Data Processing Notice
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
1. Introduction
This notice describes how personal data of users of velunite.it and its related services (the “Platform”), operated by Velunite, is processed.
The Data Controller is Velunite, reachable at privacy@velunite.it.
2. Categories of Data Collected
2.1 Data provided by the user
- Registration data: name, email, password (bcrypt-hashed)
- Profile data: display name, biography, profile picture
- Generated content: cycling routes, chat messages, photos
- Optional social data: profile ID and name from Facebook, Instagram, TikTok
2.2 Data collected automatically
- GPS route traces (coordinates, elevation, speed)
- IP address and browsing data (browser, operating system)
- Access logs and activity on the Platform
- Technical cookies necessary for operation; analytics/marketing cookies only with consent
2.3 Data from third parties
- Data from social login (if used): name and email provided by the OAuth provider
3. Purposes and Legal Basis of Processing
| Purpose | Legal Basis | Mandatory |
|---|---|---|
| Registration and account management | Art. 6(1)(b) GDPR — Contract performance | Yes |
| Creating and managing routes | Art. 6(1)(b) GDPR — Contract performance | Yes |
| Joining rides and chat | Art. 6(1)(b) GDPR — Contract performance | Yes |
| Purchases (shop, ticketing, subscriptions) | Art. 6(1)(b) GDPR — Contract performance | Yes |
| Linking social accounts | Art. 6(1)(a) GDPR — Consent | No |
| Promotional communications | Art. 6(1)(a) GDPR — Consent | No |
| Service improvement | Art. 6(1)(f) GDPR — Legitimate interest | No |
| Security and fraud prevention | Art. 6(1)(f) GDPR — Legitimate interest | No |
| Tax and legal obligations | Art. 6(1)(c) GDPR — Legal obligation | Yes |
4. How Data Is Processed
Personal data is processed using IT and telematic tools, with logic strictly related to the stated purposes and in compliance with the principles of lawfulness, fairness and transparency. Security measures include:
- TLS/SSL encryption for data transmission
- bcrypt encryption for passwords
- Token-based (JWT) authentication with expiry
- Role-based access controls
- Regular, secure backups
- Firewalls and security monitoring
5. Retention Period
- Account data: until deletion is requested
- Routes and GPS traces: until deleted by the user
- Chat messages: 12 months from sending
- Uploaded photos: until deleted by the user
- System logs: 6 months
- Billing data: 10 years (statutory/tax obligations)
- Technical cookies: session duration or up to 12 months
6. Your Rights (Articles 15-22 GDPR)
You have the right to:
- Access (Art. 15): obtain information about processing and a copy of your data
- Rectification (Art. 16): correct or complete inaccurate data
- Erasure (Art. 17): obtain deletion (“right to be forgotten”)
- Restriction (Art. 18): restrict processing in specific cases
- Portability (Art. 20): receive your data in a structured, commonly used, machine-readable format
- Objection (Art. 21): object to processing for legitimate interest or direct marketing
- Withdraw consent (Art. 7(3)): withdraw consent at any time, without prejudice
To exercise these rights: privacy@velunite.it. We will respond within 30 days of your request.
7. Complaints to the Supervisory Authority
You have the right to lodge a complaint with the competent supervisory authority; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome), if you believe processing infringes the GDPR.
8. Transfers Outside the EU
Data is mainly processed within the European Economic Area (EEA). Where providers based outside the EU are used, transfers take place only where covered by an EU adequacy decision (Art. 45 GDPR) or appropriate safeguards such as Standard Contractual Clauses (Art. 46 GDPR).
9. Cookies
The Platform uses the following categories of cookies:
- Technical (necessary) cookies: essential for the Platform to function (authentication, language preference). No consent required
- Analytics and marketing cookies: installed only with explicit consent, collected via the dedicated banner
For the full list of cookies used, see our Cookie Policy.
10. Minors
The Platform is not directed at children under 16. We do not knowingly collect personal data from children under 16; if we become aware of having done so, we will delete it promptly.
11. Changes
We may update this notice. Changes will be published on this page with an updated date.
12. Contact
For any question about the processing of personal data: privacy@velunite.it