Privacy Policy

This is a translation of the Italian text, which prevails in case of discrepancy. Read the Italian version.

This notice describes how the personal data of users who visit the website bruumers.it (the “Site”) are processed, pursuant to Art. 13 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (“Italian Privacy Code”).

The Bruumers — Professional Riders is an informal group of motorcyclists based in Palermo, not for profit and without a VAT number. The Site is for information purposes: it does not sell products or services and does not take payments. It also offers a form to propose a ride to the group and a Members' Area reserved for members of the group, from which members can also review the rides they took part in, as described in section 2.

1. Data controller

The data controller is Francesco Accardi, as the contact person for the group The Bruumers — Professional Riders, based in Palermo (Italy).

For any request about the processing of your personal data you can write to:

• Email: accardifrancesco@hotmail.it
• Instagram (DM): @bruumers

No Data Protection Officer (DPO) has been appointed, as the conditions set out in Art. 37 GDPR do not apply.

2. Types of data processed

The Site does not offer newsletters, registration open to the public or financial transactions. The only data provided directly by users are those entered in the “Propose a ride” form and, for members of the group, those in the Members' Area (including the access request), described below.

While users browse the Site, the following data are also processed automatically:

• Browsing data: IP address (anonymised where possible), browser type, operating system, language, pages visited, date and time of access, length of the visit, referring site.
• Data collected through cookies and similar technologies: see the Cookie Policy for full details.
• Data provided voluntarily: if users decide to contact us by email or through social channels, only the data strictly necessary to reply will be processed (email address, name or nickname, content of the message).

“Propose a ride” form

Anyone who proposes a ride with the form on the Propose a ride page provides their name, optionally a contact (phone or email) and the details of the proposal (destination, date, duration, route, map link, meeting point, departure time, lunch, notes). Together with the proposal, the IP address it was sent from is recorded, solely to prevent abuse and automated submissions, along with the language of the page it came from (Italian or English), so that we can reply in the right language. Proposals are read only by the group's organisers, in the private portal; the organisers also receive a Telegram notification with only the proposed destination and date, without name or contact details. If a proposal becomes a ride, the organisers may reuse its destination, route and other details in the ride's listing published on the Site; the name and contact details of the person who proposed it are not published.

Members' Area

The Members' Area is reserved for members of the group. For each member who uses it, the following are processed:

• the email address, registered by the organisers at the member's request (also through the “Request access” form), which is used to sign in and to receive the profile activation email and the link to choose or reset the password;
• the password, chosen by the member and stored only in encrypted form using an irreversible hash function: nobody, organisers included, can read it;
• the choice whether or not to make their profile visible to other members;
• the profile photo, if the member uploads or changes it from the Members' Area (or the organisers upload it): it is stored on Cloudflare R2 (img.bruumers.it), together with the full photo it was cropped from (so that it can be cropped again); it can be seen by the organisers in the portal and, if the profile is visible, by other members; when it is changed or removed, both are deleted;
• technical sign-in data: date and time, outcome (including failed attempts) and IP address, plus a technical cookie that keeps the member signed in (see the Cookie Policy);
• reviews of the rides the member took part in (a rating from 1 to 5 stars and a text), if they decide to write them: they are read by the organisers in the portal and, if approved, are published on the Site, on the ride's card in the archive, signed with the member's first name and the initial of their surname (e.g. “Marco R.”), with no photo or other data. The organisers receive a Telegram notification with only the ride and the rating. Members can edit their reviews (they go back to awaiting approval) or delete them at any time from the Members' Area, or ask the organisers to delete them. For actions on reviews (writing, editing, deleting), the IP address is also kept in the log, as for sign-ins.

In the Members' Area, members can see the group's data about them that the organisers already manage in order to organise rides: rides attended, kilometres, roads ridden (from the rides' GPX tracks), awards, bikes used, riding companions and group accessories. The organisers' internal notes are never shown.

