Privacy notice on the processing of personal data pursuant to Regulation (UE) 2016/679 (GDPR) and Legislative Decree 196/2003 (Privacy Code). Effective from 01/11/2026 (replaces the version dated 20/06/2023).
Introduction
Data Controller: Bikilia S.r.l., registered office at Strada Statale 85 Venafrana 230, 86079 Venafro (IS), operating premises and shop at Via Nazionale Appia 114, 81020 Casapulla (CE), VAT No. IVA IT01003440946. Contact details: info@evolutionbikes.it, telephone +39 0823 1560738.
Website covered by this notice: https://evolutionbikes.it/ (the "Website"), in all its language versions. The Controller has not appointed a DPO (Data Protection Officer): you can send any request directly to the Controller, including via the Privacy requests page.
This notice concerns the data you provide to us on the Website. For cookies and similar tools, see the Cookie Policy.
What data we process and why
Registration and customer account
We use registration details (name, email, addresses) for the account area: orders, returns and saved addresses. Legal basis: taking pre-contractual steps and performing the contract. Providing these details is optional, but an account cannot be created without them. The Website uses Shopify's account system; if you sign in with Shop, Shop's terms also apply.
Purchases
We process the data needed to place and fulfil your order (name, shipping and billing addresses, email, telephone number, products purchased, invoicing details such as your Italian tax code, PEC or IVA number) and to comply with tax obligations. Legal basis: performance of the contract and legal obligations.
Payments are handled directly by the providers selected at checkout (Shopify Payments, PayPal, Klarna, Scalapay, HeyLight, Shop Pay, Apple Pay, Google Pay, bank transfer): the Controller neither sees nor stores your full card details. For payments in instalments, the provider may carry out its own checks as an independent controller, in accordance with its privacy notice.
Some products are shipped directly from one of our suppliers' warehouses: in this case, we share only your name, delivery address, telephone number and ordered products with the supplier, solely for shipping purposes.
Post-purchase emails ("soft spam") and reminders
Under Article 130, paragraph 4, of the Privacy Code, we may use the email address you provide when making a purchase to offer you similar products, unless you object at any time (using the link in each email or by contacting us using the details above). We may also send you a reminder if you leave a purchase incomplete. Legal basis: the Controller's legitimate interest.
Marketing (email, SMS, WhatsApp)
Only with your consent (via a checkbox at checkout, newsletter subscription or in your account) may we send you offers and news by email and, if you choose, via SMS or WhatsApp. Consent is optional and can be withdrawn at any time, separately for each channel if you wish. Legal basis: consent.
Profiling
Only with your consent may we analyse your purchases and browsing to send you communications and advertisements that better match your interests (for example, customer segments in our email platform, or advertising shown on Google and Meta through marketing cookies). Legal basis: consent.
Enquiries and support
We use the data you send us (email, telephone, contact form, chat) to respond to your enquiries and provide support with orders and returns. Legal basis: legitimate interest in responding and performance of the contract.
Virtual assistant (chat)
An artificial intelligence-based virtual assistant is available on the Website to answer questions about products, sizes, shipping and orders. The messages you write are processed by an artificial intelligence model provider (Anthropic's Claude models, via the OpenRouter service) solely to generate a response. Do not enter unnecessary data in the chat. If you are signed in to your account, the assistant can read your order status to answer you. If you leave your email address so that we can contact you, we use it only to respond to your enquiry. We retain conversations for a maximum of 30 days for support and service improvement; conversations with customers signed in to their accounts are retained for up to 12 months so that we can follow up on enquiries. Legal basis: legitimate interest in providing support and performance of the contract.
Reviews
After a purchase, we may invite you to leave a review through Trusted Shops, which receives your name, email address and order number for this purpose. Publishing a review is optional; published reviews are visible on the Trusted Shops profile and may be displayed on the Website. Legal basis: legitimate interest in collecting feedback on the service.
Delivery country and language
The Website uses your IP address to estimate the country you are connecting from, so that it can show you the correct language, currency, prices and delivery times. This data is not used to identify you. Legal basis: legitimate interest in displaying correct information.
Other purposes
You cannot submit CVs or book appointments through the Website. Your data is not passed to third parties for their own marketing purposes.
Who we share data with
Data is processed by the Controller's authorised staff and, solely for the purposes indicated, by the following parties, who generally act as data processors:
- Shopify (online shop platform, customer accounts, checkout, emails and messages to customers through Shopify Email and Shopify Messaging);
- payment providers (Shopify Payments/Stripe, PayPal, Klarna, Scalapay, HeyLight) and banks;
- couriers and freight forwarders (for example, through MBE) and suppliers that ship some products directly;
- Trusted Shops (review invitations and review management);
- technical service and hosting providers (for example, Cloudflare, which hosts the virtual assistant and some Website services) and the assistant's artificial intelligence model provider (Anthropic, via OpenRouter);
- Google and Meta, for statistics and advertising, only with your consent to the relevant cookies (see the Cookie Policy);
- legal, tax and administrative advisers, and public authorities where required by law.
Data transfers outside the UE
Some of the providers listed (for example Shopify, Google, Meta, Cloudflare, Anthropic, OpenRouter, PayPal) may process data in the United States, Canada or other countries outside the UE. In these cases, transfers are based on an adequacy decision by the European Commission (for the United States, the EU-US Data Privacy Framework for certified companies) or on the Standard Contractual Clauses approved by the Commission.
How long we retain data
- Order and invoice data: for the period required by law (normally 10 years for accounting and tax documents).
- Customer account: until you delete your account or request its deletion.
- Marketing and profiling: until you withdraw your consent; if you do not open our communications for 12 months, we may remove your data from our marketing lists.
- Support requests: for as long as necessary to handle them and protect the rights of the parties.
- Conversations with the virtual assistant: 30 days (12 months for customers logged into their accounts).
Processing methods and security
Data is processed primarily using electronic tools, with appropriate measures to ensure its security and confidentiality. We do not process special category data (for example health data) or data relating to criminal convictions and offences through the Website. If you enter other people's data (for example a different recipient), you confirm that you are authorised to do so.
Your rights
You have the right to request access to your data, rectification, erasure, restriction of processing and data portability, and to object to processing, particularly for marketing purposes; you may withdraw your consent at any time without affecting the lawfulness of previous processing. You can exercise your rights by writing to info@evolutionbikes.it or through the Privacy requests page. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Changes
The Data Controller may update this privacy notice, indicating the effective date here. In the event of significant changes, we may also notify you by email.