neither a public authority nor a public body, it does not carry out activities requiring regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data on a large scale.

This does not mean there is nobody to talk to. The contact person for data protection matters is Luca Moretti, whom you can reach at info@cyclingexperience.it. This contact person does not have the duties and safeguards the GDPR reserves for a DPO: he is simply the person who receives your requests and answers them.

3. Data we collect

Data you provide directly

This is the data you enter in the quote request form, in your profile or in the messages you send us:

• To contact and identify you: first name and last name, email address, telephone number. If you create an account, any profile picture you upload is handled by our authentication provider.
• In your profile: the cycling ability level you declare, your bike size and the language you prefer to be contacted in.
• In the quote request: the type of group and the number of participants; how many minors are taking part and in which age bands (0-5, 6-10, 11 and over), because what kind of ride we can propose depends on it; the declared ability level, the languages spoken by the group, the area and the experience you are interested in, your preferred dates and time of day; which rental items you are interested in and how many of each (pedal bike, e-bike, child's bike, child seat, trailer and tag-along), bearing in mind that rental is a paid extra and is not included in any service level; and the free-text notes, that is, whatever you choose to tell us in the dedicated field.
• If you declare a partner arrangement: the name of the partner whose guest you are and the reference you give us as evidence, for instance a booking number, which we check before applying the dedicated discount.
• During and after the experience: the messages you send us from the members' area and the attachments you upload there, whether images or documents, and your review (star rating and text) if you choose to leave one once the experience is over.

Data collected automatically

When you visit the website, the systems that host it record some technical information: the IP address you connect from, the type of browser and device you use, and the pages you visit.

The statistics tool we have chosen does not use cookies, does not assign you a persistent identifier and does not build any profile: it tells us how many times a page has been viewed and which page visitors arrive from, not who viewed it. We do not cross-reference these statistics with the data of those who request a quote.

Payment data

Card payments are handled entirely by SumUp. Card details are entered on the provider's pages and never pass through our systems: A.S.D. CIEMME does not see and does not store your card number, expiry date or security code. For each payment we only keep the amount, the date, the outcome and the transaction identifier, which we need for our accounting and to assist you if something goes wrong.

Data we record ourselves

Besides what you provide, we keep some information that arises from your relationship with us:

• proof of your consents: which version of this policy and of the Terms of Service you accepted and on which date, and whether you gave or refused consent to marketing messages and to the publication of photos and videos. We need it to demonstrate, as Article 7 of the GDPR requires, what you actually agreed to;
• account data: the registration date and the technical identifier our authentication provider assigns to your account;
• the status of your requests: the quotes you have asked for, the proposals we have sent you, the extras you selected, your orders and the experiences you purchased, with the relevant amounts;
• internal notes: organisational notes we may write alongside your request or your order in order to prepare the experience. They are your personal data in every respect and fall within the right of access described in section 11;
• read receipts: the date and time you first open, in your members' area, the quote carrying our proposal, and a marker that a chat message has been read. We need them to know whether a message reached you, before calling you back or chasing a reply;
• the communications queue: every email the system has to send is first written into an internal list, together with your email address, your name, your telephone number and the data appearing in the message; in the internal notification of a new request, that data also includes the free-text notes you wrote to us. It exists so that no send is lost and so that we can tell what went wrong when an email fails to go out. The supplier that reads this list and sends the emails is named in the table under section 7.

The same records also hold information that concerns us rather than you, for instance the fees we pay the guides who lead the ride: that is not your personal data.

4. No special categories of data

We do not process health data, nor any of the other special categories of data listed in Article 9 of the GDPR.

In particular, the "level" we ask for in the quote form (beginner, intermediate, advanced) is a self-assessment of how used to cycling you are, not health information: it is only used to propose a route suited to how much you normally ride. We do not ask you for any health documentation, we do not put you through medical questionnaires and we do not record health conditions.

For the same reason we ask you not to put information about your health in the free-text notes field, in the messages you send us or in the attachments you upload: none of these are designed to hold it and we will not use them to process it.

5. Purposes, legal bases and retention periods

Every processing operation has a specific purpose, a legal basis that legitimises it and a retention period, after which the data is deleted or anonymised.

Where the same data serves several purposes with different periods, the longest period prevails: the data of an order, for instance, stays in our accounting records for ten years even if in the meantime you have asked to stop receiving marketing messages.

One clarification about reviews, because it is easy to assume the opposite: the review you leave us is not published. It stays visible to us and to you in your members' area, and we use it to understand how things went and to improve the service. The testimonials you see on the site's home page do not come from here: they are public reviews left on Google, where their authors wrote them. If one day we wanted to publish yours, we would ask you first, with a specific consent: until that consent exists, there is nothing we can publish. You can ask us to delete it at any time, and you can object to this processing as described in section 11.

6. Whether providing data is mandatory

Some data we simply cannot do without. Your name, email address and telephone number are necessary: without them we cannot prepare a quote, send it to you, or call you back to agree on the details of the experience. The data describing the ride (number of participants, preferred date and area) is equally necessary, because it is what makes the proposal meaningful. The data we collect for tax purposes is mandatory too, but in that case the obligation comes from the law, not from us.

