Dear User, Cicli Pinarello S.r.l., in its capacity as Data Controller, values the protection of personal data and wishes to clearly explain what data it collects through the website www.pinarello.com (hereinafter, the “Website”), why it collects them, with whom it shares them, and what rights you can exercise. 

1. Data Controller.

The Data Controller is Cicli Pinarello S.r.l., with registered office in Villorba (TV), Viale della Repubblica n. 12, Tax Code and VAT No. 05994100963, PEC: pinarello.cicli@legalmail.it, e-mail: privacy@pinarello.com.

2. Scope of application.

This Privacy Policy applies to the processing of personal data carried out through the Website, including data collection forms made available by the Data Controller at trade fairs, events, and local initiatives.
This Privacy Policy does not cover:

• processing carried out by authorized dealers and partners, who operate as independent data controllers and provide their own privacy notice;
• processing carried out by third-party websites accessible via links on the Website, over which the Data Controller exercises no control;
• processing related to purchases made at physical retail stores, which are subject to a separate privacy notice.

The Website's services are not intended for minors. Should the Data Controller become aware of having collected personal data of a minor, it will promptly delete them.   
For matters not regulated herein, reference is made to the Cookie Policy available on the Website.  

3. Categories of personal data processed, purposes, and legal basis of the processing.

Depending on the service used, the Data Controller may process the User's personal data as follows.
In any case, the Data Controller does not process special categories of personal data pursuant to Art. 9 GDPR and requests not to insert data of such nature into the free-text fields on the Website forms.

3.1  Direct marketing.  

Voluntary subscription to the newsletter service, via the form on the Website or by ticking the dedicated box, allows the User to receive commercial and promotional communications, updates, product news, and editorial content relating to the Data Controller's products, services, and initiatives. 

Data processed:

• mandatory data: first name, last name, e-mail;
• optional data: disciplines of interest (road, gravel, offroad);
• data automatically collected by the form: language and country of completion.

Purposes:

• managing the registration, sending the confirmation message, and issuing any welcome discount code;
• periodic sending of commercial communications, product news, and promotional materials;
• marketing automation workflows segmented by interest (e.g., welcome messages, messages linked to browsing and products viewed, abandoned cart messages, pre- and post-event communications);
• cross-sell proposals (i.e., accessories and clothing connected/consistent with the purchase made) and up-sell proposals (i.e., a newer model of the purchased product);
• sending commercial communications with systems that measure the audience and performance of the communication itself (intended as the opening or reading of the transmitted communication), e.g., via tracking pixels(1);
• invitations to events/initiatives.

Legal basis:

• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR.

3.2  Purchases via the e-commerce platform.

The User may proceed with the online purchase of the Data Controller's products through the digital store. The User can place an order either as a guest, without registering, or as a registered user.  

Data processed:

• mandatory data: personal identification and contact details (first name, last name, e-mail, phone number), shipping and billing addresses, tax data necessary for invoicing, payment details (complete payment card details are processed directly by the payment service provider through encrypted channels and are not stored by the Data Controller);
• data collected from the order: gender and size in case of clothing purchases, product category (clothing, accessories, components), discipline of interest (road, gravel, offroad), cart contents.

Purposes:

• managing the contractual relationship, including purchase order processing, payment, shipping, and delivery of products; post-sales assistance, management of the statutory legal guarantee of conformity, right of withdrawal, and returns;
• fulfillment of accounting and tax obligations;
• fraud prevention and protection of transaction security.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• compliance with a legal obligation, pursuant to Art. 6, para. 1, point (c) of the GDPR;
• the legitimate interest of the Data Controller, pursuant to Art. 6, para. 1, point (f) of the GDPR (including: fraud prevention and transaction security).

3.3 Profiling.   

Profiling refers to the automated processing of personal data aimed at analyzing the User's preferences, habits, and interests in the cycling field, in order to build a profile that allows the Data Controller to make communications and the User experience on digital channels more relevant and personalized.  

Data processed:

• personal identification and demographic data: age, gender, country of residence;
• browsing and online behavior data: products viewed, configurations saved on MyWay (see section 3.5.3), abandoned carts, opening and reading of marketing communications tracked via tracking pixels;
• purchase data: order history, category of bikes and accessories purchased, price range, purchase frequency;
• technical and usage data, where provided: type of cycling practiced (road, gravel, e-bike/offroad), size and measurements, kilometers ridden, and event participation.

Purposes:

• sending personalized offers and promotional content, e.g., suggesting accessories compatible with purchased or registered bikes, or highlighting new colors available on MyWay;
• personalization of the e-commerce platform and the Website, e.g., featuring recommended products on the homepage or content consistent with the practiced discipline;
• creation of target audiences (e.g., “road performance cyclists” or “gravel enthusiasts”) to be used for targeted advertising campaigns, including on third-party platforms;
• measuring the effectiveness of communications and adapting their content, relevance, and frequency.

Legal basis:

• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR.

3.4  Event registration and participation.

Through the forms available on the Website, the User can participate in initiatives organized by the Data Controller.   

