Skip to main content

Privacy Policy. Effective from 28 October 2026

Privacy Policy. Effective from 28 October 2026

This is an English translation provided for convenience. In case of any discrepancy, the Italian version prevails.

INTRODUCTION

This policy takes into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and of the Italian Privacy Code (Legislative Decree no. 196 of 30 June 2003). The document has also been drafted in accordance with the Guidelines of the Italian Data Protection Authority (in particular the anti-spam Guidelines issued by the Authority on 4 July 2013).

Data Controller: BSA Lab S.r.l, Via Enrico Fermi 92 - 95031 Adrano (CT) Italy, VAT no.: IT05579910877, Email: [email protected], Phone: +39 0959893143

Website to which this privacy policy refers: https://www.bikesportadventure.com/gb/ (Site).

The Data Controller has not appointed a DPO (Data Protection Officer). You may therefore send any request for information directly to the Data Controller.

GENERAL INFORMATION

This document describes how the Data Controller processes the personal data you provide on the Site.

The main processing activities of your personal data are described below. In particular, we explain the legal basis for the processing, whether providing the data is mandatory and the consequences of not providing personal data. To describe your rights as clearly as possible, where necessary we have specified whether and when a given processing of personal data is not carried out. On the Site you may enter personal data of third parties. In this case you guarantee that you have obtained the consent of these persons to enter their personal data. You therefore undertake to indemnify and hold the Data Controller harmless from any liability.

Registration on the Site

The information and data requested upon registration will be used to allow you to access the reserved area of the Site and to use the online services offered by the Data Controller to registered users. The legal basis for the processing is the need of the Data Controller to take pre-contractual steps at the request of the data subject. Providing the data is optional. However, if you refuse to provide the data you will not be able to register on the Site. It is also possible to register on the Site using external services. In this case your registration data will be shared with the companies providing these external services for the sole purpose of allowing registration on the Site. The legal basis for this processing is the legitimate interest of the Data Controller in allowing registration on the Site through external services. Providing personal data for this purpose is entirely optional. However, if you do not agree to the processing you will not be able to register through external services.

Purchases on the Site

Your personal data will be processed to allow you to make purchases on the Site. When an online purchase order is placed, the data are processed to allow the conclusion of the purchase contract and the correct performance of the related operations (and, where required by sector regulations, to comply with tax obligations). This processing of personal data also includes the possibility of sending communications (e.g. tracking, order information and requests to leave a review) through automated tools such as email and/or SMS and/or WhatsApp. The legal basis for the processing is the obligation of the Data Controller to perform the contract with the data subject or to comply with legal obligations. Regardless of the above (and therefore of your consent), the Data Controller may process your data for so-called "soft spam" purposes, governed by art. 130 of the Italian Privacy Code. This means that, limited to the email address you provided in the context of a purchase on the Site, the Data Controller will process that email address to send you direct offers of similar products/services, unless you object to such processing in the ways provided for in this policy. The legal basis for the processing is the legitimate interest of the Data Controller in sending this type of communication. This legitimate interest can be considered equivalent to the interest of the data subject in receiving "soft spam" communications. The Data Controller may send emails to remind the user to complete a purchase. The legal basis for this processing is the legitimate interest of the Data Controller in sending this type of communication. The Data Controller does not offer products or services prohibited to persons under 18. Consequently, no specific age verification system is in place, as there is no content subject to legal restrictions.

Responding to your requests

Your data will be processed to respond to your requests for information. Providing the data is optional, but if you refuse the Data Controller will not be able to answer your questions. The legal basis for the processing is the legitimate interest of the Data Controller in following up on user requests. This legitimate interest is equivalent to the interest of the user in receiving a reply to the communications sent to the Data Controller. The Data Controller may process your personal data to manage support tickets. The legal basis for the processing is the legitimate interest of the Data Controller in responding to the request of the data subject. This interest is equivalent to that of the data subject in receiving a reply. For this purpose personal data will be kept until the ticket has been handled. If you fill in the dedicated form on the Site, the Data Controller may use your personal data to handle the request for a quote and/or service. Providing the data is optional, but without them the Data Controller will not be able to process the request. The legal basis for the processing is the legitimate interest of the Data Controller in responding to requests sent by users, an interest that corresponds to that of the user in receiving a reply. The Data Controller may also process personal data to manage support requests (tickets). In this case too, the legal basis is the legitimate interest of the Data Controller in providing feedback, in line with the interest of the user in receiving support.

