Last updated: September 3, 2026 · Version: 1.1
1. Data controller
BURATTI MECCANICA S.R.L., owner of the “Clorofilla Bike Lab” brand and website
Registered office: Via Archimede 535, 47521 Cesena (FC), Italy
VAT number: IT00338300403
Email: info@burattimeccanica.com
Telephone: +39 0547 301623
2. Scope and categories of personal data
This notice describes the processing of personal data through clorofilla-bikelab.com, including browsing, customer accounts, shopping cart, purchases, contact requests, support, returns, reviews and cookie preferences.
- Technical and security data: IP address, date and time, requested URL, browser, device, response codes and server or application logs.
- Identification and contact data: first and last name, email, telephone number, billing and shipping addresses and the content of requests.
- Account and order data: protected credentials, cart contents, order history, notes, tax information and details required for payment, shipping, support, returns and warranties.
- Voluntarily published data: display name, rating and review content.
- Cookie preferences: choice identifier, accepted or rejected categories, notice version, date and time and, where enabled, anonymised technical references.
The website does not process complete payment-card details. The payment method currently available is bank transfer.
3. Purposes, legal bases and retention
| Processing activity | Purpose and legal basis | Retention |
|---|---|---|
| Browsing, operation and security | Provision of the requested service and legitimate interests in security, continuity and the protection of rights (Art. 6(1)(b) and (f) GDPR). | For as long as necessary; technical logs are retained for up to 365 days, unless documented security or legal-defence needs require otherwise. |
| Customer account | Creation and management of the account at the user’s request and performance of the contract (Art. 6(1)(b) GDPR). | Until the account is closed and thereafter only as required by law or for the establishment, exercise or defence of legal claims. |
| Cart and checkout | Management of the purchase request and pre-contractual steps (Art. 6(1)(b) GDPR). | For the session or the technical periods stated in the Cookie Policy; data included in an order follows the order-retention period. |
| Orders, bank transfers, delivery, invoicing and after-sales support | Performance of the contract and compliance with legal, tax and accounting obligations (Art. 6(1)(b) and (c) GDPR). | 10 years from recording the transaction, unless a longer period is required by law or for legal claims. |
| Contact and customer support | Replying to requests and taking pre-contractual or contractual steps (Art. 6(1)(b) GDPR); where applicable, legitimate interest in managing communications (Art. 6(1)(f)). | 730 days, unless the relationship continues or legal obligations or disputes require longer retention. |
| Returns, warranties and complaints | Performance of the contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR). | For the periods required by law and, where necessary, for the protection of rights. |
| Reviews | Publication at the user’s request and legitimate interest in collecting genuine feedback (Art. 6(1)(b) and (f) GDPR). | Until the review is removed or a justified request is received, unless legal-protection needs require otherwise. |
| Evidence of cookie preferences | Accountability and legitimate interest in recording and respecting the user’s choice (Arts. 5(2), 6(1)(f) and 24 GDPR). | 365 days, unless legal-defence needs or further obligations apply. |
| Analytics and non-essential external content | Consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time. | According to the duration of each tool stated in the Cookie Policy and until consent is withdrawn. |
No direct marketing, behavioural advertising, commercial profiling or solely automated decision-making producing legal or similarly significant effects is carried out.
4. Forms and requirement to provide data
The Italian and English contact forms collect identification and contact details and the content of the request, limited to the fields completed. Required data is marked as such; without it, the request cannot be answered.
The checkout collects first and last name, billing and shipping addresses, email, telephone number, order details and any required tax information. The purchase cannot be completed without mandatory data. Account creation is optional where guest checkout is available.
5. Cookies and services
Technical cookies and necessary tools are used for security, cart management, language, session management and storing preferences. WooCommerce, Polylang and Open Cookie Banner Consent operate as website components and store the relevant data within the website infrastructure.
Google Analytics 4, Google Tag Manager and YouTube content may be activated only after consent. These services may process IP addresses, online and cookie identifiers, usage data and browser or device information. Consent may be refused or withdrawn without affecting essential website functions.
The current list of tools, purposes, domains and durations is available in the Cookie Policy.
6. Recipients and processors
Personal data may be processed by authorised BURATTI MECCANICA S.R.L. personnel and, only where necessary, by:
- Aruba S.p.A., for hosting, technical infrastructure and email;
- Google Ireland Limited, for Google Analytics 4, Google Tag Manager and YouTube, in accordance with the user’s preferences;
- the bank involved in the transfer, the courier handling delivery, tax and accounting advisers and other professionals bound by confidentiality obligations;
- public authorities where disclosure is required by law.
Providers processing personal data on behalf of the controller are appointed as processors under Art. 28 GDPR where required.
7. Transfers outside the EEA
The main hosting infrastructure is located in Italy/the European Union. Google services may involve transfers to the United States or other third countries. Where applicable, transfers rely on an adequacy decision, including the EU-U.S. Data Privacy Framework for participating organisations, and/or the European Commission’s Standard Contractual Clauses together with any additional safeguards required by law.
8. Security
The controller implements technical and organisational measures appropriate to the risk, including HTTPS, access controls, regular updates, security logging, least-privilege access and encryption where applicable. No measure can completely eliminate residual risk.
9. Data-subject rights
In the cases and within the limits set out in Arts. 15–22 GDPR, data subjects may request access, rectification, erasure, restriction and portability, object to processing and withdraw consent at any time. Withdrawal does not affect processing carried out before withdrawal. A complaint may also be lodged with the Italian Data Protection Authority.
Requests may be sent to info@burattimeccanica.com or submitted through the form below. The controller may carry out a proportionate identity check before responding.
Optional form consents may be reviewed and withdrawn through a temporary link:
Supervisory authority:
Garante per la protezione dei dati personali10. Managing cookie consent
Preferences may be changed or withdrawn at any time:
See the complete list of tools:
Cookie Policy11. Children and updates
The website and products are not specifically directed at children. This notice may be updated when processing activities, providers or applicable law change. A new choice may be requested if a material change affects consent.
