Privacy & Cookie Policy

This policy describes how R.O.D GROUP (SASU, RCS Toulouse 102 658 499, registered office 22 rue de la Carrère, 31210 Le Cuing, France), operator of rideondistribution.com, collects, uses and protects users' personal data, in compliance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

R.O.D GROUP, represented by Valentin Larragneguy (President), is the controller of the personal data collected on the site.

Contact: contact@rideondistribution.com

2. Data collected

Depending on your use of the site, we may collect:

• Identification data: first/last name, email, postal address, phone (when ordering, contacting us, or booking a test ride);
• Order data: purchase history, viewed products, cart;
• Payment data: processed directly by our payment providers (Shopify Payments) — R.O.D GROUP stores no card data;
• Browsing data: IP address, browser type, pages visited, via cookies (see section 6).

3. Purposes

• Process and track your orders (management, delivery, customer service, right of withdrawal);
• Respond to contact requests or test-ride bookings;
• Send marketing communications (newsletters, offers) with your consent;
• Improve the site's operation and security;
• Comply with our legal and accounting obligations.

4. Legal basis

• Performance of the sales contract (GDPR art. 6.1.b);
• Consent (art. 6.1.a) for non-essential cookies and marketing communications;
• Legitimate interest (art. 6.1.f) for site security and improvement;
• Legal obligations (art. 6.1.c) for accounting records.

5. Recipients

Your data may be transmitted to:

• Shopify International Limited (online store, order data hosting) — Dublin, Ireland;
• Lovable Labs AB (technical hosting) — Stockholm, Sweden;
• Our carriers, for order delivery;
• Any authority legally entitled to request it.
• We do not sell or rent your personal data.
• Google Ireland Limited (Google Analytics 4 / Google Tag Manager) — Dublin, Ireland;
• Meta Platforms Ireland Limited (Meta Pixel) — Dublin, Ireland;
• TikTok Technology Limited (TikTok Pixel) — Dublin, Ireland;
• Google, Meta and TikTok may transfer data to the United States or other countries outside the EU. Google and Meta are certified under the EU-US Data Privacy Framework for covered transfers; where no applicable adequacy decision exists, including for TikTok, transfers are governed by European Commission Standard Contractual Clauses and the required supplementary safeguards.

6. Cookies

Audience-measurement cookies (Google Analytics 4) and marketing cookies (Meta Pixel, TikTok Pixel) are set only after consent to the relevant category. Optional categories are off by default; necessary cookies remain active. Google Tag Manager loads only after consent to at least one optional category.

The banner offers Accept all / Reject / Customize. The panel allows separate Audience measurement and Marketing choices, followed by saving. Detailed choices and their date are retained for no more than 13 months before consent is requested again. You can change or withdraw consent at any time through Manage cookies at the bottom of each page. Opening the panel does not change your choices. Choices and the notice version are stored locally with a visitor identifier; previous choices are preserved to document withdrawal.

Lovable Analytics: the platform injects its own navigation tracking (/__l5e/trackevents and /~api/analytics), which may send events before consent. We could not gate this tracking on Audience measurement from the site code. The panel therefore does not disable it; we do not describe it as anonymized or subject to this consent.

7. Retention

• Customer data: duration of the commercial relationship + 3 years for prospecting, then deleted or anonymized;
• Accounting records: 10 years (legal requirement);
• Prospect data with no order: 3 years from last contact.

8. Your rights

Under the GDPR, you have the following rights:

• Right of access, rectification and erasure;
• Right to restriction of and objection to processing;
• Right to data portability;
• Right to withdraw consent at any time.
• To exercise these rights, contact us at contact@rideondistribution.com. You also have the right to lodge a complaint with the French CNIL (www.cnil.fr) or with your national supervisory authority.

9. Security

R.O.D GROUP implements appropriate technical and organizational measures to protect your data against loss, unauthorized access, disclosure or destruction. The site is secured via an SSL certificate (HTTPS).

10. Transfers outside the EU

Google, Meta and TikTok may transfer data to the United States or other countries outside the EU. Google and Meta are certified under the EU-US Data Privacy Framework for covered transfers; where no applicable adequacy decision exists, including for TikTok, transfers are governed by European Commission Standard Contractual Clauses and the required supplementary safeguards.