General marketing

Subject to your consent, the Data Controller may process the personal data you provide in order to send you advertising material and/or newsletters relating to its own products or those of third parties. The legal basis for this processing is your consent. Providing personal data for this purpose is entirely optional. If you do not consent to the processing of data for marketing purposes, you will not receive advertising material relating to products/services of the Data Controller and/or third parties, and the Data Controller will not be able to carry out market research, including research aimed at assessing user satisfaction, or send you newsletters. These communications will be sent to the email address and/or telephone number you provided on the Site (in the latter case also via SMS and/or WhatsApp). We use Google services, such as Google Ads and Google Analytics, to personalise advertisements and improve the user experience. This includes the collection of personal data and cookies, used to show you ads in line with your preferences. When giving consent, you will be asked to authorise the use of these data. More details on the use of cookies and consent management are available in the cookie policy of this website. The communications sent by email by the Data Controller contain tracking tools (so-called tracking pixels and tracked links) that record the opening of the message, the date, time and number of openings, the device and email client used, the IP address and clicks on the content, in order to measure the effectiveness of the communications and improve their content and frequency. The legal basis is your consent, pursuant to art. 122 of Legislative Decree 196/2003 and art. 6(1)(a) of the GDPR, as clarified by the Italian Data Protection Authority in decision no. 284 of 17 April 2026. Consent to tracking may be given together with consent to receive the communications and is optional and independent of the latter: you may withdraw it at any time, while continuing to receive the communications, through the link at the bottom of each message or by writing to the email address of the Data Controller indicated in this policy. After withdrawal, communications will be sent to you without tracking pixels and tracked links. Data relating to openings and clicks are processed on behalf of the Data Controller by the provider of the sending platform, appointed as data processor pursuant to art. 28 of the GDPR.

Profiling

Subject to your consent, the Data Controller may process your personal data for profiling purposes, i.e. to analyse your consumer choices by identifying the type and frequency of your purchases, in order to send you advertising material and/or newsletters relating to its own products or those of third parties that are of specific interest to you. The legal basis for this processing is your consent. Providing data for this purpose is entirely optional. If you do not consent to the processing of your personal data for profiling purposes, the Data Controller will not be able to build your commercial profile by recording your purchasing choices and habits, or send you advertising material relating to products of the Data Controller and/or third parties of specific interest to you. These communications will be sent to your email address and/or telephone number (in the latter case also via SMS and/or WhatsApp).

Transfer of data to third parties

For the sending of promotional communications, subject to your explicit consent, your personal data may be transferred to "third parties". The legal basis for the processing is your consent. Providing personal data for this purpose is entirely optional. If you do not consent, your personal data cannot be transferred to third parties for advertising purposes.

Geolocation

When accessing the Site you may receive a notification on your device (desktop and/or mobile) giving you the option to allow or not the identification of the device (so-called geolocation). You may freely allow or refuse this setting without this substantially affecting the functionality of the Site. You may change the geolocation settings at any time through your device settings. The legal basis for the processing is the legitimate interest of the Data Controller in providing services relevant to the user's location. This legitimate interest is equal to the user's interest in receiving services as relevant as possible to their location.

Curriculum Vitae

It is not possible to send a curriculum vitae through the Site. Therefore, your data will not be processed for this purpose.

Appointment booking

No third-party systems for booking appointments with the Data Controller are active on the Site. Therefore, your data will not be processed for this purpose. In any case, you can always contact the Data Controller using the contact details indicated above.

Photographs and videos

The Data Controller does not request the publication of photographs and/or videos portraying you. Therefore, your data will not be processed for this purpose.

Web scraping

The use of any automated process or system to access, acquire, copy or monitor any part of our website, including but not limited to web scraping, crawling or spidering techniques, is expressly prohibited. The Data Controller reserves the right to take all necessary measures, including legal action, to prevent and prosecute any unauthorised scraping activity. By using the Site, the user or any third party undertakes not to: (i) use automated systems, such as bots, scrapers or spiders, to access or interact with the Site; (ii) collect content, data or other information on the Site without explicit written authorisation; (iii) distribute, display, publish or otherwise use content acquired through scraping techniques without consent. Any breach of this clause will be considered a material breach of the terms of use of the Site and will result in appropriate measures, including the possible suspension of access to the site and legal action to protect the interests of the Data Controller.

Disclosure of personal data

In the course of its ordinary business, the Data Controller may disclose your personal data to certain categories of recipients. In article 2 you can find the list of recipients to whom the Data Controller discloses your personal data. To help protect your rights, article 2 may specify in some cases when your data are not disclosed to third parties.

