PEGO.CC privacy and cookie policy

Updated: 15 October 2026. This policy explains how we process data when you use pego.cc, my.pego.cc and our services. Using the website does not constitute consent to marketing.

1. Controller and contact

The controller is Club Cyclista iFON Pego, CIF/NIF G70826771, C. de la Puríssima 5, 03780 Pego (Alicante), Spain, trading as PEGO.CC. Contact: [email protected], +34 961 167 350. For data protection and exercising your rights: Robert Kalandyk, [email protected].

2. Data we receive

We process contact details, information needed to book and deliver the services you order, billing information, correspondence and materials you provide. These may come from you, your group organiser, booking platforms (Booking.com, Beds24) and payment provider Stripe. We do not store your full payment card number. We collect guest registration and contract details as required for the service and by law.

Our websites also process technical data, including IP addresses, browser and activity information, cookies and measurement identifiers according to consent settings. We use health or allergy information for agreed assistance only with explicit consent; including it in a message does not itself provide that consent.

3. Purposes and legal bases

  • Handling enquiries, bookings, stays, rentals, transfers, meals and payments — a contract or steps before entering into one (GDPR Article 6(1)(b)).
  • Accounting and mandatory guest registration — legal obligations (Article 6(1)(c)).
  • Security, protecting equipment, preventing abuse, handling correspondence and legal claims — the controller’s legitimate interests (Article 6(1)(f)).
  • Newsletters, optional analytics and advertising measurement — consent (Article 6(1)(a)); health and allergy information — explicit consent (Article 9(2)(a)).

Without data required for the contract or by law, we may be unable to provide the service. Marketing consent is optional and is not a condition of booking or payment.

4. Who receives data

As needed for each purpose, we use hosting and website security providers (Hetzner, Cloudflare), email and communication services (Google Workspace/Gmail, Meta/WhatsApp), booking services (Beds24, Booking.com), payments (Stripe), newsletters (Mailchimp/Intuit, Google), AI tools (OpenAI, Anthropic), flight information (FlightAware), and analytics and advertising services (Google Analytics, Google Ads, Meta). Data is also received by authorised staff, providers of staff notifications, partners delivering the services you order, including accommodation, and public authorities where required by law.

5. Tools supporting customer service

We use AI for translation, transcription, summaries and draft replies. OpenAI or Anthropic may receive personal data contained in correspondence, recordings and attachments, together with information needed to assist you. Please do not send unnecessary identity documents or sensitive data. Staff remain responsible for customer service; you can request contact with a person and object to the use of AI. Stripe uses automated risk assessment that may result in a payment being declined; please contact us if this occurs.

6. Data outside the European Economic Area

Global providers, including Google, Meta, Stripe, Mailchimp, OpenAI, Anthropic and FlightAware, may process data outside the EEA, particularly in the USA. Depending on the service and recipient, the applicable safeguard is an adequacy decision (including the EU–US Data Privacy Framework for a covered recipient) or the European Commission’s standard contractual clauses. For information on applicable safeguards and how to obtain a copy, contact [email protected].

7. How long we keep data

Retention depends on the purpose: commercial and accounting records — generally 6 years from the last accounting entry; guest registration records — 3 years after the service ends, subject to specific legal requirements. We keep correspondence, contracts and other service records for the time needed to resolve the matter, meet legal obligations and establish or defend claims. These periods do not mean that all guest data is automatically deleted together.

Selected service data has the following periods: meal and dietary choices and addresses used solely for transfers — 30 days after the service; booking carts, draft replies and cleaning records — 90 days; assistant conversations — 183 days; bicycle feedback — 365 days before anonymisation; internal statistical data on bookings, campaigns and first payments — 395 days; technical logs — 14–90 days, depending on their type. Newsletter data is used until you unsubscribe; a limited record of your opt-out helps us respect it.

For the advertising measurement described below: measurement signals — up to 30 days; transmission records — up to 90 days; consent records — up to 24 months.

8. Cookies, analytics and advertising measurement

Cookies and similar browser storage support the website, remember your choices and — with consent — enable analytics and advertising measurement. You can reject optional categories or change them in “Cookie settings”; you can also delete website data in your browser. Choices on pego.cc and my.pego.cc are separate.

  • Operation and security (PEGO, Cloudflare): language and forms — a session or up to 1 day; application session — until expiry or logout (setting: 170 hours); other security storage depends on the protection mechanism.
  • Remembering consent (PEGO): up to 182 days on pego.cc and 365 days in the application; local storage synchronising your choice may remain until website data is deleted.
  • Analytics (Google Analytics): website usage statistics; cookies for up to 730 days after consent.
  • Advertising measurement (Google, Meta): linking a visit to an advertisement; cookies generally for up to 90 days after consent. Our supporting measurement markers last up to 48 hours; Google storage depends on the feature and consent settings.
  • Form draft and cart (PEGO): storage for the current tab until it closes.

Your browser may shorten these periods. Google may receive limited signals without analytics or advertising cookies even before consent or after refusal; this does not mean there is no connection to Google. The Meta pixel depends on advertising consent. External fonts, embedded content, form protection and payments may connect to a provider and disclose technical data, including an IP address. External services also have their own privacy information, including Google, Meta, Cloudflare and Stripe.

Booking measurement and optional matching

As of 15 October 2026, the booking payment measurement in my.pego.cc and email matching described here are disabled. The following terms apply once the features are available and the relevant consent has been obtained.

With advertising measurement consent, we share information about the first confirmed payment for a booking with Google Ads and Meta: amount and currency, time, a transaction pseudonym and an advertising click identifier; Meta also receives browser identifiers and browser type. The purpose is to assess advertising effectiveness. This measurement does not include remarketing or personalised advertising.

Matching with a platform user account requires separate consent, switched off by default. It involves sharing a cryptographic hash of the booking email address with Google Ads and Meta. The hash is not anonymous: a platform can compare it with its own user’s data. Matching consent is not required for measurement alone.

You can change or withdraw consent through the application’s cookie settings when available or by contacting us. Withdrawal stops further sharing within that scope; it does not automatically reverse earlier transmissions. Booking and payment remain available without either consent.

9. Your rights

You can request access to and a copy of your data, rectification, erasure, restriction and, where the law provides, data portability. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You can withdraw consent without affecting the lawfulness of earlier processing.

Write to [email protected] or [email protected]. We normally respond within one month, with extensions where permitted by law. You can complain to the Agencia Española de Protección de Datos or the supervisory authority where you live, work or believe an infringement occurred. We inform you of material changes to processing before they take effect.