Privacy policy

Last updated: 4 August 2026

This Privacy Policy explains how Cycling Artisan collects, uses, discloses and protects personal data when you visit www.cyclingartisan.com (the “Site”), contact us, create an account, subscribe to marketing communications or purchase our products.

1. Who is responsible for your personal data?

The controller responsible for the processing of your personal data is:

Andrew Westacott, trading as Cycling Artisan
NIF/NIE: Y6937943F
Business address: Passeig de sa Creu 5, 07316 Moscari, Illes Balears, Spain
Email: info@cyclingartisan.com

Cycling Artisan is a trading name used by an individual business operator established in Spain.

2. Personal data we collect

Depending on how you use the Site, we may collect the following categories of personal data:

• Identity and contact data: such as your name, email address, telephone number, billing address and delivery address.

• Order and transaction data: such as the products you order, order value, currency, discounts, shipping method, payment status, returns, refunds and communications concerning your order.

• Customisation data: information, wording, files, photographs, designs or other content that you provide when ordering a personalised or custom product. Please avoid providing personal data that is not necessary for us to complete your order.

• Payment data: payments are processed by third-party payment providers. We generally receive confirmation of payment and limited billing information, but we do not receive or store your complete payment-card number.

• Account data: such as login details, saved addresses and order history if you choose to create a customer account.

• Communications data: messages and information you provide when you contact us, request support, submit a review, enter a promotion or communicate with us through email, the Site or social media.

• Marketing data: such as your newsletter subscription, marketing preferences and interactions with promotional emails.

• Technical and usage data: such as your IP address, browser type, device type, operating system, approximate location, time zone, pages viewed, referring website, interactions with the Site and cookie or similar-technology identifiers.

• Fraud and security data: information used to protect transactions, accounts and the Site, including risk indicators associated with an order, device or payment.

We collect personal data directly from you, automatically through your device and cookies, and from service providers involved in operating the Site, processing payments, preventing fraud, delivering orders and measuring advertising.

3. Why we use your personal data and our legal bases

We process personal data only where we have a lawful basis to do so.

Processing and delivering orders
We use identity, contact, order, customisation, transaction and limited payment data to process, manufacture, customise, deliver and manage your order. The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

Customer service
We use identity, contact, order and communications data to answer enquiries and provide order-related support. The legal basis is the performance of a contract and our legitimate interest in providing effective customer service.

Returns, refunds and legal rights
We use identity, contact, order, transaction and communications data to manage returns, refunds, complaints, legal guarantees and withdrawal requests. The legal basis is the performance of a contract and compliance with our legal obligations.

Accounting and tax records
We use identity, contact, order and transaction data to maintain invoices, accounting records and tax records. The legal basis is compliance with Spanish and other applicable legal obligations.

Security and fraud prevention
We use technical, account, transaction and fraud data to protect the Site, accounts and transactions and to prevent fraud or misuse. The legal basis is our legitimate interest in protecting our business and customers and, where applicable, compliance with legal obligations.

Operating and improving the Site
We use technical and usage data to operate, troubleshoot and improve the Site and understand its general performance. The legal basis is our legitimate interest where the processing is strictly necessary, and your consent where non-essential analytics cookies or similar technologies are used.

Newsletters and promotional communications
We use identity, contact, marketing and communications data to send newsletters and offers. The legal basis is your consent or, where permitted by law, our legitimate interest in marketing similar products to existing customers. You may opt out at any time.

Advertising measurement and personalisation
We use technical, usage and marketing data to personalise and measure advertising, including through Google and Meta services. The legal basis is your consent where required.

Legal claims and lawful requests
We use relevant identity, contact, order, transaction, technical and communications data to establish, exercise or defend legal claims and comply with lawful requests. The legal basis is compliance with legal obligations and our legitimate interest in protecting our legal rights.

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and balance our interests against your rights and reasonable expectations.

4. Cookies and similar technologies

The Site uses cookies and similar technologies to operate essential functions, remember preferences, understand Site usage and, where you consent, measure or personalise advertising.

Essential cookies may be used without consent where they are necessary to provide the Site, keep it secure, maintain your shopping cart or complete checkout. Non-essential analytics and advertising cookies are used only where permitted and, where required, after you have given consent through our cookie-consent tool.

Depending on your consent choices, these technologies may involve Shopify and services supplied by Google and Meta. You can accept, reject or change your non-essential cookie choices using the privacy or cookie controls available on the Site. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

More detailed information about individual cookies, their purposes and duration is provided through the Site’s cookie controls or cookie information page.

5. Marketing communications

If you subscribe to receive marketing communications, we use your contact details to send you news, product information and offers. You may unsubscribe at any time by clicking the unsubscribe link in any marketing email or by contacting info@cyclingartisan.com.

We may send existing customers information about products similar to those previously purchased where the law permits us to do so. Every promotional message will provide a simple way to opt out. Service messages relating to an order, account, safety issue or legal matter are not marketing messages and may still be sent where necessary.

