Last updated: 18 September 2026
1. Data controller
- Controller: Riccardo Chiura (sole trader) – trading as Surf Therapy Surf School
- NIE: Y8308669W
- Address: Centro Comercial Lobos Bahía, Av. Ntra. Sra. del Carmen, 7 – 35660 Corralejo, Las Palmas (Fuerteventura), Spain
- Phone: +34 648 90 89 74 – Email: info@surftherapy.es
This policy explains how personal data collected through www.surftherapy.es is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD).
2. Data we process and purposes
| Purpose | Data | Legal basis |
|---|---|---|
| Managing bookings for courses, rentals and accommodation, and providing the service | Name and surname, email, phone, dates and booking details, billing data | Performance of the contract (Art. 6(1)(b) GDPR) |
| Processing payments and refunds | Amount, transaction reference and payment data processed by the financial institution | Performance of the contract and legal obligation (Art. 6(1)(b) and (c)) |
| Replying to enquiries sent by form, email, phone or WhatsApp | Name, email, phone and message content | Consent and legitimate interest in responding (Art. 6(1)(a) and (f)) |
| Accounting and tax obligations | Identification and billing data | Legal obligation (Art. 6(1)(c)) |
| Audience measurement and website improvement | Browsing and usage data collected via cookies | Consent (Art. 6(1)(a)) |
| Sending marketing communications, where requested | Name and email | Consent (Art. 6(1)(a)) |
The data requested in each form is the minimum necessary; failure to provide it may prevent us from managing the booking or answering the enquiry.
3. Minors
Bookings by minors require the consent of their parents or legal guardians, who provide the necessary data and are responsible for its accuracy.
4. Recipients
Data may be disclosed to:
- Financial institutions and payment gateway providers, to collect payment for the services.
- Technology providers acting as processors: web hosting, email, booking system, form and web analytics tools.
- Accounting and tax advisers, and public authorities where required by law.
- Competent authorities in the cases provided for by law, including the guest data reporting required of accommodation establishments.
No disclosures other than those stated are made. Some providers may involve international data transfers, which in that case rely on adequacy decisions or on standard contractual clauses approved by the European Commission.
5. Retention periods
Booking and billing data is retained for the duration of the relationship and thereafter for the applicable statutory limitation periods (generally six years for accounting and four years for tax purposes). Enquiry data is kept for as long as needed to respond and, where applicable, for the limitation period of any related claims. Data processed on the basis of consent is kept until consent is withdrawn.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent given, by writing to info@surftherapy.es or to the postal address in clause 1, providing proof of identity.
If you believe your rights have not been properly upheld, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or with the supervisory authority of your country of residence.
7. Security
Appropriate technical and organisational measures are in place to protect personal data against loss, alteration or unauthorised access, including encryption of website communications via an SSL certificate.
8. Cookies
This website uses first-party and third-party cookies, both technical and analytical. You can review and change your choices through the cookie settings panel available on the website and find further information in the cookie policy.
9. Changes to this policy
This policy may be updated to reflect legal changes or changes to the services provided. The version in force is the one published on this page, showing the date it was last updated.
