Privacy Policy (GDPR)

1. Data Controller

The Data Controller for personal data collected through the website spiderracing.it is:

2. Categories of Personal Data Collected

Through website browsing and e-commerce services, Spider S.r.l. may collect the following categories of data:

• Identification & Contact details: first name, last name, email address, phone number, shipping address, and billing address.
• Fiscal & Billing information: Tax identification number, VAT number, company legal name for invoice issuance.
• Transactional & Payment details: transaction reference codes (e.g., PayPal transaction ID, bank transfer receipt, credit card authorization token). No full credit card numbers or CVV security codes are stored on Spider Racing servers, as payments are processed via PCI-DSS compliant gateways.
• Browsing & Technical logs: IP addresses, browser types, timestamps, accessed pages, and server diagnostics collected for security and system stability.
• Motorcycle Model Preferences: motorcycle make, model, and manufacturing year selected in the garage selector to filter part compatibility.

3. Purpose and Legal Basis for Processing

Personal data is processed strictly for the following purposes:

1. Sales Contract Execution & Logistics: processing online orders, packaging and dispatching racing parts via express courier, customer order status notifications, and after-sales support (Legal basis: Art. 6.1.b GDPR — contract execution).
2. Legal and Fiscal Compliance: invoicing, accounting records, statutory warranty management, and compliance with EU/national tax laws (Legal basis: Art. 6.1.c GDPR — legal obligation).
3. Security & Fraud Prevention: web infrastructure protection, prevention of cyber attacks, and fraud prevention on online transactions (Legal basis: Art. 6.1.f GDPR — legitimate interest).
4. Marketing Communications & Newsletter (Optional): sending technical racing catalogs, product releases, and promotions upon explicit opt-in consent (Legal basis: Art. 6.1.a GDPR — user consent, revocable anytime).

4. Data Recipients & Third-Party Disclosures

Personal data is never sold or publicly distributed. Data may be shared with trusted third parties designated as Data Processors (Art. 28 GDPR):

• Express Couriers & Logistics Providers: DHL, UPS, TNT, GLS, FedEx for physical package delivery worldwide.
• Payment Gateways & Banking Institutions: Stripe, PayPal, banking partners for transaction clearing.
• Accounting & Legal Advisors: certified public accountants and legal counsels for regulatory compliance.
• IT & Cloud Infrastructure Providers: web hosting, database maintenance, and email server providers.

5. Data Retention Period

Personal data is retained only for the duration necessary to fulfill the intended purposes:

• Order & Invoicing records: 10 years as mandated by statutory accounting and commercial laws.
• User Account data: retained until user deletion request or after 36 months of continuous inactivity.
• Newsletter & Marketing data: 24 months from collection or until user unsubscribe/opt-out.

6. Data Subject Rights (GDPR Artt. 15-22)

Under EU Regulation 2016/679, users have the right to request at any time:

• Right of Access (Art. 15): obtain confirmation of whether personal data is being processed and receive a copy.
• Right to Rectification (Art. 16): request correction of inaccurate or incomplete records.
• Right to Erasure / Right to be Forgotten (Art. 17): request data deletion when processing is no longer required.
• Right to Restriction (Art. 18): request temporary suspension of data processing.
• Right to Data Portability (Art. 20): receive personal data in a structured, commonly used machine-readable format.
• Right to Object (Art. 21): object to processing for legitimate grounds or direct marketing.

To exercise your rights, contact us at: privacy@spiderracing.it.

You also have the right to lodge a complaint with your competent National Data Protection Supervisory Authority (in Italy: Garante Privacy — www.garanteprivacy.it).