3.4.1  Trade fairs and community initiatives.  

This refers to data collection during trade fairs, rallies, community events, or promotional stands, including via digital forms made available at the stand.

Data processed:

• mandatory data: first name, last name, e-mail;
• data collected based on the type of event: discipline of interest (road, gravel, offroad) and language.

Purposes:

• sending post-event information material;
• direct marketing activities as referred to in section 3.1.

Legal basis:

• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR.

3.4.2  Talks. 

This refers to data collection during registration for and participation in conferences, workshops, product presentations, and limited-seat talks organized by the Data Controller. 

Data processed:

• mandatory data: first name, last name, e-mail;
• data collected based on the type of event: discipline of interest (road, gravel, offroad) and language.

Purposes:

• managing registration and participation in the initiative;
• sending organizational communications and initiative materials;
• direct marketing activities as referred to in section 3.1.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• compliance with a legal obligation, pursuant to Art. 6, para. 1, point (c) of the GDPR;
• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR.

3.4.3  Social Rides.

This refers to data collection during participation in a group ride organized by the Data Controller, in which each participant takes part with their own bike. 

Data processed:

• mandatory data: first name, last name, e-mail;
• data collected based on the type of event: discipline of interest (road, gravel, offroad) and language.

Purposes:

• managing registration and participation in the initiative;
• sending organizational communications and initiative materials;
• direct marketing activities as referred to in section 3.1.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR.

3.4.4  Bike Tests.

This refers to data collection during participation in road demo days for the Data Controller's bikes. The activity may take place at the Data Controller's premises or at an authorized dealer or partner. 

Data processed:

• mandatory data: first name, last name, e-mail, phone number, date of birth;
• data collected based on the type of bike reserved: discipline of interest (road, gravel, offroad).

Purposes:

• managing registration and participation in the initiative;
• communicating participants' data to the authorized dealer or partner hosting the initiative;
• managing the allocation of the test bike;
• direct marketing activities as referred to in section 3.1.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• compliance with a legal obligation, pursuant to Art. 6, para. 1, point (c) of the GDPR;
• the User's free, specific, informed, and revocable consent, pursuant to Art. 6, para. 1, point (a) of the GDPR, for direct marketing and for sharing the User's data with the authorized dealer or partner hosting the initiative.

3.5  Account creation and management.  

Through the forms available on the Website, the User can create an account and access multiple services provided by the Data Controller.  

3.5.1  User Registration.  

Registration to the Data Controller's reserved area allows the User centralized access to digital services: frame registration, MyWay configurator, wishlist, e-commerce order history.  

Data processed:

• mandatory data: first name, last name, e-mail, phone number, address (street, city, postal code, province/state, country), password (stored in encrypted form and inaccessible to the Data Controller);
• optional data: gender, date of birth, disciplines of interest
• (road, gravel, offroad), annual distance ridden;
• data automatically collected by the form: language.

Purposes:

• account creation and management;
• authentication and provision of services reserved for registered Users (frame registration, MyWay configuration, e-commerce order history, wishlist);
• simplification of e-commerce checkout, product registration, and MyWay configuration processes;
• ensuring account security and preventing unauthorized access.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• compliance with a legal obligation, pursuant to Art. 6, para. 1, point (c) of the GDPR;
• the legitimate interest of the Data Controller, pursuant to Art. 6, para. 1, point (f) of the GDPR (including: account security and prevention of unauthorized access).

3.5.2  Frame registration.  

User registration in the reserved area and insertion of the frame serial number enables activation of the extended warranty.  

Data processed:

• mandatory data: account data (section 3.5.1); purchased product data (serial number or frame matrix number, model, size, purchase date); proof of purchase (receipt or invoice); dealer where the purchase was made.

Purposes:

• activation and provision of the extended warranty on the frame;
• frame authenticity checks and anti-counterfeiting prevention;
• product traceability in case of recall or safety campaigns.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• compliance with a legal obligation, pursuant to Art. 6, para. 1, point (c) of the GDPR;
• the legitimate interest of the Data Controller, pursuant to Art. 6, para. 1, point (f) of the GDPR (including: protection against counterfeiting and product traceability for safety purposes).

3.5.3  MyWay.  

User registration in the reserved area enables the use of the MyWay configurator for graphic, color, and component customization of the bike. The created MyWay configuration can be transmitted by the User to an authorized dealer to request a quote and/or place an order.  

Data processed:

• mandatory data: account data (section 3.5.1); configuration data (graphic and color choices, components, size).

Purposes:

• management of created custom configurations;
• sharing configurations with the Data Controller's sales team;
• sending the configuration summary to the selected authorized dealer for a quote or order.

Legal basis:

• the performance of a contract and pre-contractual measures, pursuant to Art. 6, para. 1, point (b) of the GDPR;
• the legitimate interest of the Data Controller, pursuant to Art. 6, para. 1, point (f) of the GDPR (including: protection of legal rights in court).

