Privacy Policy

Business details

Data controller

The controller responsible for your data is the owner indicated above. You can get in touch by email or phone for any privacy-related question.

What data we process

When booking: activity, date, time, number of people, and the name, email and phone number you enter at payment. Your card details are processed directly by Stripe; we neither see nor store them.

If you contact us via WhatsApp, email or phone: whatever data you choose to share with us.

Why, and on what legal basis

To manage your booking, charge the deposit, let you know about changes due to sea conditions, and handle your queries. The legal basis is the performance of a contract or pre-contractual measures taken at your request (Art. 6.1.b GDPR), and compliance with tax obligations (Art. 6.1.c GDPR).

How long we keep it

For as long as our relationship lasts and, afterwards, for the periods required by law (for example, tax and accounting regulations).

Who we share it with

Only with providers who help us deliver the service, acting as data processors: Stripe (payments), Hetzner Online GmbH (website hosting within the European Union) and WhatsApp/Meta when you choose to contact us via WhatsApp. Stripe and Meta may transfer data outside the European Economic Area under the safeguards provided by the GDPR (standard contractual clauses or the EU-US Data Privacy Framework). We do not sell your data.

The site displays posts from our Instagram; the images are loaded from Instagram's (Meta's) servers, which may receive your IP address.

If you accept advertising cookies, Google Ads (Google Ireland Ltd.) receives data about your visit and, if you arrived from an ad, we store the identifier of that click together with your booking so we can tell which ads work. The legal basis is your consent (Art. 6.1.a GDPR), which you can withdraw at any time.

Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data by writing to the email address above. If you believe we have not handled your request properly, you can file a complaint with the Spanish data protection authority, the AEPD (www.aepd.es).

Privacy Policy | Ori Surf