The "disclosure" of personal data to third parties is different from the "transfer" described in the previous section. In a disclosure, the third party receiving the data may use it only for the specific purposes described in its relationship with the Data Controller. In a transfer, the third party becomes an independent controller of the personal data. Moreover, your consent is always required to transfer your personal data to third parties.

Without prejudice to the above, the Data Controller may in any case use your personal data to comply with the obligations laid down by the laws in force.

SPECIFIC PRIVACY POLICY

Art. 1 Processing methods

1.1 Your personal data will be processed mainly by electronic or otherwise automated means, in ways and with tools suitable to guarantee the security and confidentiality of personal data. Where an automated chatbot service is active, the user's personal data will be processed in order to provide the automated support and interaction service, to manage and respond to requests sent by the user, and to facilitate contact between the user and the Data Controller. The processing is carried out through automated tools that allow the user to interact with the Data Controller without immediate human intervention. The legal basis for the processing is the legitimate interest of the Data Controller in providing an efficient support channel and responding to user requests through the automated chatbot service, an interest that can be considered equivalent to and balanced with that of the data subject in using this service to obtain information or support.

1.2 The information acquired and the processing methods will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.

1.3 No "special categories of data" are processed through the Site. Special categories of data are those that may reveal racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, health and sex life.

1.4 No judicial data are processed through the Site.

Art. 2 Disclosure of personal data

The Data Controller may disclose your personal data to specific categories of recipients. The Data Controller wishes to inform users that, in connection with the use of the YouTube service (operated and owned by Google LLC), some personal data may be collected and shared. This data collection is essential to provide and improve the user experience on our Site and to allow viewing of video content embedded through the YouTube API. Specifically, when a user views video content through the YouTube API on our Site, the following information may be collected: IP address: used to connect the user's device to YouTube for video streaming. Behavioural data: information on how the user interacts with videos, which videos are viewed and for how long. Location information: used to provide relevant content based on the user's geographical location. These data are collected automatically by the system and, in some cases, may be retained to improve the user experience and for YouTube's internal analytics. Please note that our Site uses YouTube API services and, by viewing content through these APIs, the user accepts the YouTube Terms of Service available at https://www.youtube.com/t/terms. For further details on how Google LLC handles data, users are invited to consult the Google LLC privacy policy at http://www.google.com/policies/privacy and the YouTube policy at https://www.youtube.com/intl/ALL_it/howyoutubeworks/our-commitments/protecting-user-data/. Details on the use of user API data. User API data: when a user interacts with YouTube videos embedded in our Site, data such as viewing preferences, history of videos watched and interactions with video content (likes, comments, shares) may be collected. These data are made available through the YouTube API and help us understand how users interact with video content. Access to data through the API Client: our Site may use specific API calls to request and receive data from YouTube. This may happen when a user watches a video, with the system automatically recording the relevant information. Data collection: data are collected automatically by the YouTube system when users interact with YouTube videos on our Site. This process is essential to provide a smooth and personalised user experience. Data retention: the data collected are stored securely in YouTube's systems for a period not exceeding the need for their use. YouTube adopts all necessary security measures to protect these data from unauthorised access or unlawful use. Use of data: YouTube uses these data for several purposes, including: Internal analysis: to better understand user interactions with video content and improve the quality of YouTube services. Content personalisation: to offer users a more personalised experience, based on their preferences and interaction history. Improvement of the user experience: to identify and solve any technical problems and optimise the usability of video content. The recipients to whom the Data Controller reserves the right to disclose your data are listed below:

  • The Data Controller may disclose your personal data to all those entities (including Public Authorities) that have access to personal data by virtue of regulatory or administrative measures.
  • Your personal data may also be disclosed to all those public and/or private entities, natural and/or legal persons (legal, administrative and tax advisers, Judicial Offices, Chambers of Commerce, Labour Offices, etc.), where the disclosure is necessary or functional to the correct fulfilment of legal obligations.
  • The Data Controller makes use of employees and/or collaborators in any capacity. For the correct operation of the Site, the Data Controller may disclose your personal data to these employees and/or collaborators.
  • In the ordinary management of the Site, the Data Controller makes use of companies, consultants or professionals responsible for the installation, maintenance, updating and, in general, management of the hardware and software of the Data Controller or used by it to provide its services. Therefore, solely for these purposes, your data may also be processed by these parties.
  • To send its communications, the Data Controller makes use of external companies responsible for sending this type of communication (CRM platforms). Your personal data (in particular your email address) may therefore be disclosed to these companies.
  • For customer support purposes, the Data Controller makes use of one or more companies providing customer care services. Solely for this purpose, your personal data may be disclosed to these companies.
  • The Data Controller makes use of banks and companies that manage national and international payment circuits for the online payment of products and services purchased through the Site.
  • The buyer's personal data may be disclosed to post offices, couriers or forwarders responsible for delivering the Products purchased through the Site.
  • The Data Controller may disclose your personal data to providers of generative artificial intelligence technology used for the operation and automated processing of chatbot replies.

