Last updated: 25 October 2026
This policy explains how we process the personal data of visitors to www.area199.com and of users of the AREAbike app, under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and the Italian Privacy Code (Legislative Decree 196/2003). This English version is a translation: in case of discrepancy, the Italian version prevails.
1. Data controller
AREA199 di Antonio Petruzzi, Via Belvedere 34, 75025 Policoro (MT), Italy — VAT no. IT01451490773.
For any privacy matter: info@area199.com.
2. What data we process
Website
- Browsing data: IP address, browser type, pages visited, date and time, logged by the server to run and protect the site.
- Data you send us: messages by email or WhatsApp and answers to the triage form.
AREAbike app
- Account: first name, last name, email, sex, date of birth.
- Physical and performance data: weight, height, maximum and resting heart rate, power thresholds (FTP, critical power, W′).
- Health and recovery data: heart rate variability (HRV), resting heart rate, sleep duration and quality, energy or stress indices provided by devices, how you feel (energy, perceived sleep, stress), muscle soreness, therapies or medications you declare, and — only if you turn on tracking — menstrual cycle and related symptoms.
- Training data: activity files (for example FIT, TCX, CSV) with power, heart rate, cadence, duration, speed and, if the file contains it, GPS location data; training load, tests, goals, race calendar, notes.
- Subscription: status and expiry date. Payment data (card, account) is handled only by the payment provider, not by us.
- Technical data: app version and errors, for security and bug fixing.
Health data belongs to the “special categories” of Article 9 GDPR: we process it only with your explicit consent, which you can withdraw at any time.
3. Where the data comes from
- From you, when you enter it in the app or write to us.
- From the activity files you upload.
- From the devices and services you connect to the app (for example Garmin Connect, Health Connect on Android, Apple Health on iOS), only after your authorization. You can revoke a connection at any time, from the app or from the settings of the connected service.
- From your coach, if they follow you through the app.
4. Why we process it and on what legal basis
- Providing the service: assessing your morning recovery, proposing the day’s session, analysing completed training, keeping your history and load. Legal basis: performance of the contract (Art. 6.1.b) and, for health data, your explicit consent (Art. 9.2.a).
- The “Sports Director” comment: a commentary on your day generated by an artificial intelligence service, which receives the day’s data needed to write it. AI makes no training decisions: those are made by the app’s calculation engine. Same legal bases.
- Letting your coach follow you, if you choose so. Legal basis: consent.
- Subscriptions, invoices and tax obligations. Legal basis: legal obligation (Art. 6.1.c).
- Security of the site and the app and abuse prevention. Legal basis: legitimate interest (Art. 6.1.f).
- Replying to messages sent from the site. Legal basis: pre-contractual steps at your request (Art. 6.1.b).
We do not sell your data, we do not use it for advertising and we do not share it with third parties for their own purposes. We do not use your data to train artificial intelligence models.
5. Profiling and automated decisions
To propose the day’s training, the app processes your data automatically (profiling for training purposes). These proposals produce no legal effects or similarly significant effects: you can always choose the duration, correct your data and ask for human review by writing to info@area199.com. The app does not replace medical advice.
6. Who processes data on our behalf
We use providers appointed as data processors (Art. 28 GDPR), who process data only as needed for the service and on our instructions:
- Google (Google Workspace / Google Cloud): storage of app data.
- OpenAI: generation of the Sports Director’s comment.
- Server provider running the app.
- Aruba S.p.A.: website hosting and email.
- Tally: the site’s triage form.
- Payment providers (for example Google Play) for subscriptions.
The manufacturers of the devices and platforms you connect (for example Garmin) process data in their own services as independent controllers, under their own privacy policies: they send us only what you authorize. Data may be disclosed to authorities when required by law.
7. Transfers outside the European Union
Some providers (for example Google and OpenAI) are based in the United States. Transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on the Standard Contractual Clauses approved by the Commission.
8. How long we keep data
- App data: while your account is active. After a deletion request or account closure we delete it within 30 days; backups are overwritten within the following 90 days.
- Data received from a connected device or service: if you revoke the connection we stop receiving it; data already received stays in your history until you ask us to delete it.
- Billing data: 10 years, as required by law.
- Website browsing data: up to 12 months.
- Messages: as long as needed to reply and manage the relationship.
9. Minors
In Italy, users under 14 may use the app only with the consent of the holder of parental responsibility; other countries may set a different age. For under-18 athletes the app applies specific safeguards in the training proposal.
10. Your rights
At any time you can request access to your data, rectification, erasure, restriction of processing and portability (a copy of your data in a machine-readable format), and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting the lawfulness of prior processing; without health data, however, the app cannot calculate your training. Write to info@area199.com: we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the authority of your country.
11. Security
We protect data with encrypted connections (HTTPS), access through personal credentials, permissions limited to what is strictly necessary and a log of administrative operations.
12. Cookies
The site uses only technical cookies. Details are in the cookie policy.
13. Changes
We may update this policy. The date at the top shows the latest version; we notify you in the app of any significant change.