6. How we share personal data

We disclose personal data only where necessary for the purposes described in this Policy. Recipients may include:

• Shopify, which provides our ecommerce platform, checkout, hosting, store analytics and related services.

• Payment providers and financial institutions involved in authorising, processing or refunding your payment.

• Delivery and logistics providers, including Sendcloud, Correos, UPS and relevant postal or delivery partners, in order to prepare, track and deliver orders.

• Analytics and advertising providers, including Google and Meta, where their services are active and the required consent has been obtained.

• Email, communications, IT, hosting, security and customer-support providers that help us operate the business and communicate with you.

• Accountants, tax advisers, lawyers, insurers and other professional advisers where access is necessary for their services.

• Public authorities, regulators, courts or law-enforcement bodies where disclosure is required by law or necessary to protect legal rights.

• A purchaser or successor to the business, if all or part of the business is sold, transferred or reorganised, subject to appropriate confidentiality and data-protection measures.

Service providers acting on our behalf are permitted to process personal data only for authorised purposes and under appropriate contractual and security obligations. Some providers, such as payment services, may also act as independent controllers for their own legal and regulatory purposes. Their privacy notices apply to that processing.

We do not sell personal data for money. Certain advertising-related disclosures may be treated as “sharing,” “sale” or targeted advertising under the laws of some jurisdictions. Where applicable, you can exercise the relevant choice through the Site’s privacy controls.

7. International transfers

Some of our service providers operate or store data outside the European Economic Area (EEA), including in the United States, Canada and the United Kingdom.

Where personal data is transferred outside the EEA, we use a transfer mechanism recognised by applicable data-protection law. This may include an adequacy decision adopted by the European Commission, participation in an approved data-protection framework, the European Commission’s Standard Contractual Clauses, or another lawful safeguard. Additional technical and organisational measures may be used where appropriate.

You may contact us for further information about the safeguards relevant to a particular transfer.

8. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the relevant purpose, including to meet accounting, tax, consumer-protection and other legal obligations and to establish or defend legal claims.

In general:

• Order, invoice and accounting records are normally retained for the applicable statutory period, which may be up to six years or longer where another legal obligation or active claim requires it.

• Customer-service and order communications are retained for as long as necessary to manage the order, complaint, guarantee or potential legal claim.

• Customer-account information is retained while the account remains active and for a reasonable period afterwards, unless earlier deletion is appropriate or continued retention is legally required.

• Marketing data is retained until you unsubscribe or withdraw consent, after which we may retain minimal suppression information to ensure that your opt-out is respected.

• Cookie and analytics data is retained for the periods indicated in the relevant cookie controls or by the applicable provider, subject to your consent choices.

• Fraud and security information is retained for a proportionate period necessary to prevent misuse and protect transactions.

When personal data is no longer required, we delete it, anonymise it or securely restrict its use until deletion is possible.

9. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• obtain confirmation of whether we process your personal data and request access to it;

• request correction of inaccurate or incomplete personal data;

• request deletion of your personal data;

• request restriction of processing;

• object to processing based on legitimate interests, including profiling based on those interests;

• object at any time to processing for direct marketing;

• receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller;

• withdraw consent at any time where processing is based on consent; and

• receive information about, and where applicable challenge, a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise a right, contact info@cyclingartisan.com. We may request information reasonably necessary to verify your identity. Exercising your rights is normally free of charge. We will respond within the period required by applicable law.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) at www.aepd.es, or with another competent supervisory authority where applicable. We would appreciate the opportunity to address your concern directly first, although you are not required to contact us before making a complaint.

10. Automated fraud screening

We and our payment or ecommerce providers may use automated indicators to identify transactions that may involve fraud, misuse or security risks. These indicators can contribute to a review, request for additional information, payment refusal or order cancellation.

Where applicable law gives you rights concerning a decision based solely on automated processing that produces legal or similarly significant effects, you may request human intervention, express your point of view and contest the decision by contacting us.

11. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. However, no internet transmission or storage system can be guaranteed to be completely secure.

You are responsible for keeping any account password confidential. Please contact us if you believe that an account or transaction involving your data has been compromised.

12. Children’s privacy

The Site is not directed at children, and we do not knowingly collect personal data from children who cannot lawfully provide it. If you believe that a child has provided personal data to us without the required authorisation, please contact us so that we can take appropriate action.

13. Third-party websites and social media

The Site may link to websites, applications or social-media services operated by third parties. We are not responsible for their independent privacy practices. Please review the relevant third party’s privacy notice before providing personal data to it.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, services or legal obligations. The current version will be published on this page with its latest revision date. Where required, we will provide additional notice of material changes.

15. Contact us

For questions about this Privacy Policy, our use of personal data or the exercise of your rights, contact:

Andrew Westacott, trading as Cycling Artisan
Email: info@cyclingartisan.com
Postal address: Passeig de sa Creu 5, 07316 Moscari, Illes Balears, Spain