Privacy Policy
1. Who We Are
Cycling in Slovenia ("we", "us", "the Platform") operates cyclinginslovenia.com and its booking pages. The Platform is operated by OFF TRAIL, Grega Cuderman s.p., Pilovova ulica 8, 1000 Ljubljana, Slovenia, registration no. 7536330000, tax no. 38530619. We are the data controller for personal data collected through the Platform.
Contact: info@cyclinginslovenia.com
2. Data We Collect
Account data (when you create an account):
- Full name and username
- Email address
- Profile photo (if uploaded)
- Strava profile URL and Instagram URL (if provided voluntarily)
- Routes you create, save, or mark as ridden, and your preferences
Booking data (when you book a tour, experience, bike rental, or accommodation):
- Full name, email address, and phone number
- Number of participants and names of accompanying riders
- Country of residence and billing details
- Tour-specific details you provide, such as bike preference, rider height (for rentals), or dietary requirements
- Booking history, payment status, and correspondence related to your booking
Payment data:
Payments are processed by Stripe. We never see or store your full card number. We receive only confirmation of payment, the amount, and the last four digits of your card for reference.
Newsletter data:
Email address and your consent record (date and source of sign-up).
Technical and usage data:
IP address, browser type, pages visited, and interactions with the Platform, collected via cookies and similar technologies where you have consented (see Section 7).
We do not collect real-time location data or sensitive personal data.
3. How We Use Your Data and Legal Bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Operating your account, displaying your profile and routes | Performance of a contract (6(1)(b)) |
| Processing and fulfilling tour bookings, sending booking confirmations, GPX routes, roadbooks, and pre-departure information | Performance of a contract (6(1)(b)) |
| Providing on-route support during your tour | Performance of a contract (6(1)(b)) |
| Issuing invoices and keeping accounting records | Legal obligation (6(1)(c)) |
| Sending marketing emails (newsletter, offers, route tips) | Consent (6(1)(a)) |
| Advertising measurement and retargeting via Meta Pixel | Consent (6(1)(a)) |
| Responding to enquiries and support requests | Legitimate interest (6(1)(f)) |
| Improving and securing the Platform | Legitimate interest (6(1)(f)) |
4. Sharing Your Data
To fulfil your booking, we share the minimum necessary data with:
- Hotels and accommodation providers on your itinerary — your name, number of guests, and arrival/departure dates
- Luggage transfer and support drivers — your name and hotel schedule
- Bike rental partners (only if you request a rental) — your name, height, and bike preference
- Stripe — for payment processing (Stripe acts as an independent controller for payment data; see Stripe's privacy policy)
Our processors and service providers:
- Supabase — database, authentication, and file storage
- Vercel — website hosting
- [Email provider — e.g. Resend/Mailerlite] — transactional and marketing emails
- Meta Platforms Ireland Ltd. — advertising measurement (only with your consent; see Section 7)
We do not sell your personal data. We never share your data with anyone except as described above or where required by law.
5. International Transfers
Some providers (e.g. Stripe, Meta, Vercel) may process data in the United States. Where this happens, transfers are protected by the EU–US Data Privacy Framework or Standard Contractual Clauses.
6. Data Retention
Account data:
Retained while your account is active; deleted when you delete your account. Routes you created may be retained in anonymised form.
Booking and invoice data:
Retained for 10 years after the end of the financial year, as required by Slovenian tax and accounting law, then deleted.
Newsletter data:
Retained until you unsubscribe.
Advertising cookie data:
According to the retention periods in Section 7.
7. Cookies and Tracking
Strictly necessary cookies
Authentication and session cookies, cookie-consent preference. These do not require consent.
Advertising cookies (Meta Pixel)
Only if you accept them in our cookie banner. The Meta Pixel allows us to measure the effectiveness of our advertising and show you relevant ads on Facebook and Instagram. Data collected includes pages visited and actions taken (e.g. viewing a tour, starting a booking). Meta Platforms Ireland Ltd. acts as a joint controller for this data collection; see Meta's Data Policy for details.
You can withdraw or change your cookie consent at any time via the "Cookie settings" link in the footer. Refusing advertising cookies does not affect your use of the Platform.
8. Marketing Communications
We only send marketing emails with your explicit consent. You can withdraw consent at any time via the unsubscribe link in any email or in your account settings. Withdrawal does not affect the lawfulness of prior processing. Booking confirmations and essential trip information are not marketing and will always be sent.
9. Your Rights under GDPR
You have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data (also directly in account settings)
- Erasure — request deletion (also directly in account settings); note that booking/invoice data we must keep by law is exempt until the statutory period expires
- Restriction — limit how we process your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for marketing and cookies, at any time
To exercise these rights, email info@cyclinginslovenia.com. We respond within 30 days. You may also lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si) or your local supervisory authority.
10. Data Security
We use appropriate technical and organisational measures, including encrypted connections (TLS), access controls, and reputable infrastructure providers. No method of transmission over the internet is completely secure.
11. Children
The Platform is not directed at children under 16, and we do not knowingly collect their data. Minors may participate in tours only when booked by and accompanied by a parent or guardian, whose data we process as the booking contact.
12. Changes to This Policy
We may update this Policy. Registered users and active booking holders will be notified of material changes by email. The date of the latest update is shown at the top of this page.
Data-related enquiries? Contact us at info@cyclinginslovenia.com