Privacy policy

Last updated: 29 October 2026

Data controller

GoBike Sas di Dekoven Andrea & C. (Garda Bike Shop), Viale Rovereto 1A, 38066 Riva del Garda (TN), Italy, VAT no. and tax code 02200020226. Email: store@gardabikeshop.com, phone +39 0464 567011.

What data we process

Online rental booking data: name, email, phone, language, dates, bikes and sizes, extras, amounts, payment status and Stripe transaction reference. You enter your card details directly on Stripe's payment page: we never see or store them.
Self-guided tour GPX purchase data, when tracks are on sale: name, email, language, tour purchased, amount, payment status and number of file downloads.
Data you send through the request form: name, email, phone if provided, request type, number of people and your message.
Data you send by email or phone when you contact us directly.
Technical browsing data (IP address, browser type, pages requested) logged by the hosting provider for security and operation of the site.

Purposes and legal basis

Handling online rental bookings: payment, confirmation email, pickup and return of the bike. This is performance of the rental contract (Art. 6(1)(b) GDPR).
Selling GPX tracks and sending you the download link: performance of the contract (Art. 6(1)(b) GDPR).
Answering requests and handling workshop and tour bookings: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR).
After you return the bike, one email (and at most one reminder) asking for a review: our legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by replying to the email.
Security and operation of the site: our legitimate interest (Art. 6(1)(f) GDPR).
Legal obligations, e.g. tax and accounting for paid rentals (Art. 6(1)(c) GDPR).

We do not use your data for newsletters or profiling and we do not sell it.

Recipients

We use these providers, who process data on our behalf or, for payments, under the rules for payment services:

Netlify, Inc. (United States): website hosting, the functions that handle bookings and payments, and request form submissions.
Stripe Payments Europe, Ltd. (Ireland) and Stripe group companies: card, Apple Pay and Google Pay payments and fraud prevention.
Turso (ChiselStrike, Inc., United States): the database where bookings and purchases are stored.
Resend (Plus Five Five, Inc., United States): sending confirmation and service emails.

Where data is processed outside the European Union, transfers rely on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. Data may be seen by shop staff who handle rentals and requests and, if needed, by our tax adviser.

Retention

Bookings that were never paid (expired, cancelled or with an unfinished payment) and unpaid GPX track purchases are deleted automatically 12 months after they were created. Requests sent through the form that do not lead to a service are deleted within 12 months. Data on paid rentals and other contracts is kept for as long as tax and accounting obligations require (usually 10 years). Technical logs are kept by the hosting provider for short periods.

Your rights

You can request access, rectification, erasure, restriction, portability and object to processing (Arts. 15-22 GDPR) at any time by writing to store@gardabikeshop.com. You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Required data

To book online we need your name, email and phone number: without them we cannot confirm the rental or contact you. In the request form, name, email and message are needed to reply; the other fields are optional.

Cookies

For cookies and the map, see the cookie policy.