Privacy policy

Last updated: June 2026

This Privacy Policy informs users ("Users") of this website ("Website") about the collection, processing and storage of their personal data ("Personal Data") carried out by the data controller ("Controller") in connection with the management of the Website.

This Privacy Policy has been prepared in accordance with Regulation (EU) No. 2016/679 (GDPR), the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018) and any other applicable legal provisions.

Users under the age of 16 cannot provide valid consent to the processing of personal data without the authorization of their parents or legal guardians.

1. Data Controller

The Data Controller is:
Lunar Sport S.r.l.
Via Gianfranco Miglio, 2 - 21045 Gazzada Schianno (VA), Italy
VAT No. 03030530129
E-mail: privacy@all4cycling.com

Personal Data is processed by personnel authorized by the Controller and by suppliers acting as Data Processors pursuant to Art. 28 GDPR. The updated list of Data Processors may be requested by writing to privacy@all4cycling.com.

2. Data collected and purposes of processing

Browsing data
The IT systems used to operate the Website automatically collect certain technical data whose transmission is implicit in the use of Internet communication protocols: IP addresses, domain names, URI addresses of the requested resources, time of the request, method and size of the server response, operating system and user IT environment. This data is not collected to be associated with identified data subjects and is used solely to obtain anonymous statistical information on the use of the Website and to check its correct operation. It may also be used to ascertain liability in the event of computer crimes. The legal basis is the Controller’s legitimate interest in the operation and security of the Website. Browsing data is stored for the time strictly necessary to ensure the operation, security and correct technical management of the Website, as well as for the possible ascertainment of liability in the event of unlawful IT activities, according to the technical and organizational timeframes defined by the Controller and by the infrastructure providers involved.

Data provided voluntarily
Voluntary contact with the Controller via e-mail or the contact form involves the acquisition of first name, last name, e-mail address, telephone number and any additional data included in the communication. This data is used exclusively to respond to the User’s request. The legal basis is the Controller’s legitimate interest in responding to communications received. Data voluntarily provided via e-mail, contact forms or other communications is stored for the time necessary to manage the User’s request and any subsequent obligations or protection needs of the Controller, according to criteria of proportionality and storage limitation.

Newsletter
The User may subscribe to the newsletter by providing their e-mail address. Processing is carried out on the basis of the User’s consent, which may be withdrawn at any time through the unsubscribe link included in each communication or by writing to privacy@all4cycling.com. Failure to provide consent has no consequences on the contractual relationship. The data processed for sending the newsletter is stored until the User withdraws consent or for as long as the processing remains necessary in relation to the purpose for which consent was collected, taking into account the procedures for managing and updating contact lists.

The newsletter delivery service is managed through Mailchimp (Intuit Inc.) as Data Processor.

E-Commerce
For the purchase of products through the Website, the following data is processed: first name, last name, residence, tax code and/or VAT number, telephone number, e-mail address, shipping and billing address, order description and purchased product, payment data managed directly by payment providers. The data is processed for the management of the pre-contractual and contractual relationship, for administrative, accounting and tax obligations, and for the management of disputes. The legal basis is the performance of the contract (Art. 6, par. 1, letter b GDPR) and compliance with legal obligations (Art. 6, par. 1, letter c GDPR). The data is stored for the entire duration of the contractual relationship and subsequently for 10 years in order to comply with legal tax and accounting obligations.

The Controller may use the e-mail address provided by the User when making a purchase to send commercial communications relating to products or services similar to those already purchased, pursuant to Art. 130, paragraph 4, Legislative Decree 196/2003. The User may refuse such use from the outset or object to it at any time by writing to privacy@all4cycling.com. The maximum duration of processing for this purpose is 36 months from the last purchase.

3. Cookies and tracking technologies

The Website uses cookies and similar tracking technologies to ensure the operation of the pages, analyze traffic and, subject to the User’s prior consent, deliver personalized advertising and non-personalized advertising, including remarketing on external platforms. Cookies and advertising identifiers are used for both personalized and non-personalized advertising.

Google LLC is among the technology partners that process data through cookies on the Website. For information on how Google uses personal data collected through advertising partner websites, please visit: business.safety.google/privacy/

For the complete list of cookies used, their purposes, duration and the parties placing them, please refer to our Cookie Policy.

4. Disclosure of data to third parties

The Controller discloses Personal Data to third parties exclusively within the limits necessary for the purposes described in this policy. In particular, data may be disclosed to:

Shopify Inc. - e-commerce platform, technical infrastructure of the Website
Google LLC - statistical analysis (Google Analytics), advertising campaigns (Google Ads), tag management (Google Tag Manager)
Meta Platforms Ireland Ltd. - advertising campaigns on Facebook and Instagram (Meta Pixel)
Couriers and shipping providers - for order delivery (first name, last name, shipping address, telephone number)
Payment providers (PayPal, Stripe, Shop Pay and others) - for transaction management
Trustpilot A/S - collection and display of reviews
Intuit Inc. (Mailchimp) - newsletter management
Judge.me - product reviews
ReturnGo Ltd. - returns management
RichPanel Inc. - customer support
Accountants, legal and tax consultants - for mandatory legal obligations
Judicial and public authorities - in the cases provided for by law

In all other cases, the disclosure of Personal Data to third parties is subject to the User’s prior express consent.

5. Data transfers to third countries

Some of the suppliers listed in the previous section, particularly Google LLC and Meta Platforms Ireland Ltd., may transfer or process personal data outside the European Economic Area, including the United States. In such cases, the transfer takes place in compliance with the safeguards provided for by Articles 44-49 of the GDPR, in particular on the basis of standard contractual clauses approved by the European Commission or adequacy decisions. For information on the specific safeguards adopted by each supplier, the User may consult the respective privacy policies or contact the Controller.

6. Users’ rights

Pursuant to Articles 15-22 of the GDPR, each User has the right to:

Access (Art. 15): obtain confirmation of the processing and a copy of the personal data processed
Rectification (Art. 16): obtain the updating, correction or integration of data
Erasure (Art. 17): obtain the deletion of data, in the cases provided for by law
Restriction (Art. 18): obtain the restriction of processing in the cases provided for
Portability (Art. 20): receive the data provided to the Controller in a structured and readable format
Objection (Art. 21): object to processing, particularly for direct marketing purposes
Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal
Not to be subject to automated decisions (Art. 22): not to be subject to decisions based solely on automated processing that produce significant legal effects

To exercise their rights, the User may contact the Controller by writing to: privacy@all4cycling.com

The Controller responds to requests within 30 days of receipt, unless extended in the cases provided for by the GDPR.

7. Right to lodge a complaint

The User has the right to lodge a complaint with the competent supervisory authority. In Italy, the competent authority is the Italian Data Protection Authority:

Website: www.garanteprivacy.it
E-mail: garante@gpdp.it
Certified e-mail (PEC): protocollo@pec.gpdp.it

Users residing in other European Union countries may contact the supervisory authority of their country of residence.

8. Updates

This Privacy Policy is subject to periodic updates in relation to the evolution of the Website, the services offered and the applicable legislation. In the event of substantial changes, Users will be informed through a specific notice on the Website. Users are advised to review it periodically. The updated version is always available at this address.