Cookie Policy of Whistle Bikes

1. What Are Cookies

Cookies are small text files sent by the website to the user’s browser and stored on their device. They enhance browsing experience by remembering preferences, optimizing functionality, and—with explicit consent—collecting usage or profiling data.

2. Types of Cookies Used

2.1 Technical Cookies

Purpose: ensure site functionality and remember navigation preferences (e.g., language, banner settings).

Legal Basis: Article 6(1)(b) GDPR and Article 122(1) Italian Privacy Code.

Mechanism: the site uses browser localStorage to save consent preferences. No HTTP technical cookies are set.

2.2 Analytics Cookies

Purpose: collect anonymous, aggregated traffic data to optimize content and services.

Legal Basis: Article 6(1)(a) GDPR (explicit consent).

Example: Google Analytics 4 (GA4).

2.3 Marketing & Profiling Cookies

Purpose: track user interests to display targeted ads on this and other sites.

Legal Basis: Article 6(1)(a) GDPR (explicit consent).

Examples: Google Ads cookies, Facebook Pixel, DoubleClick.

3. Purposes and Legal Basis by Category

4. Detailed List of Cookies/Trackers

^** Only set after explicit consent for marketing cookies.

5. Third-Party Tools

Google Analytics 4 (GA4): Google Ireland Ltd. – anonymized IP, loaded only after consent.

Google Tag Manager: asynchronous tag management, blocked by default (Consent Mode v2).

Jetboost: search and filtering features (uses localStorage, no HTTP cookies).

Webflow: hosting and CMS (no cookies for core functionality).

6. Consent Management

Consent Platform (CMP): internally implemented, IAB TCF 2.2 certified, external audit.

Cookie Banner: appears on first visit; distinguishable; “X” button top-right to close without non-technical cookies; buttons “Accept All,” “Reject All,” “Save Preferences” (identical styling); one-click link to “Cookie Preferences.”

Script Loading: all tracking tags (GA4, Ads, Pixel) loaded only after JavaScript event ConsentGiven. Consent Mode v2 initialized with analytics_storage:'denied' and ad_storage:'denied', then updated to 'granted' upon consent.

7. Compliance Measures

Preventive Blocking: no non-technical cookies set until explicit consent.

Consent Mode v2: default denied, automatic update after consent.

IP Anonymization: gtag('config',…) includes anonymize_ip:true.

Server-Side Tracking (recommended): additional control over transmitted data.

8. Extra-EU Data Transfers

Google Ireland Ltd.: data processed in EU; any US transfers under EU-US Data Privacy Framework and Standard Contractual Clauses, compliant with Schrems II.

Other third parties: transfers outside EU only under adequacy decisions or equivalent safeguards.

9. User Rights

Users may at any time:

• Access, rectify, or delete personal data;
• Restrict or object to processing;
• Request data portability;
• Withdraw consent for analytics and marketing cookies;
• File a complaint with the Data Protection Authority.

To exercise rights, use the “Cookie Preferences” link on any page or write to:

10. Final Notes

This document is available in both Italian and English and will be reviewed periodically to stay up-to-date with regulatory changes.