What we collect, why, and what you can ask us to do about it.
Last updated: October 2026
The data controller is AdventureLab S.r.l., Via Giulio Braga 98, 59100 Prato (PO), Italy — VAT no. 02410590976. For anything concerning your personal data, write to[email protected].
There is no account to create. Three forms ask for your email address, and each of them is a fair exchange we state upfront. If you buy a planning session or a ride plan, the section further down explains what that adds.
The GPX of a route. On every route page you can ask us to email you the GPX file. We send it to the address you give us, and that same address joins our mailing list — the two go together, and the tick box says so before you send anything. Alongside your email we store which route you asked for and its area, type and difficulty, so we know which corners of Tuscany people want to ride. Legal basis: your consent (Art. 6(1)(a) GDPR).
Bike rental and airport transfer requests. On theplan your trip page you can ask us for a bike or for a transfer from the airport. We process what you write (for a transfer: dates, flight or arrival time, pick-up and drop-off, number of riders and bikes) to find an option and to answer you, and your address joins the same mailing list. Legal basis: your consent (Art. 6(1)(a) GDPR). We share the details of your request only with the stays, bike shops or transfer services that could serve it.
Planning sessions and ride plans. When you buy a Ride Planning Session or a Bespoke Ride Plan we process your name, email, billing details and what you tell us about your trip, to book and run the call and to write your plan. Legal basis: the contract you ask us to perform (Art. 6(1)(b) GDPR); invoices are kept for the ten years required by Italian law (Art. 6(1)(c) GDPR). Payments are handled byStripe, which receives your card details directly: we never see them. The booking calendar and the video call run on third-party tools that act as our processors.
Leaving the list is one click. Every email we send carries an unsubscribe link, and you can also write to[email protected]. Withdrawing your consent stops the emails from that moment on and does not affect what was lawful beforehand — the file you already received stays yours.
Our mailing is handled by Brevo (Sendinblue SAS, France), which acts as our data processor and stores the data inside the European Union. We keep your contact until you unsubscribe.
If instead you simply email us, we process your address and the content of your message for the sole purpose of replying — legal basis: our legitimate interest in answering someone who contacted us (Art. 6(1)(f) GDPR). We keep that correspondence only as long as it is useful for the exchange.
Technical logs. The site is served by Cloudflare Pages. Like any web server, the infrastructure processes your IP address, the requested page, the time of the request, your browser and operating system. This is necessary to deliver the pages and to protect the site from abuse (Art. 6(1)(f) GDPR). Cloudflare acts as our data processor.
Google Analytics 4 — only if you accept. We use GA4 to understand how many people reach the site and which pages they read. It is loaded through Cloudflare Zaraz, our consent tool, with every storage category denied by default: until you pressAccept on the banner, no analytics cookie is written and no measurement identifier is stored on your device. The legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time — see thecookie policy. We do not use GA4 for advertising or profiling: ad storage, ad user data and ad personalisation are all left denied.
Google Ireland Limited acts as our data processor for GA4. Analytics data may be transferred outside the European Economic Area under the safeguards described in Google's own privacy documentation. GA4 data is retained for the period configured in the property, never longer than the 14 months GA4 allows.
Forms protected from bots. Our forms useCloudflare Turnstile, which checks signals from your browser to tell people from bots before a request is accepted (Art. 6(1)(f) GDPR, our legitimate interest in keeping the forms from being abused).
Route maps load their background tiles from CARTO; the booking maps come fromStay22 and the Monte Calvi trail map fromTrailforks; the route previews on stay and territory pages are images served by Ride with GPS. To show them, your browser connects to those services, which see your IP address. Some accommodation links are affiliate links — we explain exactly which ones, and why, in how we earn.
Once you follow one of those links you are on someone else's site, and their privacy policy applies — not ours. We do not receive your personal data back from them: what reaches us is, at most, aggregate commission reporting with no information that identifies you.
Under Articles 15 to 22 GDPR you may ask us for access to your personal data, and for its rectification or erasure; you may ask us to restrict or object to a processing operation; and you may ask for your data in a portable format. Where processing rests on your consent, you can withdraw it at any time without affecting what was lawful beforehand.
Write to [email protected] and we will reply within one month. In practice, since we hold almost nothing about you, most requests are answered in a line or two. If you believe your data has been mishandled you also have the right to lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the country where you live.
If this notice changes we update the date at the top of the page. Should a change affect a processing operation that rests on your consent, we will ask for that consent again.
