Last updated: 23 October 2026
Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), this policy explains how we process the personal data of people who visit kalura-bikes.com, contact us, rent a bike or join a tour with Kalura Bike Station.
1. Data controller
Costa Caldura S.r.l. – operator of Hotel Kalura and Kalura Bike Station
Via Vincenzo Cavallaro 13 – 90015 Cefalù (PA), Italy
VAT no. (P.IVA) IT06497310828 · REA PA-325177
Email: bikes@hotelkalura.com · Phone/WhatsApp: +39 339 627 4001
No Data Protection Officer (DPO) has been appointed, as the company does not meet the criteria for a mandatory appointment.
2. What data we process and why
Browsing data
The servers hosting the site automatically log certain technical data (IP address, date and time, requested page, browser and operating system). This is needed to run the site and keep it secure. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). It is kept only as long as strictly necessary, unless needed to investigate criminal offences.
Enquiries by email or WhatsApp
The form on the Contact page does not store any data on our website: it composes a message that you send yourself via WhatsApp. If you write to us by email or WhatsApp, we process your name, contact details and the content of your message (dates, bike, tour, number of people) to reply and prepare your rental. Legal basis: pre-contractual steps at your request (Art. 6(1)(b)). We keep this data as long as needed to handle the enquiry and no longer than 12 months if no contract follows. WhatsApp is a service of WhatsApp Ireland Ltd. (Meta group), which processes data under its own privacy policy.
Bike rental and tours
For the rental contract we collect your first and last name, place of residence and postcode, room number or hotel, email, the rented bike, the rental period, price, deposit and advance payment, the accessories handed over and your signature. For tours we also process the details needed to organise them (number of participants, level, contact). Purposes: concluding and performing the contract and handling the deposit, any damage or theft, and accounting. Legal bases: performance of a contract (Art. 6(1)(b)), legal accounting and tax obligations (Art. 6(1)(c)) and our legitimate interest in protecting our rights (Art. 6(1)(f)). We cannot rent you a bike without this data. Contracts are kept for the duration of the rental and then for 10 years to meet accounting and tax obligations and to defend against claims.
3. Cookies and external services
The site uses no profiling cookies and no analytics tools. The only thing we store in your browser is your chosen language (technical local storage), which requires no consent.
The fonts are hosted directly on our own server, so no data is sent to Google or other third parties to display them.
4. Recipients
Your data is processed by authorised staff of the Bike Station and Hotel Kalura. It may be shared with providers acting on our behalf as processors (website hosting and maintenance, accounting and tax advisers) and with public authorities where required by law. We do not sell or pass on your data to third parties for marketing.
5. Transfers outside the EU
If you contact us via WhatsApp, WhatsApp/Meta may process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. Your rights
You can ask at any time to access, rectify or erase your data, restrict processing, receive your data (portability) and object to processing based on legitimate interest (Arts. 15–22 GDPR). Write to bikes@hotelkalura.com or to the postal address above. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
We do not make decisions based solely on automated processing, including profiling.
7. Changes
We may update this policy; the version published on this page always applies. For Hotel Kalura, the privacy policy published on hotelkalura.com applies.