4. Processing methods.

Data are processed using electronic, IT, and telematic tools, as well as, where necessary, manual and paper-based tools, and stored on suitable media, including the Data Controller's CRM systems. The Data Controller adopts appropriate technical and organizational measures in accordance with the principles of privacy by design and by default, aimed at minimizing the risks of loss and unauthorized access.
Data processing is carried out through the operations indicated in Art. 4, no. 2, GDPR, specifically: collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. The Data Controller does not adopt fully automated decision-making processes that produce legal effects concerning you or similarly significantly affect you pursuant to Art. 22 GDPR.
The profiling activities described are exclusively aimed at personalizing content, offers, and commercial communications and do not result in the application of differentiated prices or purchase conditions, nor do they limit access to products and services in any way. 

5. Data retention period.

Your personal data will be stored for the period strictly necessary to achieve the purposes for which they were collected, and in particular:

• contractual, accounting, and tax data: within the statutory limitation periods established for the retention of accounting/tax documentation, as well as for the exercise of legal rights depending on the activated warranty;
• account data: until the User requests account deletion; in case of prolonged inactivity, deletion or anonymization after 36 months from the last login (except for data referred to in section 3.5.2, which are retained for the entire duration of the warranty plus an additional 10 years);
• data processed for direct marketing: until withdrawal of consent and, in any case, with automatic deletion after 24 months of inactivity (including lack of interaction with communications received from the Data Controller; time limit applicable to data referred to in section 3.4.1);
• data processed for profiling: until withdrawal of consent and in any case no later than 12 months from data collection;
• data processed for event registration (sections 3.4.2, 3.4.3, and 3.4.4): 6 months from the event.

Upon expiry of these periods, the data will be erased or anonymized, unless further retention is required by legal obligations or for the exercise or defense of legal claims in court.  

6. Nature of data provision and consequences of refusal.

The provision of data marked as mandatory on the Website forms is necessary for the provision of the requested service: total or partial refusal may make it impossible for the Data Controller to follow up on the request (for example, to complete an order, activate the extended warranty, and/or register for an event).
The provision of optional data and the granting of consent for marketing and profiling are entirely voluntary. Failure to provide optional data or withdrawal of consent will not affect the purchase of products or the use of Website services in any way, resulting solely in the impossibility of receiving promotional communications and personalized offers, respectively.

7. Categories of recipients of personal data.

Exclusively for the purposes specified above, collected data may be communicated to internal personnel formally authorized to process data based on their respective roles, as well as to the following categories of external entities:

• service providers of the Data Controller, e.g., for maintenance activities (e.g., IT service providers), operational and logistical needs (e.g., couriers, carriers), event organization (event and communication agencies, authorized dealers, and partners hosting events)
• email marketing and marketing automation platforms, cloud and hosting service providers, digital marketing agencies, advertising/social platforms;
• payment processors and banking institutions;
• group companies;
• consultants, professionals, and service companies (for example, accountants and law firms) acting on behalf of the Data Controller, as well as public authorities and bodies where required by law.

Where such recipients process data on behalf of the Data Controller, they will be designated as Data Processors pursuant to Art. 28 GDPR, by means of a specific contract or other legal act. The updated list of appointed Data Processors will be provided upon the User's request.  

8. Data transfer to a third country and/or an international organization.

The User's personal data will not be disseminated. Without prejudice to communications made in compliance with legal and contractual obligations, all data collected and processed may be communicated in Italy and within the EU, exclusively for the purposes specified above. Should the use of certain service providers involve a transfer of data to third countries (e.g., due to the use of overseas IT platforms), the Data Controller will ensure the adoption of adequate safeguards pursuant to Art. 44 et seq. of the GDPR.

9. User Rights.

Please note that you may exercise the rights recognized under Articles 15 to 21 and 77 of the GDPR, and in particular:

1. right of access: the right to obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed and, where that is the case, access to the personal data;
2. right to rectification and erasure: the right to obtain the rectification of inaccurate data and/or the completion of incomplete data, or the erasure of data for legitimate reasons;
3. right to restriction of processing: the right to request the suspension of processing where legitimate grounds exist;
4. right to data portability: the right to receive data in a structured, commonly used, and machine-readable format, as well as the right to transmit those data to another data controller;
5. right to withdraw consent: at any time (including via opt-out mechanisms – also on a granular level – present in every commercial/promotional communication received) without affecting the lawfulness of processing based on consent before its withdrawal;
6. right to object: the right to object to the processing of data where legitimate grounds exist, or unconditionally for marketing and profiling purposes;
7. right to lodge a complaint: with the competent data protection authority in the event of unlawful data processing.

You may send requests relating to the rights listed above to the Data Controller at the following contact details: (i) by registered mail, Cicli Pinarello S.r.l., located in Villorba (TV), Viale della Repubblica n. 12; (ii) by e-mail, privacy@pinarello.com.  

10. Amendments to the Privacy Policy.

Should the purpose or methods of processing personal data undergo significant changes, we will promptly update this privacy policy and inform you accordingly of the changes made.

Villorba (TV), 01/09/2026
The Data Controller 
Cicli Pinarello S.r.l.