Requesting access to the Members' Area

Anyone who belongs to the group but does not yet have access to the Members' Area can ask for it with the “Request access” form on the Members' Area page, providing their first name, surname, email address and phone number. Together with the request, the IP address it was sent from is recorded, solely to prevent abuse and automated submissions, along with the language of the page it came from (Italian or English), so that we can reply and send emails in the right language. The request is read only by the organisers who administer the private portal, to check that the sender belongs to the group; the phone number is used only to contact the sender again, if necessary. The organisers also receive a Telegram notification, without name or contact details.

If the request is accepted, the email address provided becomes the one the member uses to sign in to the Members' Area, and an email with the link to choose the password is sent to that address; if it is rejected, no email is sent. If the email address provided is already registered, the request is not kept: the link to choose or reset the password is sent straight away to that address, as with “First time here or forgot your password?”.

3. Purposes and legal basis of processing

Data are processed for the following purposes:

1. Ensuring the technical operation of the Site (e.g. remembering the cookie preference and the chosen language).
   Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR) and, for technical cookies, Art. 122 of Legislative Decree 196/2003 (no consent required).
2. Statistical analysis of traffic in aggregate form through Google Analytics, to understand how users use the Site and to improve it.
   Legal basis: the user's explicit consent (Art. 6(1)(a) GDPR), given through the cookie banner. Consent can be withdrawn at any time.
3. Replying to contact requests received by email or on the group's social channels.
   Legal basis: pre-contractual measures taken at the data subject's request and legitimate interest in managing communication (Art. 6(1)(b) and (f) GDPR).
4. Assessing and organising the rides proposed with the “Propose a ride” form and, if a contact was left, getting back in touch with the person who proposed them.
   Legal basis: responding to a request from the data subject (Art. 6(1)(b) GDPR) and, for the IP address, legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR).
5. Giving members access to the Members' Area: checking access requests, identification by email and password, sending the activation email and the link to choose or reset the password, protecting sign-ins and forms from abuse.
   Legal basis: providing the service requested by the member (Art. 6(1)(b) GDPR) and legitimate interest in the security of sign-ins (Art. 6(1)(f) GDPR).
6. Showing the profile to other registered members (statistics, awards, rides, bikes) and allowing comparison, only if the member chooses to by turning on the relevant switch in the Members' Area. The profile is never visible to anyone who is not signed in, nor to search engines.
   Legal basis: the member's consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time by turning the switch off.
7. Publishing members' ride reviews on the Site, after approval by the organisers.
   Legal basis: the member's consent (Art. 6(1)(a) GDPR): members choose whether to write reviews and can delete them at any time from the Members' Area (or by asking the organisers); once deleted, a review also disappears from the Site.

4. How data are processed

Data are processed with electronic tools, adopting appropriate technical and organisational measures to ensure their security, integrity and confidentiality, in accordance with Art. 32 GDPR.

The Site is hosted on Cloudflare Pages (Cloudflare, Inc.) and distributed through its server network. Images are also served through the subdomain img.bruumers.it. The hosting server's technical logs may contain IP addresses and user agents for security purposes, and are managed directly by the provider according to its own privacy policy.

Ride proposals and the Members' Area rely on the group's private portal (portal.bruumers.it), hosted on a virtual server provided by IONOS SE, a provider based in Germany, and reached through the Cloudflare network. Passwords are stored only in encrypted form, password links are valid for one hour (the one in the profile activation email for 7 days) and can be used only once, and sign-in and submission attempts are limited to prevent abuse. Members' Area emails (profile activation and password links) are sent, in Italian or in English depending on the language of the page they were requested from, from the group's address thebruumers@gmail.com via Gmail (Google), which processes the recipient's address and the message in order to deliver it.

5. Third-party services used by the Site

The Site integrates some services provided by third parties which, by the nature of the web, may independently collect users' browsing data. Each provider acts as an independent controller or, depending on the case, as a processor, according to its own privacy policy.

The links to social profiles lead to external platforms. If you click on them you will be taken to the provider's website, whose privacy policy we invite you to read separately.

