1. Who We Are

Cycling in Slovenia ("we", "us") operates the website cyclinginslovenia.com. We are the data controller for personal data collected through this Platform. Contact: info@cyclinginslovenia.com

2. Data We Collect

When you create an account, we collect:

• Full name and username
• Email address
• Profile photo (if uploaded)
• Strava profile URL and Instagram URL (if provided voluntarily)

When you use the Platform, we may also collect routes you create, routes you save or mark as ridden, and your preferences (e.g. privacy settings). We do not collect real-time location data, payment information, or sensitive personal data.

3. How We Use Your Data

We use your data for the following purposes:

• Operating your account and displaying your public profile and routes
• Sending service-related emails (e.g. password reset, account confirmation)
• Sending marketing emails with route recommendations and cycling tips — only if you have given explicit consent
• Improving the Platform

4. Marketing Communications

We will only send you marketing emails if you have given explicit consent. You can withdraw consent at any time through your account settings or by clicking "unsubscribe" in any marketing email. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, your personal data (name, email, profile photo) is deleted. Route data you have created may be retained in anonymised form.

6. Third-Party Services

We use the following third-party services that may process your data:

• Supabase — database and authentication provider. Your data is stored on Supabase infrastructure. Supabase acts as a data processor on our behalf.
• Vercel — website hosting provider.

We do not sell your personal data to third parties.

7. Cookies

We use cookies that are strictly necessary for the operation of the Platform (authentication session cookies). We do not currently use advertising or tracking cookies. If this changes, we will update this Policy and request your consent where required.

8. Your Rights under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data (you can do this directly in your account settings)
• Erasure — request deletion of your data (you can delete your account directly in settings)
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — for marketing emails, at any time

To exercise any of these rights, contact us at info@cyclinginslovenia.com. We will respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec) at ip-rs.si.

9. Data Security

We take reasonable technical measures to protect your data. However, no method of transmission over the internet is completely secure.

10. Children

The Platform is not directed at children under 16. We do not knowingly collect data from children under 16.

11. Changes to This Policy

We may update this Policy. We will notify registered users of material changes by email. The date of the latest update is shown at the top of this page.