Giro D’Europa / Information
Privacy Notice
Effective and last updated: 2026-09-29
Operator: [OWNER ACTION REQUIRED: confirm the legal operator’s name], publishing under the name Giro D’Europa. Giro D’Europa is an independent personal road-trip and media project. It is not currently operated as a business.
Contact: contact form. Privacy email: [OWNER ACTION REQUIRED: confirm a monitored privacy email address]
What this notice covers
Giro publishes road-trip stories, photography and live route updates. The public signup form is a mailing list, not a trip application or booking. We do not offer member accounts. This notice describes the website code and configured services; unresolved operator details are marked explicitly.
Information and purposes
| Information | Use and basis |
|---|---|
| Email, optional name, chosen interest and signup time | Occasional Giro news, Road Books, events and product updates only when you choose to subscribe. Basis: your consent. We store the wording/version and time of consent and any withdrawal. |
| Contact email, optional name and message | Responding to your enquiry, privacy request or complaint. No marketing enrolment. [OWNER ACTION REQUIRED: confirm whether legitimate interests in responding to enquiries or steps you request before a contract apply, and document the assessment.] |
| Network information and admin session | Providing and securing the website, throttling abuse and authenticating administrators. Rate-limit keys are hashed in memory and expire after ten minutes; the hosting provider may keep request logs. [OWNER ACTION REQUIRED: confirm the security legitimate-interests assessment and hosting log policy.] |
| Precise and approximate route coordinates, timestamps, place labels, trip details | Authorised trackers/administrators send location updates. Precise points are private; the live map normally publishes delayed, displaced points. They may still identify participants. [OWNER ACTION REQUIRED: confirm the participant notice, permission arrangements and lawful basis before tracking.] |
| Published photographs, contributor/driver names, car details and captions | Telling the story of the trips. Content comes from the operator and contributors. [OWNER ACTION REQUIRED: confirm publication basis, contributor permissions and media licences, and review identifiable bystanders.] |
Where information comes from
You provide form information directly. Authorised trackers, administrators and contributors provide route and archive content. Normal technical request information comes from your browser. We do not buy audience lists or operate an advertising/analytics tracker in this codebase.
Who receives information
Authorised Giro operators can access enquiries, subscribers and precise locations. Hosting is configured for Render. A configured Google Apps Script/Sheets webhook receives mailing-list submissions; the configured SMTP email service delivers confirmations and messages to the operator. The provider selected in the production settings must be confirmed by the operator; the repository’s Zoho example is not proof it is in use.
Public live maps request tiles from OpenStreetMap. If a route-routing service is configured, it receives simplified approximate route points. It does not receive the raw-location database. Fonts are hosted on this site. YouTube and Instagram links take you to their own services only when followed.
Stripe checkout code exists but sales are disabled by default and current local products are not on sale. If the operator opens checkout after the required sales review, Stripe handles payment details on its hosted page; Giro must update the applicable sales and privacy information. The application does not collect or store full card numbers or CVCs.
International transfers
[OWNER ACTION REQUIRED: confirm actual host, email and Google account regions, contracts and any UK transfer safeguards]. Provider locations cannot be established from the website alone. Do not assume an EU hostname means all processing stays in the UK, or that a provider contract by itself establishes an appropriate transfer safeguard.
How long information is kept
Admin sessions expire after eight hours and server restart; rate-limit entries expire after ten minutes. Cookie/storage durations are listed in our storage notice. Enquiries and signup copies in mailboxes/Sheets follow the operator’s retention controls. Consent/withdrawal evidence and live-trip locations currently require operator review and deletion; they do not have an automatic deletion schedule. Media can remain in the archive and backups. [OWNER ACTION REQUIRED: approve and implement the retention schedule in docs/data-retention.md]
A minimal record of an unsubscribe may be kept to avoid contacting someone who has opted out. Deleting a working record does not immediately remove every backup or external copy; the operator must include those in the retention process.
Your choices and rights
You can withdraw email-marketing consent at any time. This does not affect the lawfulness of earlier use or stop essential replies you request. Ask through the contact form for access, correction, deletion, restriction, objection or portability where the relevant right applies. We may need proportionate information to verify identity; do not send identity documents unless requested through an agreed secure method. Some rights depend on the purpose and legal basis.
Complaints
Send a privacy complaint using the contact form, identifying it as a data protection complaint. The operator must acknowledge it within 30 days and investigate/respond without undue delay. You may also complain to the Information Commissioner’s Office. A rights request is a separate process, generally due within one month subject to applicable legal exceptions.
Automated decisions and storage
No solely automated decisions with legal or similarly significant effects, advertising profiling or customer scoring were found. Rate limits and route calculations are technical functions. See Cookies and storage and Cookie settings for choices.