GDPR · RGPD

Privacy Policy

Last updated: May 8, 2026

Back to home

This Privacy Policy describes how Surf Booking ("we", "the Platform" or "surfbooking.eu") collects, uses and protects your personal data, in compliance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and Portuguese Law 58/2019.

Surf Booking is available in 175 countries — including the 27 EU member states (Apple App Store DSA trader status confirmed on 8 May 2026), the United Kingdom, Brazil, USA, Switzerland and others. This policy applies to all users regardless of country, with the GDPR as the legal basis where applicable by residence or by targeting.

1. Data Controller

DSA / trader status: SurfBooking operates as an intermediary service provider (marketplace) under Regulation (EU) 2022/2065 — Digital Services Act. Trader status confirmed on the Apple App Store on 8 May 2026 for the 27 EU Member States.

For bookings you make with surf schools, the school is the controller of the booking data and Surf Booking acts as a processor — see B2B Commitment for the joint controllership terms (Art. 26) and DPA (Art. 28).

2. Data We Collect

2.1 Account and profile

2.2 Physical and surf data

2.3 Medical and safety data

2.4 Waivers and digital signatures

2.5 Bookings, packs and activity

2.6 Communications

2.7 Location

2.8 Technical and device data

2.9 Payments

2.10 School and instructor documents

2.11 Images and gallery

2.12 Channel Manager — third-party data (Art. 14)

2.13 Affiliate program (cookies + attribution)

2.14 Stock and equipment (informational, school opt-in)

Schools that opt into stock-tracking see an aggregated report of wetsuit/board/leash/boots sizes derived from bookings, without exposing individual student names. It allows the school to align stock with actual demand. Strictly informational — never blocks bookings.

2.15 Aggregated analytics

We collect anonymous, aggregated analytics (page/screen views, conversion rates, usage patterns) to improve the product. This data does not identify you individually. Retained for 180 days, then deleted.

2.16 Zone-level statistics that may reach partners

The same aggregated, de-identified statistics we already publish in the public rankings — by zone, never by school or by person, and always with at least three records in each aggregate — may be made available to brand and equipment partners through our API. Because they are anonymous they are not personal data under the GDPR: no student and no school is identifiable from them. This does not change our rule that we do not sell, rent, swap or transfer personal or identifiable data about students or schools to third parties.

3. How We Use Your Data

4. Legal Basis for Processing (Art. 6)

Consent can be withdrawn at any time without affecting the lawfulness of prior processing (Art. 7(3)).

5. Sub-processors (Art. 28) and International Transfers (Art. 44–49)

We do not sell, rent, swap or transfer your data for commercial purposes. We work only with the technical sub-processors below, each bound by a DPA compliant with GDPR Art. 28:

Transfers outside the EEA rely on (i) the EU–US Data Privacy Framework adequacy decision of 10 July 2023 where applicable, and (ii) EU Standard Contractual Clauses (Module 3, processor-to-sub-processor) executed with each provider.

Full list for schools (with flow, location and mechanism) at /compromisso-escolas. Signed DPA available on request to [email protected].

6. Your Rights (GDPR Art. 15–22)

You have the following rights over your personal data. Most can be exercised directly in the app/site:

Target response time: 48 hours. Statutory limit: 1 month, extensible by +2 months for complex requests (Art. 12(3)). Email: [email protected].

7. Data Security (Art. 32)

We apply appropriate technical and organisational measures, including:

8. Retention

9. Cookies and Local Storage

The mobile app uses no cookies. It uses secure local storage for the session token, preferences and data cache.

The website uses the following cookies/storage:

Retention: essential cookies expire at session end; language preference 1 year; consent stored until removed; analytics 2 years.

You can change your preferences at any time via the "Cookies" link in the site footer.

10. Minors

The digital age of consent in Portugal is 13 years (Law 58/2019 Art. 16(1)). Surf Booking applies this rule:

11. Changes to This Policy

We will notify you of material changes by email and in-app notification, with at least 15 days' notice. The "Last updated" date at the top of this page always reflects the active version. Version history available on request.

12. Complaints and Supervisory Authority

You have the right to lodge a complaint with the Portuguese data protection authority:

CNPD — Comissão Nacional de Proteção de Dados
www.cnpd.pt · [email protected]

If you reside in another EU member state, you may also contact your national data protection authority.

13. Contact

For privacy enquiries, exercising rights, signed-DPA requests or incident notifications:

Email: [email protected]
Address: Ericeira, Portugal