How we handle your data

Who handles the data

The data controller is SP Dataforge Ltd, registered office 20 Wenlock Road, London, England, N1 7GU (company number 16200599), which runs the Curva Nove brand. The business operates in Italy, from the workshop at Via Marconi 13, 10026 Santena (TO). For anything about your data write to paddock@curvanove.com or call +39 366 970 7626.

What we collect when you book

The form asks only for what it takes to call you back and get the day ready. No field is there out of curiosity.

• Name and phone number: to call you back and confirm.
• Your email: to write to you with the confirmation and, if you ask for it, to send you the copy of the request. We use it for nothing else and we sign you up to nothing.
• Circuit, dates, number of days, format, how many bikes and which models, extras chosen: that is the request itself.
• Date and time of the submission, IP address and browser type: to understand where a request came from if something does not add up, and to stop automated submissions.

What we do not collect

The form asks for no address, no documents and no payment details, and never for your card: the balance is settled by bank transfer after confirmation, and those details go through the bank, not through this site. We use no advertising pixels, we do no remarketing, we do not combine your data with other sources and we sign you up to no newsletter: the email you leave for the copy is only used to send you that.

Why we are allowed to

Every use has its legal basis, and there are three.

• To answer your request: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
• To keep automated submissions out and protect the form from abuse: our legitimate interest (Art. 6(1)(f)).
• For Google Analytics statistics: only if you agree through the notice at the bottom (Art. 6(1)(a)). If you do not agree, nothing loads.

Where it goes

The request is saved to a file on our server and emailed to the paddock mailbox. It goes nowhere else.

• We do not sell, share or trade data with anyone.
• It is seen by the provider hosting the site and the one running the mail, who handle it on our behalf as processors.
• If you accepted statistics, Google LLC processes site usage data, including in the United States, under the standard contractual clauses and the EU-US data privacy framework.

For how long

Booking requests are kept for 24 months from the submission, then deleted: they exist to reconstruct a day, a dispute or a deposit, not to build an archive. The anti-abuse counter only keeps the count of the last ten minutes, with the IP address turned into a one-way code. Statistics data follows the retention set in Google Analytics.

Your rights

They are the ones the regulation gives you, and to use them you just write to us: we answer within a month.

• Know what data we hold and get a copy of it.
• Have it corrected if it is wrong.
• Have it deleted, or restrict how it is used.
• Object to processing based on legitimate interest.
• Withdraw your consent to statistics whenever you like, from the "Cookies" button at the foot of every page.
• Complain to the Italian data protection authority (garanteprivacy.it) or to the UK ICO if you think something is wrong.

If something changes

If we change how we handle data, we change this page too and update the date below. We make no retroactive changes to requests already sent.