Other data is optional: the free-text notes, the languages you speak, your bike size, the review you may leave once the experience is over, consent to receive marketing messages and consent to the publication of photos and videos. You may withhold it, and you may refuse the optional consents: doing so does not prevent you from requesting a quote, receiving a proposal and purchasing the experience. The only consequence is that you will not receive our marketing messages and we will not publish images featuring you.

The partner arrangement reference is a case of its own: declaring it is optional, but without it we cannot verify that you are entitled to the dedicated discount and therefore cannot apply it.

7. Recipients and data processors

To run the website and the service we rely on a number of external suppliers. Those who process personal data on our behalf are appointed as data processors under Article 28 of the GDPR and act only on our instructions.

The guides receive only the data needed to lead the experience they are assigned to: who is taking part, how many people there are, the date, the meeting point and the details needed to organise the ride. They do not receive payment data and do not use your data for their own purposes.

We may also disclose your data to the competent authorities where the law requires us to.

We do not sell your data and we do not share it with third parties for marketing purposes, whether for a fee or free of charge.

8. Transfers outside the European Union

Some of the suppliers listed above are based in the United States and may process data outside the European Economic Area. In those cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission in implementing decision (EU) 2021/914: they are the instrument provided for by Article 46 of the GDPR to guarantee your data a level of protection substantially equivalent to the European one even once it leaves the Union.

The clauses require assessing, case by case, whether the legal context of the destination country allows them to be complied with, and adopting any supplementary measures that may be needed. If you want to know more about these safeguards, or receive a copy of the clauses applied to a specific supplier, write to info@cyclingexperience.it.

The email service we use to send our messages is provided by an Italian company: for the sending of our communications there is therefore no transfer outside the European Union.

9. No automated decision-making

We do not take decisions concerning you based solely on automated processing, and we do not carry out profiling within the meaning of Article 22 of the GDPR. Every proposal you receive is written by a person who has read your request: the price, the route and the service level are not calculated by an algorithm that decides on our behalf.

10. Minors

The service is aimed at adults: to request a quote, accept a proposal and make a payment you must be at least 18 years old.

Minors may take part in the experiences when accompanied by an adult. In that case their data is provided to us by the responsible adult, who takes responsibility for it by declaring that they are entitled to share it, and it is processed solely to organise and lead the experience: we do not use it for marketing messages and we do not keep it beyond the periods set out in the table in section 5.

11. Your rights

The GDPR grants you a number of rights over your data. You can exercise all of them by writing to info@cyclingexperience.it, with no particular formality: we just need to understand who you are and what you are asking for.

• Access (Art. 15): to know whether we process data concerning you and obtain a copy of it, together with information on the purposes, the recipients and the retention periods.
• Rectification (Art. 16): to correct inaccurate data and complete incomplete data.
• Erasure (Art. 17): to have your data deleted, where no legal obligation or contractual need requires us to keep it.
• Restriction (Art. 18): to ask that your data be kept but not used, for instance while we check whether it is accurate.
• Portability (Art. 20): to receive, in a machine-readable format, the data you provided to us and that we process on the basis of consent or of the contract, and to have it transmitted to another controller.
• Objection (Art. 21): to object to processing based on our legitimate interest, explaining your particular situation.
• Withdrawal of consent (Art. 7.3): to withdraw at any time the optional consents you have given us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal: it takes effect from that moment onwards.

Response times. Article 12.3 of the GDPR gives us one month to respond to your request. That period may be extended by two further months where the request is particularly complex or where we are handling several requests at once: in that case we will tell you within the first month, explaining the reason for the delay.

Complaint to the supervisory authority. If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Garante per la protezione dei dati personali (the Italian data protection authority, www.garanteprivacy.it), or bring the matter before the courts. We would be glad to hear from you first, so we can try to settle the matter directly, but this is not a mandatory step: complaining is your right and you may exercise it whenever you wish.

12. Cookies

The website uses cookies and loads five components provided by third parties:

• the authentication service that manages access to your account (Clerk), present on every page, public pages included;
• the data store (Airtable), which receives your IP address because the site queries it straight from your browser, on the public pages too and without your having signed in: on the quote request form and on the detail pages of experiences and areas;
• the traffic statistics tool (Vercel), present on every page, which installs no cookies and does not profile you;
• the payment service (SumUp), which comes into play at checkout;
• the route map hosted by Strava, which appears in the detail view of a proposal in the members' area and loads only after you explicitly click on it.

Which cookies are used, who sets them, what they are for and how long they last is described in the Cookie Policy: it is a page of its own because that is where such detail belongs and is kept up to date.

13. Changes to this policy

This policy may change, for instance if the suppliers we use or the purposes for which we process data change. Every version is numbered and dated: the version number and the date of the latest update are shown at the top of this page, and previous versions remain tracked in the history of our source code.

Where the changes are substantial, that is, where they significantly alter how we process your data or the rights you can exercise, we notify registered users by email before they take effect. For minor changes, such as a clarification of wording, we simply update this page.