Privacy policy

This policy explains how Adapt Activ Solutions Limited, trading as Rock Cyclery, collects and uses personal data when you use www.rockcyclery.com, shop with us online or in store, book the workshop or contact us. We follow the Gibraltar GDPR and the Data Protection Act 2004, and, for customers in the EU, the EU GDPR.

1. Who is responsible for your data

The data controller is Adapt Activ Solutions Limited, company number 123648, registered office Suite 4, 2nd Floor, The West Wing, Montarik House, 3 Bedlam Court, Gibraltar GX11 1AA. Shop: 95A Harbours Deck, New Harbours, Rosia Road, Gibraltar GX11 1AA.

For anything about your data, email info@rockcyclery.com with "Privacy" in the subject.

2. What we collect and why

What Why we use it Legal basis
Name, email, phone, delivery and billing address, order details To take, deliver and support your orders, including returns and warranty claims Contract
Account details (name, email, password, optional title and date of birth) To run your customer account and order history Contract
Payment confirmation (we don't see or store full card details) To take payment online through SumUp, or in store Contract
Invoices, receipts and transaction records To keep accounts and meet tax and legal duties Legal obligation
Workshop bookings, bike details and notes To book, carry out and follow up workshop jobs, including reminders by email or WhatsApp Contract
Messages to us (contact form, email, WhatsApp) To answer you Contract or legitimate interests
Email address for newsletters and journal updates To send news, offers and event dates you've signed up for Consent (unsubscribe any time)
Website use, via analytics cookies To understand how the site is used and improve it Consent (see our cookie policy)
Technical data (device, browser, security checks) To keep the site secure and stop spam and fraud, including Google reCAPTCHA on forms Legitimate interests
Promo code and ambassador use, gift card balances To apply discounts fairly (for example once per person) and honour gift cards and credit notes Contract and legitimate interests

You don't have to give us your data, but we can't take an order or book a job without the details needed for it.

3. Who we share it with

Only the service providers we need, each bound to protect your data:

  • SumUp: card, Apple Pay and Google Pay payments;
  • Delivery partners: Royal Gibraltar Post and couriers (DHL, UPS, FedEx) when we send parcels;
  • Google: Google Analytics (only with your consent) and reCAPTCHA;
  • Microsoft: our business email (Microsoft 365);
  • WhatsApp (Meta): when you message us on WhatsApp;
  • Wise: our bank, for bank-transfer payments and refunds;
  • our website host, accountant and professional advisers, and authorities where the law requires it.

We never sell your data.

4. Data sent outside Gibraltar and the EU

Some providers (for example Google and Microsoft) may process data in the United States. Where they do, we rely on the EU–US Data Privacy Framework or standard contractual clauses to keep it protected.

5. How long we keep it

  • Orders, invoices and accounting records: 7 years, to meet tax and accounting rules;
  • Customer account: while it's open; if it isn't used for 3 years we may close it, keeping only what the law requires;
  • Workshop booking records: 3 years after the job, for warranty and service history;
  • Messages and enquiries: up to 2 years;
  • Newsletter: until you unsubscribe;
  • Cookie choices: 12 months in your browser; our record of your choice for 3 years.

6. Your rights

You can ask us to:

  • give you a copy of your data;
  • correct it;
  • delete it;
  • restrict how we use it;
  • send it to you or another organisation in a reusable format;
  • stop using it for direct marketing;
  • object to uses based on legitimate interests.

Where we rely on consent, you can withdraw it at any time: use the unsubscribe link in any email, or Cookie settings for cookies. Email info@rockcyclery.com to use any of these rights. We'll reply within one month.

If you're unhappy with how we handle your data, please tell us. You also have the right to complain to the Gibraltar Regulatory Authority (the data protection regulator), www.gra.gi, or, if you live in the EU, to the data protection authority in your country.

7. Security

We use secure connections (HTTPS) across the site, limit who can access customer data, and don't store full card numbers. Payments are handled by SumUp.

8. Children

Our online shop is for adults. We don't knowingly collect data from children under 16 without a parent or guardian.

9. Changes

We may update this policy. The latest version is always on this page.

Last updated: 29 October 2026.

Back to top