Privacy & cookies
Last updated: 23 October 2026
This notice explains how Terreno Cycling Therapy ETS processes the personal data of people who visit terrenocyclingtherapy.com and use its forms, under Regulation (EU) 2016/679 ("GDPR") and the Italian Privacy Code (Legislative Decree 196/2003). The Italian version prevails.
1. Data controller
Terreno Cycling Therapy ETS, Via Capruzzi, 270/B, 70124 Bari, Italy — Tax code 93554380720
Email: info@terrenocyclingtherapy.com
The association is not required to appoint a Data Protection Officer: please send any request to the address above.
2. What data we process, why and for how long
| Activity | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Browsing the site | IP address, date and time, requested page, browser (server logs) | Running and securing the site — legitimate interest (Art. 6.1.f) | As long as set by the hosting provider for security purposes, then automatically deleted |
| Membership request | Name, email, phone (optional), message | Contacting you and completing your membership — pre-contractual steps at your request (Art. 6.1.b) | 12 months if membership is not completed; if you become a member, for the duration of membership and then as required by law for the association's records and accounts |
| Event registration (via the link given for each event, usually the association's Google Forms form; until 23/10/2026 also a form on this site). If the link leads to another organiser's service, their terms also apply | Full name; email, phone and notes if provided | Organising the event, managing attendance and telling you about any changes — performing your request (Art. 6.1.b) | 24 months from registration (organisational and insurance needs), then deleted |
| "Women on bikes" programme | Name, email, phone and city (optional), self-assessed starting level, bike availability, notes | Contacting you and placing you in the right group — performing your request (Art. 6.1.b) | 24 months from the last contact |
| TANDEM newsletter | Sending you the newsletter — consent (Art. 6.1.a), which you can withdraw at any time via the link in every email | Until you unsubscribe | |
| Team profile (internal form) | Name, email, role, description, photo, LinkedIn profile (optional) | Publishing your profile in "Our team" — consent (Art. 6.1.a). Your email is never published | Until consent is withdrawn or the collaboration ends |
| Emails and messages you send us | The data you choose to send | Replying to you — your request / legitimate interest (Art. 6.1.b and f) | As long as needed to handle the request |
| Form security | IP address and browser linked to a form submission | Preventing spam and abuse — legitimate interest (Art. 6.1.f) | 12 months, then automatically deleted |
Required fields are marked in each form: without them we cannot handle your request. We do not profile users or take automated decisions.
3. Photos and videos at events
During rides and events we may take photos and videos to publish on this site and our social channels. If you do not want to appear, tell the organisers and we will avoid filming you. If you recognise yourself in a published image and want it removed, write to us and we will take it down. Recognisable images of minors are published only with the consent of their parents or guardians.
4. Who receives the data
Data is handled by board members and authorised volunteers, and is never sold or shared for commercial purposes. We use these providers, acting as processors or as independent controllers for their own services:
- SeoHost (Poland, EU) — website and database hosting;
- Google (Google Workspace, including Google Forms) — the association's email, where form notifications are delivered, and event registration forms. We use the Google Workspace account registered to the association, not personal accounts: for these services Google acts as a processor (Art. 28 GDPR) under the Google Workspace data processing agreement (Cloud Data Processing Addendum). It processes data only on our instructions, does not use it for advertising or profiling, and protects it with certified security measures (ISO/IEC 27001 and 27018). Registrations collected with Google Forms are therefore handled in compliance with the GDPR, for the same purposes and retention periods listed above;
- Substack Inc. (USA) — newsletter platform: your email is sent to Substack only if you subscribe, and is also processed under Substack's privacy policy.
5. Transfers outside the EU
For the newsletter (Substack) and, in some cases, email and registration forms (Google), data may be transferred to the United States, on the basis of the safeguards in Arts. 45-46 GDPR (EU-US Data Privacy Framework adequacy decision for certified providers, or the European Commission's Standard Contractual Clauses).
6. Cookies and tracking
This site does not use cookies — neither technical nor profiling ones — nor analytics, pixels or any other tracking tools. That is why there is no cookie banner.
Fonts, newsletter cover images and event posters are also served directly from our server: while browsing, your browser does not contact third-party services. Event posters and texts are fetched by our server from Terreno's Instagram profile; no data about site visitors is sent to Meta in the process. Links to our social profiles (Instagram, Facebook, LinkedIn) and to partner websites are plain links: if you follow them, those sites' policies apply.
7. Security
The site is served only over an encrypted connection (HTTPS). Form data is stored in a protected database and in archives that are not reachable from the web; photos sent for the team page are not public until we publish them. To report a vulnerability, see security.txt.
8. Your rights
At any time you can ask us for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR). Where processing is based on consent, you can withdraw it at any time without affecting prior processing. Just write to info@terrenocyclingtherapy.com: we reply within one month.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of your EU country.
9. Minors
The forms on this site are intended for adults. For children under 14, requests must be sent by a parent or guardian.
10. Changes
We may update this notice if the site's services change: the date at the top shows the version in force.