Privacy Policy

Last updated: 31 / 08 / 2026

This Privacy Policy describes how CO.RE S.R.L, as the Data Controller, collects and processes the personal data of users who visit and use the website www.ultimatebikeshop.it, in accordance with Regulation (EU) 2016/679 (“GDPR”) and the applicable Italian legislation on the protection of personal data.

1. Data Controller

The Data Controller of personal data is:

CO.RE. S.r.l
Registered office: Via per Gorra 16, 17024 Finale Ligure (Sv)
VAT Number / Tax Code: 01931660094
E-mail: ultimatefinaleligure@gmail.com
Certified E-mail (PEC): coreultimate@pec.it

For any request concerning the processing of personal data or the exercise of your rights, you may contact the Data Controller using the contact details provided above.

2. What personal data we collect

Different categories of personal data may be collected through the website, depending on the services used by the user.

In particular, the following data may be processed:

  • identification and contact details, such as first name, last name, e-mail address and telephone number;
  • information provided by the user through contact forms and information or booking requests;
  • data necessary to manage any orders and purchases made through the website;
  • information relating to requests made by the user and communications exchanged with the Data Controller;
  • technical data relating to browsing, necessary for the operation and security of the website;
  • information collected through cookies and other tracking technologies, as described in the relevant Cookie Policy.

The Data Controller does not require users to provide personal data belonging to special categories under Article 9 GDPR, unless this is necessary and provided for by the specific activity requested.

3. Purposes of processing

Personal data may be processed for the following purposes:

  • responding to requests submitted through the website;
  • managing requests for information, availability and bookings relating to bike rental, bike shuttle, tours, Academy, Dream Park and other services offered;
  • managing any orders, purchases and requests relating to products available through the website;
  • providing assistance and communicating with the user in relation to the services requested;
  • complying with obligations established by law, regulations or European legislation;
  • protecting the rights of the Data Controller and preventing or investigating any unlawful activities or misuse;
  • ensuring the proper operation, security and technical maintenance of the website;
  • carrying out statistical analyses of browsing activity, where applicable and in accordance with the preferences expressed by the user and the applicable legislation.

4. Legal basis for processing

The processing of personal data is based, depending on the specific purposes, on the following legal bases provided for by Article 6 GDPR:

  • performance of a contract or pre-contractual measures, when processing is necessary to manage a request, booking, order or service requested by the user;
  • compliance with a legal obligation, when processing is necessary to comply with obligations established by law;
  • legitimate interest of the Data Controller, for activities necessary to ensure website security, prevent misuse and protect its rights;
  • consent of the data subject, when required by law, for example for specific cookies or non-essential tracking technologies.

Where processing is based on consent, the user may withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

5. Processing methods

Personal data are processed using electronic means and, where necessary, paper-based methods, in accordance with the principles of fairness, lawfulness, transparency, data minimisation and security.

The Data Controller adopts appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, disclosure or unlawful use.

6. Data retention period

Personal data are retained for the period necessary to achieve the purposes for which they were collected.

In particular, data provided for information or contact requests are retained for the time necessary to handle the request and any subsequent relationship, unless further retention is required by law.

Data relating to orders, purchases and contractual relationships may be retained for the period required by applicable civil, tax and accounting regulations.

Data processed on the basis of consent are retained until consent is withdrawn, unless another legal basis allows for their continued retention.

7. Disclosure and recipients of personal data

Personal data may be processed, within the limits necessary for the purposes indicated, by parties that provide services to the Data Controller, including IT service providers, hosting providers, website maintenance providers, communication management services, payment services, technical service providers and other parties necessary for the management of activities requested by the user.

Depending on the circumstances, these parties may act as data processors pursuant to Article 28 GDPR or as independent data controllers.

Personal data are not disclosed indiscriminately.

8. Transfers of data to non-EU countries

If some of the service providers used by the Data Controller involve the transfer of personal data to countries outside the European Economic Area, such transfers will take place in compliance with the conditions set out in Articles 44 et seq. of the GDPR and, where necessary, on the basis of an adequacy decision, Standard Contractual Clauses or other safeguards provided for by applicable legislation.

9. Cookies and other tracking technologies

The website uses cookies and other tracking technologies, where applicable, to ensure the proper functioning of the website, improve the browsing experience and, where applicable, collect statistical information or carry out other activities.

For detailed information about the types of cookies used, their purposes, the parties involved and how to manage or change your preferences, please refer to the Cookie Policy.

Where required by law, non-essential tracking technologies are activated only after obtaining the user's consent.

10. Provision of personal data

The provision of personal data requested in the website forms may be necessary to process the user's request.

Failure to provide data marked as mandatory may prevent the Data Controller from responding to the request or providing the requested service.

The provision of data for purposes based on consent is optional, and failure to provide consent does not affect the possibility of using services for which processing is not necessary.

11. Data subject rights

Where provided for by applicable legislation, users have the right to:

  • obtain confirmation as to whether or not personal data concerning them are being processed;
  • obtain access to their personal data;
  • request the rectification of inaccurate data or the completion of incomplete data;
  • request the erasure of personal data in the cases provided for by law;
  • request the restriction of processing in the cases provided for by Article 18 GDPR;
  • object to the processing of personal data in the cases provided for by law;
  • receive their personal data in a structured, commonly used and machine-readable format, in the cases provided for by Article 20 GDPR;
  • withdraw previously given consent, where processing is based on consent.

To exercise your rights, you may contact the Data Controller using the contact details provided in this Privacy Policy.

12. Right to lodge a complaint

If the user believes that the processing of their personal data is carried out in violation of applicable legislation, they have the right to lodge a complaint with the competent supervisory authority.

For Italy, the supervisory authority is the Garante per la protezione dei dati personali.

13. Updates to this Privacy Policy

This Privacy Policy may be amended or updated from time to time, for example in the event of changes in legislation, the introduction of new services or changes to the way personal data are processed.

The updated version will be published on this page with the relevant update date.