Privacy Policy

How we collect, use, and protect your personal data.

PRIVACY POLICY

SURFLESSONS4YOU

Last updated: 05 September 2026

1. Data Controller

The data controller responsible for processing your personal data is:

SURFLESSONS4YOU

Registered seat: Katja Schiefer, Grabko 42, 03172 Schenkendöbern, Germany

Correspondence/service address: Calle Puipana, Bloque 18, Apt. 0E, 35640 Casilla de Costa – Villaverde, Spain

Contact email: [email protected]

This Privacy Policy governs access to and use of the SURFLESSONS4YOU platform (the “Platform”), provided to users (the “Users”) who are interested in the content and services offered through the Platform.

2. Recommendations

Please consider the following recommendations:

Keep your device equipped with updated antivirus and antispyware software to prevent security risks and protect stored data.
Carefully read this Privacy Policy and all other legal texts made available on the Platform.

3. Data We Collect

SURFLESSONS4YOU may collect and process the following personal data:

3.1 Identification Data

First name and surname.

3.2 Contact Data

Email address
Telephone number
Postal address (if provided)

3.3 Booking Data

Course selection
Booking date and time
Additional details submitted in booking forms

3.4 Payment Data

Processed externally by Stripe:

Tokenized card information
Transaction ID
Payment status (We do not store full credit card details.)

3.5 Technical and Browsing Data

SURFLESSONS4YOU does not use analytics or advertising tools. Limited technical data (such as IP address and basic device/browser information) is processed by the third-party services listed in Section 7, only where strictly necessary to deliver, secure, or display parts of the Platform (e.g. content delivery and security, maps, sign-in, profile pictures). Full details of each service, including exactly what data it receives and why, are set out in our separate Cookie Policy.

4. Legal Basis for Processing

SURFLESSONS4YOU processes personal data on the following legal bases:

4.1 Contract Performance – Art. 6(1)(b) GDPR

To:

Manage bookings
Deliver surf lessons
Communicate regarding your reservation
Process payments

4.2 Legitimate Interest – Art. 6(1)(f) GDPR

For:

Ensuring security and proper functioning of the Platform (Cloudflare)
Fraud prevention
Hosting and content delivery
Displaying maps of schools and meeting points (Google Maps)

4.3 Consent – Art. 6(1)(a) GDPR

For:

Marketing and commercial communications
Newsletter subscription
Signing in with a Google account (only if you actively choose this option)

Consent may be withdrawn at any time via [email protected].

5. Purposes of Processing

Your data may be processed for the following purposes:

Providing the requested services on the Platform.
Managing booking requests and surf lesson delivery.
Responding to inquiries submitted via contact forms.
Processing payments via Stripe.
Sending marketing or commercial communications (only with consent).
Displaying maps of lesson meeting points via Google Maps.
Displaying profile pictures via Gravatar.
Ensuring website functionality, performance, and security via Cloudflare.
Sharing essential booking details with partner surf schools to deliver the booked course.

6. Accuracy of Data Provided

Users guarantee the accuracy of all data submitted and agree to inform SURFLESSONS4YOU of any updates or changes. Users are responsible for the accuracy of their data. SURFLESSONS4YOU may deny services to Users who provide false information.

We recommend Users protect their personal data with adequate security measures. SURFLESSONS4YOU is not liable for theft, unauthorized modification, or loss of data on the User’s device.

7. Data Sharing and Recipients

SURFLESSONS4YOU does not sell or commercially transfer personal data.

Data may be shared only with the following categories:

7.1 Hosting Provider

Hostinger International Ltd. (Hosting, server logs, security)

7.2 Booking System

WordPress / Voxel (Platform booking engine). Receives data necessary to manage reservations.

7.3 Payment Providers

Stripe Payments Europe, Limited

7.4 Website Infrastructure & Third-Party Features

Cloudflare, Inc. – security, performance, and content delivery
Google Ireland Limited – Google Maps (meeting-point maps) and Google Sign-in (optional login)
Automattic Inc. – Gravatar (profile pictures)

7.5 Partner Surf Schools

To fulfill the booked course, the following data may be shared:

Name
Contact information (e-mail and mobile number)
Course details
Booking time and date

No additional personal data is shared.

7.6 Legal Obligations

Data may be disclosed if required by law or competent authorities.

8. International Data Transfers

Some service providers (Google, Cloudflare, Stripe, Automattic) may process data outside the EU, in particular in the United States.

These transfers are safeguarded by:

Standard Contractual Clauses (SCCs)
The EU–US Data Privacy Framework, where the provider is certified

9. Data Retention

Personal data is kept only for the time necessary for each purpose:

Booking data: Duration of account activity + 5 years for legal compliance
Payment data: According to tax regulations
Newsletter data: Until the User unsubscribes
Server and security logs (Hostinger / Cloudflare): Typically 30–180 days

10. User Rights

In accordance with GDPR, Users may exercise the following rights:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to object
Right to data portability
Right not to be subject to automated decision-making
Right to withdraw consent

Requests must be sent to: [email protected]

The competent supervisory authority for SURFLESSONS4YOU (registered seat in Brandenburg, Germany) is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg)

Regardless of this, Users located elsewhere in the EU may also file a complaint with their own local supervisory authority (e.g. the Spanish AEPD), in accordance with Art. 77 GDPR.

11. Data Security

SURFLESSONS4YOU applies appropriate technical and organizational measures including:

SSL encryption
Secure hosting environment (Hostinger), fronted by Cloudflare’s security network
Restricted access to personal data
Protection against unauthorized access, loss, alteration, or misuse

However, Users acknowledge that no Internet transmission is entirely secure.

12. Cookies and Tracking Technologies

The Platform does not use analytics or advertising cookies. Cookies are only set once you make a choice in our cookie banner, or once you log in. For the full, service-by-service breakdown of what is set and by whom, please see our separate Cookie Policy, available in the footer of the Platform.

13. Contact Forms

Personal data submitted via contact forms is used only to respond to inquiries.

If additional purposes are intended (such as marketing), an explicit opt-in checkbox will be provided.

14. Newsletter Subscription

Newsletter communications are only sent:

After explicit user consent
Through Brevo (Sendinblue SAS)

Users may unsubscribe at any time via a link or by contacting [email protected].

15. Implementation of Privacy Information Layers

In our forms and Platform interface:

A link to this Privacy Policy is displayed permanently in the footer.
An information icon (“i” or “+info”) displays a short first layer summarizing who processes your data, for what purpose, the legal basis, data transfers, user rights, and contact information.

The full Policy represents the second information layer.

16. Changes to This Privacy Policy

SURFLESSONS4YOU may update this Policy to reflect operational or legal changes. The latest version will always be available on the Platform.

17. Contact

For questions about this Privacy Policy or your personal data, contact: