Privacy Policy

Last updated: 6 October 2026

This policy explains how personal data is processed when you use the Bike Configurator, a RockIT Tools project, at road-tt-configurator.web.app.

1. Controller

The controller determines the purposes of processing. You can use the email address above to ask a privacy question or exercise your rights.

2. Using the configurator

Frame, paint, wheel and groupset selections are processed in your browser. The application keeps these selections in working memory, not in an account or a server-side configuration database. Reloading the page resets them. The site has no registration, checkout, newsletter, uploads or location request.

Photographs, page files and scripts are downloaded so the tool can display your selection. This creates ordinary requests to the hosting provider; requested image filenames can reveal which product image is being loaded. Configuration choices are not sent as analytics events.

3. Hosting and technical requests

The website is served through Google Firebase Hosting. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its relevant service affiliates process technical request data to deliver and protect the service. Requests can include an IP address, time, requested URL, browser information and a referrer, depending on the browser.

The purpose is delivery, reliability and abuse prevention. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in providing a secure, functioning website. Firebase states that Hosting retains IP data for a few months. Provider-managed retention is described in Firebase's privacy and security information.

4. Firebase SDK, storage and cookies

The configurator also loads the Firebase App SDK from Google's www.gstatic.com service to initialize the site's Firebase configuration. The download exposes ordinary technical connection information to Google. Automatic data collection is disabled in this site's Firebase App initialization. No Authentication, Firestore, Realtime Database, Analytics, Performance Monitoring or advertising SDK is used by the configurator.

The configurator does not set advertising cookies or store your bike selections in localStorage, sessionStorage or IndexedDB. The consent service described below may store a record of your privacy choices. Your browser can cache downloaded files as part of normal website delivery. This is different from storing a bike configuration or using advertising identifiers.

5. Advertising and consent

Current status: this version does not load advertising or analytics scripts. The AdSense publisher verification tag and ads.txt entry identify the publisher; they do not themselves serve ads or place advertising cookies.

Managing your privacy choices

The online configurator integrates Google's Privacy & messaging consent service (Google's certified consent management platform, or CMP) using the IAB Transparency and Consent Framework. The service is requested from fundingchoicesmessages.google.com. Google receives technical connection information such as your IP address, browser information and the website address, and uses the request to determine which published consent message applies to your visit. Banner availability depends on the site's AdSense message configuration and your region. The downloaded, local HTML version does not request this service.

Where a message is available, it lists the relevant purposes, advertising providers and their information and lets you accept, refuse or manage optional processing. Google may save your selection and the associated consent record in cookies or other browser storage to remember and apply your choices. Consent-record storage is used to maintain your choice, not to save your bike configuration. The purpose of the technical consent service is to present, record and respect privacy choices. The legal basis for this technical processing is Article 6(1)(f) GDPR, the legitimate interest in operating and maintaining privacy controls; strictly necessary consent-record storage is subject to Section 25(2) TDDDG.

Use Privacy & cookie settings, also available in the footer, to reopen an available Google consent message and change or withdraw your selection. Refusing optional processing does not prevent use of the configurator. If the service is unavailable or no message applies to your visit, the settings explain this and advertising remains disabled. This privacy page and the other information pages do not load the consent service or advertising scripts.

The service's current message and provider information explain the selected purposes and applicable storage durations. Records can remain in your browser until their expiry, replacement or removal. You can also delete site cookies and storage using your browser's settings; this may cause the consent service to ask for your choice again. A consent record is not an instruction to activate advertising on this version of the website.

Information about Google AdSense

If Google AdSense is enabled later, Google and third-party advertising partners may place or read cookies, use web beacons, process IP addresses or other identifiers, and use previous visits to this or other websites to select, personalize and measure advertising. Google's advertising cookies can allow Google and its partners to show ads based on those visits.

Consent-dependent advertising must remain blocked until the CMP has received the required permission. Optional storage and consent-based processing rely on Section 25(1) TDDDG and Article 6(1)(a) GDPR. Advertising and analytics are disabled in this version, including after a consent choice; accepting a consent message does not itself load advertisements. The privacy information, actual partners, retention details and consent-dependent loading must be reviewed before advertising is activated.

You can read how Google uses information from partner sites, Google's advertising technology information, and manage personalization at My Ad Center. Third-party opt-out information is available at YourAdChoices. These external settings do not replace consent on this website.

6. Contact by email

If you email the operator, your email address, the contents of your message and any information you include are processed to answer the request. The mailbox is provided through Google Gmail; the site itself has no contact form. For a general inquiry, the legal basis is Article 6(1)(f) GDPR, the legitimate interest in responding to correspondence. Where an inquiry concerns a contract, Article 6(1)(b) GDPR may apply.

Correspondence is kept as long as needed to handle the request and, where applicable, to meet legal retention duties or establish, exercise or defend legal claims. It is then erased. Please avoid sending unnecessary sensitive information.

7. Recipients and international processing

Google receives the technical information necessary for hosting, SDK delivery and the consent service and, when you send an email, the information handled by its email service. Data may be processed outside the EEA, including in the United States. Google's Firebase privacy information describes its EU–U.S. Data Privacy Framework certification and relevant international processing arrangements; Google's data transfer frameworks and its applicable service terms provide further information.

External manufacturer, retailer and reference links are opened only when you follow them. Those sites process data under their own privacy policies. Their images are served from this website's hosting rather than fetched directly from a retailer when you select a bike.

8. Your rights

Subject to the requirements of the GDPR, you have rights to access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your particular situation. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

You may complain to a competent supervisory authority, including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW). Contact the controller above to exercise your rights. Information needed to handle such a request is used only to identify and respond to it.

9. Other information

You are not required to create an account or provide contact information to use this tool. Technical connection data is necessary to deliver the site. This application does not make automated decisions about you with legal or similarly significant effects and does not create advertising profiles in its current version.

This policy will be revised when the site's functionality or data processing changes. The date above identifies the current version.