The Data Controller reserves the right to modify the above list according to its ordinary operations. You are therefore invited to consult this policy regularly to check to which recipients the Data Controller discloses your personal data.

Art. 3 Retention of personal data

3.1 This article describes for how long the Data Controller reserves the right to retain your personal data.

  • Your personal data will be retained only for the time necessary to guarantee the correct provision of the services offered through the Site.
  • For the purpose of performing the sales contract, data will be retained for 10 years from the date of receipt of the purchase order. This allows the Data Controller to exercise its right of defence and to demonstrate that it has correctly performed the contract.
  • For customer care purposes, data will be deleted once the support service has been completed and, in any case, within a maximum of 3 months from the last email exchange with the data subject.
  • As provided for by article 2220 of the Italian Civil Code, invoices, as well as all accounting records in general, are kept for a minimum period of ten years from the date of registration, so that they can be presented in the event of an inspection.
  • Through the Site (or by making a request to the Data Controller) the user account can be deleted. In this case all the personal data retained will be deleted and will not be kept by the Data Controller for any purpose.
  • For marketing purposes, unless consent is withdrawn earlier, data are retained for 24 months from when they were provided. After consent is withdrawn or at the end of the 24-month period, personal data will be deleted and no longer used for marketing purposes.
  • For "profiled" marketing purposes, unless consent is withdrawn earlier, data are retained for 12 months from when they were provided. After consent is withdrawn or at the end of the 12-month period, personal data will be deleted and no longer used for this purpose.
  • Personal data provided through the quote request form will be retained for the time strictly necessary to respond to the request and, in any case, for no longer than 6 months from its receipt. After this period, the data will be deleted or anonymised, unless legal obligations require longer retention.
  • Your personal data processed in connection with the use of the artificial intelligence chatbot will be retained for the time strictly necessary to ensure the correct operation of the service and the management of requests made through the Site.
  • For marketing purposes, personal data will be retained until consent is withdrawn. For inactive users, personal data will be deleted one year after the last email they opened.

3.2 Without prejudice to article 3.1, the Data Controller may retain your personal data for the time required by specific regulations, as amended from time to time.

Art. 4 Transfer of personal data

4.1 The Data Controller is established in a country that offers an adequate level of protection from a regulatory point of view. Where your personal data are transferred to a non-EU country for which the European Commission has issued an adequacy decision, the transfer is in any case considered safe from a regulatory point of view. This article 4.1 indicates from time to time the countries to which your personal data may be transferred and for which the European Commission has issued an adequacy decision.

  • Your personal data may be transferred to the USA on the basis of the adequacy decision of the European Commission. With this decision the European Commission established that the USA offers protection of personal data comparable to that offered by the European Union.

4.2 Without prejudice to article 4.1, your data may also be transferred to non-EU countries for which the European Commission has not issued an adequacy decision. You are therefore invited to consult this article 4.2 regularly to find out to which of these countries your data may be transferred.

4.3 In this article the Data Controller indicates the countries to which it may specifically direct its activities. This may imply the application of the law of the country concerned, together with the law governing the relationship with the user as indicated in the Introduction.

  • At the user's request, the Data Controller will apply to the processing of personal data any more favourable rules provided by the user's national legislation.

Art. 5. Rights of the data subject

The Data Controller informs you that you have the right to:

  • ask the Data Controller for access to your personal data and their rectification or erasure, or the restriction of processing concerning you, or to object to their processing, as well as the right to data portability
  • withdraw your consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal
  • lodge a complaint with a supervisory authority.

The above rights may be exercised by sending an informal request to the contact details indicated in the Introduction.

Art. 6. Amendments and Miscellaneous

The Data Controller reserves the right to amend this policy at any time, giving appropriate notice to users of the Site and in any case guaranteeing adequate and similar protection of personal data. To see any changes, you are invited to consult this policy regularly. In the event of substantial changes to this privacy policy, the Data Controller may also notify them by email.