Privacy policy

Last updated: 15/07/2026

1. Data Controller

  • Controller: Turboebike 2018 SL ("IBKBIKE")
  • Tax ID: ESB75211482
  • Address: Polígono Benta-Aldea, 26, 20270 Anoeta, Gipuzkoa, Spain
  • Phone: +34 843 99 99 53
  • Email (privacy and support): clients@ibkbike.com

2. Websites and scope This Policy applies to the processing of personal data carried out by IBKBIKE through its websites and domains of the IBKBIKE brand, including browsing, purchasing as a guest or with registration, customer service, returns, warranties and communications. This Policy applies to ibkbike.com and any other domains, subdomains or national/market versions operated by IBKBIKE under the IBKBIKE brand, including among others: ibkbike.es .com .fr .de .uk .ch .at .eu This definition includes any domain or market that IBKBIKE enables in the future under the IBKBIKE brand, without needing to update this list for the Policy to apply.

3. What personal data we process Depending on your use of the site, IBKBIKE may process:

  1. Identification and contact data: first name, last name, email, phone.
  2. Shipping and billing data: address, country, postcode, city.
  3. Purchase data: products, order history, returns, warranties, incidents and associated communications.
  4. Payment data (minimal): IBKBIKE does not store complete card data. Payments are handled via Shopify Payments (which accepts card, Google Pay, Apple Pay and other methods enabled by this gateway), PayPal and, where applicable, financing providers such as Scalapay or Cetelem. IBKBIKE receives payment confirmation/status and transaction identifiers, not the full card data.
  5. Technical browsing data (logs): IP, date/time, requested URL, referring URL, browser/device, operating system and data necessary for security and operation.
  6. Marketing and preference data: newsletter subscription/unsubscription, preferences and associated metrics (e.g. opens/clicks) where applicable.
  7. Data provided to support: messages, documentation and evidence (for example, photos of packaging/product in the event of an incident).

IBKBIKE does not, as a general rule, request particularly sensitive data.

4. Why we process your data and on what legal basis

A) Site management, security and operation – Purpose: to enable browsing, keep the site stable/secure, prevent misuse and fraud and carry out technical maintenance. – Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

B) Account registration and guest purchase – Purpose: to create/manage your account (if you create one) or process purchases as a guest. – Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

C) Management of orders, payments, shipments, returns and warranties – Purpose: to process the order, send confirmations, manage delivery, returns, refunds, warranties and after-sales service. – Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR) where applicable (tax/accounting/consumer law).

D) Customer service and complaints – Purpose: to answer queries, manage incidents, complaints and communications. – Legal basis: performance of a contract (Art. 6(1)(b)) and/or legitimate interest (Art. 6(1)(f)).

E) Newsletter and commercial communications (Klaviyo) – Purpose: to send you promotional communications, news, reminders, recommendations or campaigns via our marketing automation platform (Klaviyo). – Legal basis: consent (Art. 6(1)(a) GDPR). You may unsubscribe at any time via the link included in each email or by writing to clients@ibkbike.com.

F) Analytics, measurement and advertising (Google Analytics / Meta Pixel / Google Ads) – Purpose: audience measurement, attribution, usage analytics and advertising/remarketing. – Legal basis: consent via the cookie/consent system, where required. These technologies are governed in more detail in the Cookie Policy, where you can accept, reject or withdraw your consent.

5. Mandatory data To process an order and provide the service, certain data are necessary (for example, delivery address, email and phone number). If you do not provide them, IBKBIKE will not be able to correctly manage the order or delivery.

6. Recipients: to whom we may disclose your data IBKBIKE may disclose or allow access to personal data only when necessary for the provision of the service:

  1. E-commerce platform: Shopify (technical operation of the store, order management, checkout and hosting of the WEBSITE). In addition to the processing Shopify carries out on IBKBIKE's behalf, Shopify also processes certain data on its own account as platform provider to operate and improve its services, in accordance with its own Privacy Policy for platform users, independent of this Policy.
  2. Payments: Shopify Payments, PayPal.
  3. Financing/instalment payment (if you choose this option): Scalapay, Cetelem.
  4. Marketing automation / newsletter: Klaviyo.
  5. Analytics and advertising: Google Analytics / Google Ads (Google) and Meta Pixel (Meta).
  6. Carriers and logistics: for delivery and management of shipping incidents.

IBKBIKE requires its providers to make confidentiality commitments and, where applicable, to sign data processing agreements in accordance with the GDPR.

7. International data transfers Some of the technology and advertising providers we use operate globally, so certain data may be processed or accessed from outside the European Economic Area. In particular:

  • Shopify: the e-commerce platform is operated by Shopify Inc. (Canada/USA) and Shopify International Ltd. (Ireland). The processing of European customers' data is carried out in accordance with Shopify's contractual commitments, which include Standard Contractual Clauses (SCCs) for transfers outside the EEA.
  • Google (Analytics/Ads) and Meta (Pixel): both companies are based in the USA and may process data outside the EEA in accordance with their own transfer mechanisms (SCCs and/or applicable adequacy frameworks).
  • Klaviyo: US-based company; transfers are carried out in accordance with Standard Contractual Clauses.

Where international transfers exist, IBKBIKE relies on valid GDPR mechanisms, such as: adequacy decisions, where applicable, and/or Standard Contractual Clauses (SCCs) and additional measures where necessary.

8. Retention periods We retain data for as long as necessary for the stated purposes and, thereafter, for the legally required periods:

  • Orders, billing and accounting: for the applicable retention and limitation periods.
  • Customer service/incidents: the time needed to resolve the incident and, where applicable, during limitation periods for claims.
  • Newsletter/marketing (Klaviyo): until you withdraw your consent or request unsubscription.
  • Technical logs: the strictly necessary time for security and diagnostic reasons, or longer if required to investigate incidents.

9. Users' rights You may exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent. To do so, write to clients@ibkbike.com stating the right you wish to exercise and the information needed to identify you. If there are reasonable doubts about your identity, IBKBIKE may request additional information strictly necessary to verify it and prevent unauthorised access or actions. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD).

10. Automated decisions As a general rule, IBKBIKE does not make automated decisions that have legal effects on the user. If automatic mechanisms are applied in certain cases (for example, fraud prevention), they will be used proportionally and, where applicable, additional information and a review channel will be provided.

11. Security IBKBIKE applies reasonable technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. No system is, however, completely infallible. In the event of a personal data breach that poses a risk to your rights and freedoms, IBKBIKE will notify the Agencia Española de Protección de Datos (AEPD) and, where applicable, the affected individuals, in accordance with Articles 33 and 34 of the GDPR.

12. Minors The WEBSITE is not aimed at minors. The purchase of products is reserved for adult natural persons acting as end consumers, in accordance with the General Terms and Conditions of Sale. If IBKBIKE were to learn that personal data of a minor had been collected without the consent of their parents or legal guardians when legally required, it will proceed to delete them as soon as possible. If you are a parent or legal guardian and believe your child has provided us with data without your consent, contact us at clients@ibkbike.com.

13. Cookies The WEBSITE uses cookies and similar technologies (including, where applicable, analytics and advertising cookies). For more information and to configure/withdraw your consent, see the Cookie Policy.

14. Changes to this policy IBKBIKE may update this Policy to adapt it to legal or technical changes. The current version will be available on the WEBSITE.