Controller
Gaugel Business Consulting S.L., trading as Epic Bike Trails
Avinguda d’Icària, 150, 4º 1ª, 08005 Barcelona, Spain
NIF: B63996938 · EU VAT: ESB63996938
Privacy contact: hello@updates.epicbiketrails.com
Data we process
Depending on your interaction with us, we may process your name, email address, telephone number, country, group size, travel dates, destination and trip preferences, riding and bicycle requirements, messages and correspondence. Our systems may also process IP addresses, device and security information, website usage information from analytics (enabled by default, with an opt-out available at any time), and booking, invoicing or payment-related records if you become a customer.
Please do not send medical information, identification documents, payment-card details or other sensitive information through a general enquiry form. If essential safety information is later required, we will request it through an appropriate process.
Purposes and legal bases
Enquiries and proposals
We use enquiry data to respond, assess suitable trip options, prepare a proposal and communicate about your request. The legal basis is taking steps at your request before a possible contract (Article 6(1)(b) GDPR).
Bookings and service delivery
If you proceed, we use necessary information to arrange and administer your booking, coordinate requested services, communicate operational information, manage changes and handle payment or cancellation matters. The legal basis is contract performance and, where applicable, compliance with legal obligations.
Security, records and legal claims
We may retain and use limited information for fraud prevention, system security, accounting, tax, consumer-protection requirements and the establishment or defence of legal claims. The bases are applicable legal obligations and our legitimate interests in protecting our business and legal rights.
Analytics
PostHog analytics and heatmaps operate by default from your first visit, to help us understand website use and improve our service. The legal basis is our legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR). You can object to this processing and opt out at any time through “Cookie Settings” in the footer, after which no further analytics data is collected about you.
Marketing
We will not add an enquirer to a newsletter merely because they contacted us. If you specifically request an apparel-drop notification, we use your name and email address only to manage that notification on the basis of your consent. You can withdraw consent at any time by emailing hello@updates.epicbiketrails.com. Any broader marketing subscription will request separate consent and provide an unsubscribe method.
Sharing and recipients
We do not sell, rent or trade personal data. We may share only relevant information with independent accommodation providers, bicycle-rental businesses, guides, transport operators and other suppliers where necessary to prepare or perform the services you request. Those suppliers may act as independent controllers for their own services.
Information may also be processed by service providers supporting our website, email, communications, security and administration. Current principal providers include Cloudflare (website hosting and security), Resend (delivery of enquiry emails), our business email provider, and PostHog (analytics, enabled by default with an opt-out available). We require processors to act under appropriate data-protection terms.
International transfers
Some providers may process data outside the European Economic Area. Where this occurs, we rely on a European Commission adequacy decision, approved Standard Contractual Clauses or another lawful safeguard. Information about relevant safeguards may be requested from our privacy contact.
Retention
- Enquiries not resulting in a booking are normally deleted or anonymised within 12 months after the last meaningful communication.
- Booking, invoicing and transaction records are retained for the relationship and the applicable Spanish tax, accounting and legal-limitation periods.
- Analytics information is retained according to the configured PostHog retention period; opting out through Cookie Settings stops further collection at any time.
- Apparel-drop notification details are retained until the requested notification has been sent, consent is withdrawn, or the notification list is discontinued.
- Security records are kept only for the period reasonably required to investigate and protect the service.
- Information relevant to a complaint or claim may be retained until the matter and applicable limitation periods have ended.
Your rights
Subject to the conditions in data-protection law, you may request access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Send requests to hello@updates.epicbiketrails.com. We may request reasonable evidence of identity.
You may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the supervisory authority in your country.
Other people and minors
If you provide information about another group member, you must be authorised to do so and should direct them to this policy. Please provide only what is necessary. Enquiries concerning minors must be submitted by a parent or legal guardian.
Security and changes
We use proportionate technical and organisational safeguards, but no internet transmission or storage system is completely secure. We may update this policy when our services, providers or legal obligations change; the current revision date appears above.