Privacy policy • royalasport.eu · version November 2026
1. Data controller
Pyrenees Cycling Group, the trading name of Marc Duchesne, sole proprietor (SIREN 384 873 519), Quartier St-Michel, F-64360 Lucq-de-Béarn, France. Contact for any question about personal data and for the exercise of rights: contact@pyreneescycling.cc.
2. Data, purposes, legal bases and retention periods
| Processing | Data | Legal basis | Retention period |
|---|---|---|---|
| Operation and security of the website (connection logs) | IP address, browser, operating system, date and time, pages visited | Legitimate interest (Art. 6(1)(f) GDPR) | [period set by the hosting provider, to be completed], 12 months at most |
| Audience measurement with Google Analytics | Pages viewed, visit duration, device, origin | Consent (Art. 6(1)(a) GDPR) | Cookies: 13 months at most; data: [2 or 14 months depending on the setting] |
| Contact form and emails | Last name, first name, email, telephone, company, message | Consent or legitimate interest | 3 years after the last exchange |
| Newsletter | Email, first name, last name, date and IP address of registration | Consent (Art. 6(1)(a) GDPR) | Until unsubscription, then deletion or archiving for 3 years |
| Customer account, orders, quotes, invoicing | Identity, address, telephone, email, company, intra-community VAT number, purchase history | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | Duration of the commercial relationship + 5 years; accounting records 10 years |
| Payment | Identity, amount, order reference (bank details stay with the payment provider) | Contract (Art. 6(1)(b)) | According to the statutory periods of the provider and of accounting records |
| Delivery | Name, address, telephone, email | Contract (Art. 6(1)(b)) | Duration of order fulfilment + 5 years |
| Embedded Instagram feed | Browsing data transmitted to Instagram | Consent (Art. 6(1)(a) GDPR) | Duration of the consent, 6 months at most |
| Traffic measurement by the website platform (SiteAnalytics, Snowplow Analytics technology, IONOS) | Frequency of access, pages viewed, visit times | [to be confirmed according to the setting chosen in the editor: consent or legitimate interest] | [period set by IONOS, to be completed] |
| Display of the website fonts (Google Fonts) | IP address, browser, date and time of the font request | Consent (Art. 6(1)(a) GDPR) [to be adapted if the fonts are hosted locally] | Browser cache duration of the fonts |
| Strictly necessary cookies (cart, language, login) | Technical identifiers | Consent exemption | Session or 13 months at most |
Providing the data for the customer account and the order is mandatory to conclude and perform the sale. The other processing operations rest on the individual's choice.
3. Cookies and trackers
When the website first displays, a banner presents two buttons of equal prominence, "Accept all" and "Reject all", together with access to settings by purpose. Google Analytics, the embedded Instagram feed and the Google Fonts typefaces load after the visitor consents. The banner links to this single page, available at https://www.royalasport.eu/privacypolicy. The choice is kept for 6 months at most. The "Manage cookies" link in the footer lets visitors change it at any time. The browser settings offer an additional way to control cookies.
4. Recipients and processors
Depending on the processing operation, data is passed to the following recipients:
- IONOS [IONOS France, 7 place de la Gare, 57200 Sarreguemines]: website hosting and the SiteAnalytics traffic measurement tool;
- online shop platform: IONOS;
- newsletter tool: Intuit Mailchimp;
- payment providers: PayPal and Klarna;
- carriers in charge of delivery;
- Google Ireland Limited (Google Analytics and Google Fonts);
- Meta Platforms Ireland Limited (Instagram);
- accountant and public authorities, where the law requires it.
Pyrenees Cycling Group keeps personal data for its own operations and shares it only with the recipients listed above.
5. Transfers outside the European Union
Some providers (Google, Meta, technical platforms) may process data in the United States. These transfers rely on the adequacy decision of the EU-US Data Privacy Framework (July 2023) when the provider participates in it, or on the European Commission's standard contractual clauses.
6. Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability regarding your data, and the right to withdraw your consent at any time; withdrawal leaves the processing carried out before it valid. You may also define directions for the fate of your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, write to contact@pyreneescycling.cc, attaching proof of identity where necessary. The answer arrives within one month. You may unsubscribe from the newsletter at any time with the link included in every mailing.
You may also lodge a complaint with the CNIL: Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.
7. Security
Pyrenees Cycling Group applies suitable technical and organisational measures: encrypted connection (HTTPS), restricted access to data, and payments entrusted to certified providers.
8. Updates
The seller adapts this policy when its processing operations or the regulations evolve. The date of the last update appears at the bottom of the page.
Last updated: November 2026.