6. Transfer of data outside the European Union

Some of the providers listed above (in particular Google, Cloudflare and Amazon Web Services) are based in the United States of America or also process data on servers outside the EU.

Personal data are transferred to third countries on the basis of the safeguards provided for in Art. 44 et seq. GDPR, in particular through participation in the EU-U.S. Data Privacy Framework and/or the use of the Standard Contractual Clauses approved by the European Commission, as well as further supplementary measures adopted by the individual providers (for Google, this includes Gmail, which delivers the Members' Area links).

7. Data retention period

• Consent cookie: stored locally on the user's device for 6 months, in accordance with the Guidelines of the Italian Data Protection Authority of 10 June 2021. After this period, the banner is shown again.
• Site language: the chosen language (with the IT · EN switch or from the notice offering the Site in the other language) and the fact that the notice has been closed are stored only in the user's browser, until the user changes language or clears the site's data; they are not sent to any server (see the Cookie Policy).
• Google Analytics data: retained according to the settings of the GA4 property (normally 14 months).
• Contact emails: kept for as long as strictly necessary to handle the user's request and, in any case, for no longer than 24 months after the last interaction, unless the law requires otherwise.
• Ride proposals (with the language of the page they came from): automatically deleted 12 months after they are sent (the organisers may delete them earlier); the sender's IP address is deleted after 30 days.
• Members' Area: email and password are kept for as long as the member's access is active and are deleted when the organisers remove the email or delete the member's record (including at the member's request). The sign-in session expires after 30 days of inactivity; the sign-in log is automatically deleted after 12 months.
• Access requests (with the language of the page they came from): deleted as soon as the organisers handle them (by accepting or rejecting them) and in any case automatically 6 months after the last submission; the sender's IP address is deleted after 30 days. A record of the outcome remains in the sign-in log (without name or contact details, if the request is rejected), which is automatically deleted after 12 months.
• Ride reviews: kept until the member deletes them from the Members' Area or the organisers remove them, and deleted together with the member's record or with the ride; the log of actions on reviews (writing, editing, approval), with the IP address for those made by the member, is automatically deleted after 12 months.

8. Disclosure and dissemination of data

Personal data collected through the Site are not disseminated, sold or passed on to third parties for commercial or marketing purposes. The exception, by the member's choice, is ride reviews: once approved, they are published on the Site and anyone can read them, with the rating, the text and the signature “First name + initial”.

Data may be accessed only by:

• the data controller;
• the group's organisers who manage the private portal, authorised to process the data, for ride proposals and the Members' Area;
• other members registered with the Members' Area, limited to the statistics of the profiles that each member has chosen to make visible;
• the technical service providers listed in sections 4 and 5, as independent controllers or processors;
• public authorities, if they make a lawful request under the applicable legislation.

9. Rights of the data subject

As a data subject, under Articles 15–22 GDPR, you have the right to:

• access your personal data and obtain a copy of it (Art. 15);
• ask for inaccurate data to be rectified or incomplete data to be completed (Art. 16);
• ask for your data to be erased (“right to be forgotten”) in the cases provided for by Art. 17;
• ask for the processing to be restricted (Art. 18);
• receive your data in a structured, commonly used and machine-readable format (portability, Art. 20);
• object to the processing on legitimate grounds (Art. 21);
• withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3)).

To exercise your rights you can write to accardifrancesco@hotmail.it. Requests will normally be handled within 30 days.

10. Right to lodge a complaint with the supervisory authority

If you believe that your personal data are being processed in breach of the GDPR, you have the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (the Italian Data Protection Authority):

• Piazza Venezia n. 11, 00187 Rome, Italy
• Website: www.garanteprivacy.it
• Email: protocollo@gpdp.it

11. Minors

The Site is not aimed at children under 14 and does not knowingly collect personal data relating to them. If a parent or guardian finds that a minor has provided their personal data, they can contact the data controller to have it deleted.

12. Changes to this notice

The data controller reserves the right to change this notice at any time to reflect changes in the law or in how the group is organised. The updated version will always be published on this page, showing the date of the last update.