Privacy Policy

Last Updated: 22 November 2025

This Privacy Policy explains how Avalanche Algarve (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you use our website avalanchealgarve.com and our services, including bike rentals, guided tours, delivery services, and customer support.

Avalanche Algarve is committed to complying with:

Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
Portuguese Data Protection Law (Law no. 58/2019)
Applicable EU ePrivacy and cookie regulations

By using our website or booking our services, you acknowledge that you have read and understood this Privacy Policy.

1. Data Controller

Avalanche Algarve
Rua 5 de Outubro lt1
8150-114 São Brás de Alportel
Algarve, Portugal

Phone: +351 963 415 122
Email: avalanche.bikeshop@gmail.com

We operate as the primary Data Controller for all customer personal data.

2. Types of Data We Collect

We collect the following categories of personal data:

A. Information Provided Directly by You

Collected when you complete a booking, contact us, or interact with our services.

Full name
Email address
Phone number
Delivery / pickup address
Booking details (bike model, size, dates, duration, accessories)
Messages sent through forms, email, or WhatsApp

B. Automatically Collected Website Data

Collected via analytics tools, cookies, and server logs.

IP address
Browser type and device information
Operating system
Pages visited and interaction data
Referrer URL
Session identifiers and cookie identifiers

C. Booking or Payment Platform Data

If bookings are made through WhatsApp, Google Maps, social media, or third-party tools, those platforms may also collect and process your data under their own privacy policies.

D. Communication Data

We also process data when you contact us via:

Email
WhatsApp
Telephone
Contact forms on the website

This data is retained for customer support, service confirmation, and legal compliance.

3. Purposes of Processing

We process personal data for the following purposes:

Service Delivery

Processing bike rental bookings
Delivering and collecting bikes
Providing guided tours
Scheduling and performing repair or service jobs
Sending booking confirmations and updates

Customer Support

Responding to questions and requests
Providing technical or mechanical assistance
Handling complaints or incident reports

Website Functionality & Analytics

Improving user experience and navigation
Monitoring website performance and security
Analysing aggregated visitor behaviour

Business Administration

Accounting and invoicing
Tax and legal compliance
Fraud and misuse prevention

Marketing (Only If You Consent)

Sending email updates or offers
Running remarketing or advertising campaigns (if implemented in future)

4. Lawful Basis for Processing (GDPR)

We process personal data based on the following lawful bases under Article 6 GDPR:

Purpose	Lawful Basis
Booking and service delivery	Contractual necessity (Art. 6(1)(b))
Customer communication and support	Legitimate interest (Art. 6(1)(f))
Website analytics and improvement	Legitimate interest (Art. 6(1)(f))
Email marketing	Consent (Art. 6(1)(a))
Accounting, tax and legal obligations	Legal obligation (Art. 6(1)(c))

5. Data Retention Periods

We store personal data only for as long as necessary for the purposes described in this policy or as required by law.

Data Category	Retention Period
Booking and service information	Up to 3 years after the last interaction
Accounting and invoice data	7 years (legal requirement)
Contact form and email communications	Up to 12 months after resolution
Analytics and technical logs	Up to 26 months (or anonymised)
Email marketing data	Until you withdraw consent or unsubscribe
Incident or damage reports	Up to 5 years, depending on legal risk

After these retention periods, personal data is securely deleted or anonymised.

6. Data Sharing and Third Parties

We do not sell or trade your personal data. We may share data with carefully selected third parties only when necessary.

A. Service Providers (Processors)

We may share data with:

Delivery staff and mechanics fulfilling bookings
Website hosting and maintenance providers
Analytics providers such as Google Analytics
Email and communication services
Payment processors or invoicing tools (if applicable)

All such providers operate under agreements that comply with GDPR requirements and only process data under our instructions.

B. Third-Party Platforms

If you interact with us via third-party platforms (such as WhatsApp, Google Maps, Facebook, Instagram or others), those platforms may process your data in accordance with their own privacy policies.

C. Legal and Regulatory Authorities

We may disclose personal data where required to do so by law or in response to valid requests by public authorities (e.g., courts, police, data protection authorities).

7. International Data Transfers

Some of our service providers or tools (for example, Google or Meta) may process personal data outside the European Economic Area (EEA).

Where such transfers occur, we ensure that:

The country has an EU adequacy decision; or
Standard Contractual Clauses (SCCs) or equivalent safeguards are in place; and
Additional technical and organisational security measures are applied where appropriate.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to make the site work, improve performance and analyse usage.

Types of Cookies We Use

Strictly Necessary Cookies – required for basic website functionality and security.
Analytics Cookies – used to understand how visitors use the site (e.g., Google Analytics with IP anonymisation).
Functional Cookies – remember preferences and improve user experience.
Marketing Cookies – only used if enabled in future and only with your consent.

You can manage or disable cookies via your browser settings. Disabling certain cookies may affect site functionality.

9. Your Rights Under GDPR

As a data subject within the EU/EEA, you have the following rights:

Right of Access – to obtain confirmation whether we process your data and receive a copy.
Right to Rectification – to correct inaccurate or incomplete data.
Right to Erasure – to request deletion of your data in certain circumstances.
Right to Restriction – to limit processing under specific conditions.
Right to Object – to object to processing based on legitimate interests or direct marketing.
Right to Data Portability – to receive data in a structured, commonly used, machine-readable format.
Right to Withdraw Consent – where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at:

Email: avalanche.bikeshop@gmail.com

You also have the right to lodge a complaint with your local data protection authority. In Portugal, this is:

Comissão Nacional de Proteção de Dados (CNPD)
Website: https://www.cnpd.pt

10. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

Use of HTTPS (TLS encryption)
Secure hosting with regular updates and security patches
Limited access to personal data on a need-to-know basis
Use of strong authentication practices
Regular monitoring for suspicious activity

However, no system is completely secure. We cannot guarantee absolute security of data transmitted via the internet.

11. Children’s Data

Our services are not directed at children under 16 years old. We do not knowingly collect personal data from children under 16.

If you believe that a child under 16 has provided us with personal data, please contact us and we will delete such data promptly.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements or services.

Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this page regularly.

14. Contact Information

If you have any questions, requests, or concerns regarding this Privacy Policy or our data practices, you can contact us at: