Privacy Policy

Velunite is the Data Controller for the personal data collected through the velunite.it platform (the “Platform”).

For any privacy-related request: privacy@velunite.it

The Platform collects and processes the following categories of personal data:

• Registration data: name, email address, password (securely hashed)
• Profile data: display name, biography, profile picture
• User-generated content: routes created, rides joined, chat messages, photos
• GPS and activity data: route and activity traces (coordinates, elevation, speed), recorded in the app, imported from FIT/GPX/TCX files or synced from linked services
• Health data: heart rate and physiological data contained in imported or synced activities, processed only on the basis of your explicit consent (Art. 9.2.a GDPR), which you may withdraw at any time
• Linked accounts (optional): Facebook, Instagram, TikTok and sports services such as Garmin Connect, Wahoo and Hammerhead; from these we receive the activities you choose to sync
• Technical data: IP address, browser type, operating system, device identifiers
• Stretch leaderboard data (optional): gender and date of birth that you declare, and the private zones you set. Only you can see them: leaderboards show only name, avatar and times

Your data is processed for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): providing the Platform's services, including shop purchases, event ticketing and club subscriptions
• Consent (Art. 6(1)(a) GDPR): promotional communications, newsletters, non-essential cookies
• Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting and other statutory obligations
• Stretch leaderboards (art. 6.1.b and 6.1.a GDPR): calculating Personal best, Crown and Warden; gender and date of birth are used only for gender and age categories, based on your consent, which you can withdraw at any time by deleting the data from your profile

Data is processed using electronic and IT tools, in compliance with the security measures required by Regulation (EU) 2016/679 (GDPR). Processing is carried out using logic strictly related to the purposes stated above, to ensure the security and confidentiality of your data.

• Account data: retained until deletion is requested
• Routes and GPS traces: retained until deleted by the user
• Activities and sports data from linked devices: retained until deleted by the user or until the linked account is disconnected, if deletion of the synced data is also requested
• Chat messages: retained for 12 months from sending
• Access logs: retained for 6 months
• Purchase and billing data: retained for 10 years (statutory obligation)
• Stretch efforts: kept until the activity or account is deleted; gender, date of birth and private zones: until the user deletes them

Personal data may be shared with:

• Hosting and cloud infrastructure providers, located in the EU
• Payment service providers for shop, ticketing and subscription purchases
• Competent authorities, where required by law

Your data is never sold or shared with third parties for marketing purposes. Any transfer outside the EU takes place only through providers offering adequate safeguards under Art. 45-46 GDPR (e.g. an adequacy decision or Standard Contractual Clauses) — for example for optional social login or integrations with sports services such as Garmin Connect.

Under Articles 15-22 GDPR, you have the right to:

• Access (Art. 15): obtain confirmation of processing and a copy of your data
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): obtain deletion (“right to be forgotten”)
• Restriction (Art. 18): restrict processing in specific cases
• Portability (Art. 20): receive your data in a structured, machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)): withdraw consent at any time, without affecting prior processing

To exercise these rights, write to: privacy@velunite.it. We will respond within 30 days.

You have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement. In Italy, the competent authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

The Platform uses technical cookies necessary for its operation. Non-essential cookies (analytics or marketing) are installed only with your prior consent, requested via the banner shown on first visit. See our Cookie Policy and Data Processing Notice for details.

The Platform is not directed at children under 16. We do not knowingly collect personal data from children under 16; if we become aware of having done so, we will delete it promptly.

We may update this Privacy Policy from time to time. Changes will be published on this page with an updated date; in case of material changes, we will notify you through appropriate means (e.g. email or an in-app notice).

For any question about the processing of personal data: privacy@velunite.it