Privacy policy

Who we are

Best Surf (bestsurf.pt) is a booking and marketing agency for surf schools in Portugal. We are the data controller for the data described here.

• PLACEHOLDER: registered company name.
• PLACEHOLDER: registered address.
• PLACEHOLDER: tax number (NIF).
• Contact for data questions: hello@bestsurf.pt

What we collect and why

Booking data

Your name, email, phone, country, number of people, session dates, experience level, any notes you write and an optional tax number for the school's invoice. We use it to arrange your booking and to pass it to the school that will teach you. The legal basis is performance of the contract you are entering into.

Payment data

Card details are handled entirely by Stripe. They never reach our servers and we never see them. We store only the payment reference, the amount and the status. The legal basis is performance of the contract.

Optional marketing email

If you tick the optional box we send you an occasional email about surf conditions and new schools, no more than once a month. The legal basis is your consent. You can withdraw it at any time with the unsubscribe link or by emailing us, and it never affects your booking.

Analytics

Anonymous counts of page views and booking steps. Nothing loads until you accept analytics in the cookie banner, so the legal basis is your consent. See the cookie list, or change your choice.

Enquiries

Some options cannot be booked online, for example a surf camp with accommodation. If you use the request form we collect your name, email, dates, number of people and your message, and we send it to the school so they can reply. The legal basis is taking steps at your request before a contract.

Who we share it with

• The partner surf school for your booking. They receive your booking and contact details because they run the lesson and invoice you for the balance. For their own use of that data they are an independent controller with their own privacy policy.
• Stripe, our payment processor, for the deposit.
• Our hosting and database provider, which stores the site and its records on our behalf.
• Our transactional email provider, which delivers your confirmation and cancellation emails.
• Our analytics provider, only if you accepted analytics.

We never sell personal data. We never share your details with any other surf school, with advertisers or with data brokers.

Transfers outside the EU

Our hosting, database and email records are stored in the European Union. Some providers are companies based in the United States and may access data from there for support. Where that happens the transfer relies on the European Commission standard contractual clauses, together with the EU to US Data Privacy Framework where the provider is certified.

PLACEHOLDER: confirm the hosting region, and the exact transfer mechanism for each provider (payments, hosting and database, email, analytics), then name them here.

How long we keep it

• Booking and payment records: 10 years from the end of the tax year, the accounting retention period required by Portuguese law.
• Enquiries that never became a booking: 24 months, then deleted.
• Abandoned booking forms: 6 months, then deleted.
• Marketing consent and email address: until you withdraw consent, plus 12 months to prove when you withdrew it.
• Analytics events: 14 months, then deleted.
• School applications: while the school is under consideration or listed, plus 24 months.

Your rights

You can ask us to:

• give you a copy of your data (access),
• correct anything wrong (rectification),
• delete it (erasure),
• pause our use of it (restriction),
• send it to you or another provider in a portable file (portability),
• stop processing based on our legitimate interests (objection),
• withdraw your marketing consent at any time.

Email hello@bestsurf.pt and we answer within one month. You can also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt. See also our complaints page.

Children

This site is not for children. A booking that includes anyone under 18 must be made by an adult, who gives the contact details and is responsible for the booking. The school may ask for a signed parental consent form on the day.

Changes

If we change this policy we update the date at the top. Material changes are announced on the site.