What we collect, why, and what you can ask us to do about it.
Last updated: August 2026
The data controller is AdventureLab S.r.l., Via Giulio Braga 98, 59100 Prato (PO), Italy — VAT no. 02410590976. For anything concerning your personal data, write to365@tuscanytrail.it.
There is no account to create and nothing to buy on this site. Three forms ask for your email address, and each of them is a fair exchange we state upfront.
The GPX of a route. On every route page you can ask us to email you the GPX file. We send it to the address you give us, and that same address joins our mailing list — the two go together, and the tick box says so before you send anything. Alongside your email we store which route you asked for and its area, type and difficulty, so we know which corners of Tuscany people want to ride. Legal basis: your consent (Art. 6(1)(a) GDPR).
Bike rental and custom tour requests. On therental & tours page you can describe what you are looking for. We process what you write to check availability with our partners and to answer you, and your address joins the same mailing list. Legal basis: your consent (Art. 6(1)(a) GDPR). We may share the details of your request with the stay or the local partner who could serve it, and only with them.
Leaving the list is one click. Every email we send carries an unsubscribe link, and you can also write to365@tuscanytrail.it. Withdrawing your consent stops the emails from that moment on and does not affect what was lawful beforehand — the file you already received stays yours.
Our mailing is handled by Brevo (Sendinblue SAS, France), which acts as our data processor and stores the data inside the European Union. We keep your contact until you unsubscribe.
If instead you simply email us, we process your address and the content of your message for the sole purpose of replying — legal basis: our legitimate interest in answering someone who contacted us (Art. 6(1)(f) GDPR). We keep that correspondence only as long as it is useful for the exchange.
Technical logs. The site is served by Cloudflare Pages. Like any web server, the infrastructure processes your IP address, the requested page, the time of the request, your browser and operating system. This is necessary to deliver the pages and to protect the site from abuse (Art. 6(1)(f) GDPR). Cloudflare acts as our data processor.
Google Analytics 4 — only if you accept. We use GA4 to understand how many people reach the site and which pages they read. It runs in Google Consent Mode v2 with every storage category denied by default: until you press Accept on the banner, no analytics cookie is written and no measurement identifier is stored on your device. The legal basis is your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time — see the cookie policy. We do not use GA4 for advertising or profiling: ad storage, ad user data and ad personalisation are all left denied.
Google Ireland Limited acts as our data processor for GA4. Analytics data may be transferred outside the European Economic Area under the safeguards described in Google's own privacy documentation. GA4 data is retained for the period configured in the property (by default, 14 months).
The accommodation buttons send you to Stay22 or to the property's own website. Some of those links are affiliate links — we explain exactly which ones, and why, in ouraffiliate disclosure. The route buttons send you to Ride with GPS.
Once you follow one of those links you are on someone else's site, and their privacy policy applies — not ours. We do not receive your personal data back from them: what reaches us is, at most, aggregate commission reporting with no information that identifies you.
Under Articles 15 to 22 GDPR you may ask us for access to your personal data, and for its rectification or erasure; you may ask us to restrict or object to a processing operation; and you may ask for your data in a portable format. Where processing rests on your consent, you can withdraw it at any time without affecting what was lawful beforehand.
Write to 365@tuscanytrail.it and we will reply within one month. In practice, since we hold almost nothing about you, most requests are answered in a line or two. If you believe your data has been mishandled you also have the right to lodge a complaint with the Italian supervisory authority (Garante per la protezione dei dati personali, garanteprivacy.it) or with the authority of the country where you live.
If this notice changes we update the date at the top of the page. Should a change affect a processing operation that rests on your consent, we will ask for that consent again.
