PRIVACY POLICY

Information provided pursuant to Article 13 of the EU Regulation 2016/679 (GDPR)

Dear User,

Welcome to the website www.romastarbike.com. We highly value your privacy and are committed to protecting your personal data. In accordance with the EU General Data Protection Regulation (GDPR) 2016/679, this Privacy Policy explains how we collect, use, and protect your personal data, based on the principles of lawfulness, fairness, transparency, and data minimization.

This privacy statement applies exclusively to the website www.romastarbike.com and does not apply to other external websites that you may access via links.

1. Data Controller

The Data Controller (the entity that decides how and why your personal data is processed) is:

Roma Star Bike S.R.L.

Registered office: Via dei S.S. Quattro, 58.

Email: info@romastarbike.com

VAT / P.IVA: 14686811002

2. Purposes of Processing and Legal Basis

Your personal data will be collected and processed for the following purposes:

A. Service and Contractual Purposes:

Fulfillment of pre-contractual and contractual obligations (e.g., processing tour bookings, purchases, or rentals).

Administrative, accounting, and fiscal obligations arising from the business relationship.

Customer service and technical support before and after sales.

Legal basis: Processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (Art. 6.1.b GDPR), and to comply with legal obligations (Art. 6.1.c GDPR).

B. Marketing Purposes (Subject to specific consent):

Sending newsletters, informative material, and promotional offers regarding our services and events.

Legal basis: Your explicit and freely given consent (Art. 6.1.a GDPR). You may withdraw this consent at any time.

C. Other Purposes:

Evaluation of job applications (recruiting and selection).

Managing specific user inquiries submitted through our contact forms or email.

Legal basis: Processing is necessary to take steps at the request of the data subject (Art. 6.1.b GDPR) or based on the legitimate interest of the Data Controller to respond to communications (Art. 6.1.f GDPR).

3. Optional vs. Mandatory Provision of Data

Providing your personal data for the Service and Contractual Purposes (Point 2.A) is mandatory. Without this data, it will be impossible for us to process your orders, confirm bookings, or fulfill legal obligations.

Providing your data for Marketing Purposes (Point 2.B) is entirely optional. If you decline, it will not affect your ability to purchase our services, but you will not receive our promotional communications.

4. Modalities of Processing and Security Measures

Your personal data is processed both in paper and electronic/automated formats. We have implemented appropriate physical, technical, and organizational security measures to prevent data loss, illicit or incorrect use, and unauthorized access.

5. Data Retention Period

We keep your personal data only for the time strictly necessary to achieve the purposes for which it was collected:

Contractual and Fiscal Data: Kept for 10 years as required by Italian law for accounting and tax purposes.

Marketing Data: Kept until you withdraw your consent (unsubscribe from the newsletter).

Recruitment Data: Kept for a maximum of 12 months from the submission of the application.

General Inquiries: Kept for the time necessary to resolve your request.

6. Access, Communication, and Transfer of Data

Your data will not be sold to third parties or disseminated globally. However, it may be shared with:

Internal employees and associates specifically authorized by the Data Controller.

External entities providing essential services strictly related to our business operations (e.g., IT and hosting providers, payment gateways, accounting firms, customer assistance). These entities act as designated Data Processors (Art. 28 GDPR).

Should your data be transferred outside the European Economic Area (EEA) (e.g., through the use of US-based email servers or marketing software), we ensure it is done in strict compliance with GDPR regulations, utilizing Standard Contractual Clauses or ensuring the destination country offers an adequate level of data protection.

7. User Rights

Under Articles 15 to 22 of the GDPR, you have the right at any time to:

Access your personal data and request a copy.

Rectify inaccurate or incomplete data.

Erase your data ("Right to be forgotten"), where applicable.

Restrict the processing of your data.

Data Portability: Receive your data in a structured, commonly used, and machine-readable format.

Object to the processing of your data for legitimate reasons, including direct marketing.

Withdraw your consent at any time (e.g., for newsletters), without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise these rights, you can send an email to the Data Controller at: info@romastarbike.com

Furthermore, if you believe your privacy rights have been violated, you have the right to lodge a complaint with the national supervisory authority (Garante per la Protezione dei Dati Personali in Italy).