Privacy Policy

1. Data Controller

Data Controller: Turboebike 2018 S.L. (“IBK” / “IBKBike” / “IBKSport”) Tax ID: ESB75211482 Address: Errekalde Industrial Park 1, No. 24 — 20160 Lasarte, Gipuzkoa, Spain Phone: +34 843 99 99 53 Email (privacy): clients@ibkbike.com

2. Websites and Scope of Application

This Policy applies to the processing of personal data carried out by IBK through all its websites and domains, including browsing, purchases as a guest or registered user, customer service, returns, warranties, and communications.

Domains operated by IBK:

  • ibkbike: .es .com .fr .de .uk .ch
  • ibksport: .es .eu .fr .de .uk .com .nl .ch

3. What Personal Data We Process

Depending on how you use the site, IBK may process:

  1. Identifying and contact information: first name, last name, email, phone number.
  2. Shipping and billing information: address, country, ZIP code, city.
  3. Purchase information: products, order history, returns, warranties, issues, and related communications.
  4. Payment data (minimum): IBK does not store full card details. Payments are processed through specialized providers (Stripe, PayPal, and, if applicable, Scalapay or Cetelem). IBK only receives payment confirmation/status and transaction identifiers.
  5. Technical browsing data: IP address, date/time, requested URL, referring URL, browser/device, operating system, and other data necessary for the security and operation of the site.
  6. Marketing data and preferences: newsletter subscription/unsubscription, preferences, and associated metrics (opens, clicks) where applicable.
  7. Data provided via support channels: messages, documentation, and evidence (for example, photographs of the packaging or the product in the event of an incident).
  8. Ratings and reviews: If you post a rating through Trustpilot or other integrated platforms, those platforms will process your data in accordance with their own privacy policies.

IBK does not collect or process special categories of sensitive data.

4. Purposes and Legal Bases for Processing

A) Technical Operation, Security, and Fraud Prevention To enable navigation, maintain a stable and secure website, prevent misuse, and perform technical maintenance. Legal basis: legitimate interest (Art. 6.1.f GDPR).

B) Account Registration and Guest Purchases To create and manage your account or process purchases as a guest. Legal basis: performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).

C) Management of Orders, Payments, Shipments, Returns, and Warranties To process orders, send confirmations, manage delivery, returns, refunds, warranties, and after-sales service. Legal basis: performance of the contract (Art. 6.1.b GDPR) and legal obligation (Art. 6.1.c GDPR) regarding tax, accounting, and consumer matters.

D) Customer service and complaints Respond to inquiries, manage issues, and handle communications. Legal basis: performance of the contract (Art. 6.1.b) and legitimate interest (Art. 6.1.f).

E) Newsletter and Marketing Communications: Sending you promotional communications, news, reminders, recommendations, or campaigns via Klaviyo and/or Connectif. Legal basis: consent (Art. 6.1.a GDPR). You can unsubscribe at any time by clicking the link included in each email or by writing to clients@ibkbike.com.

F) Analytics, Measurement, and Advertising Audience measurement, attribution, usage analytics, and advertising/remarketing through Google Analytics, Google Ads, and Meta Pixel. Legal basis: consent via the cookie management system (CMP), when required. You can manage or withdraw your consent at any time through the Cookie Policy.

5. Required Data

To process an order and provide you with the service, certain data is essential (shipping address, email, and phone number). If you do not provide this information, IBK will not be able to properly process the order or arrange delivery.

6. Recipients: Who We May Share Your Data With

IBK shares personal data only when necessary to provide the service:

  1. E-commerce platform: Shopify Inc. (technical operation of the store, orders, management).
  2. Payments: Stripe, PayPal.
  3. Installment financing (if you choose it): Scalapay, Cetelem.
  4. Marketing automation / newsletter: Klaviyo, Connectif.
  5. Analytics and advertising: Google Analytics / Google Ads (Google LLC) and Meta Pixel (Meta Platforms Ireland Ltd.).
  6. Review management: Trustpilot A/S.
  7. Carriers and logistics: for delivery and handling shipping issues.

IBK requires its suppliers to enter into confidentiality agreements and, where applicable, enters into data processing agreements in accordance with the GDPR.

7. International Data Transfers

When using global technology and advertising providers (including Shopify, Google, Meta, and Klaviyo, with servers or access points in the U.S. or other countries outside the European Economic Area), some data may be processed outside the EEA.

In such cases, IBK relies on mechanisms valid under the GDPR:

  • Adequacy decisions recognized by the European Commission, where applicable.
  • Standard Contractual Clauses (SCCs) and additional measures where appropriate.

8. Retention Periods

  • Orders, billing, and accounting: 6 years in accordance with Spanish commercial and tax law, or the longer period required by the applicable regulations in each country.
  • Customer service and incidents: the time necessary to resolve the incident and, where applicable, for the duration of the statute of limitations for legal actions (minimum 3 years for contractual matters).
  • Newsletter / marketing: until you withdraw your consent or request to unsubscribe.
  • Technical browsing logs: maximum 12 months, unless it is necessary to retain them longer to investigate specific incidents.

9. Your Rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, data portability, and withdrawal of consent at any time.

To exercise these rights, please write to clients@ibkbike.com, specifying the right you wish to exercise and providing the necessary information to identify yourself. If there are reasonable doubts regarding your identity, IBK may request additional information strictly necessary to verify it.

You also have the right to file a complaint with the competent supervisory authority:

  • Spain and the EU (lead authority): Spanish Data Protection Agency (AEPD) — www.aepd.es
  • United Kingdom (.uk): Information Commissioner’s Office (ICO) — www.ico.org.uk
  • Switzerland (.ch): Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch

10. Minors

IBK’s services are not intended for minors under the age of 16. IBK does not knowingly collect or process data from minors under that age. If you become aware that a minor has provided data without parental consent, please contact us at clients@ibkbike.com so we can delete it.

11. Automated Decisions

In general, IBK does not make automated decisions that produce legal effects on the user. If automated mechanisms are used in any case (for example, for fraud prevention), they will be used proportionately, and additional information and a channel for human review will be provided.

12. Security

IBK implements reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure, including encryption in transit (TLS/HTTPS) and role-based access controls. In the event of a security breach that may affect you, IBK will act in accordance with the notification obligations set forth in the GDPR.

13. Cookies

The website uses cookies and similar technologies, including analytics and advertising cookies. For more information and to configure or withdraw your consent, please see our Cookie Policy.

14. Changes to This Policy

IBK may update this Policy to adapt it to legal, technical, or business changes. The current version, with its update date, will always be available on the website. In the event of substantial changes, we will notify you prominently.

For any privacy-related inquiries: clients@ibkbike.com