Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal information collected through this website (https://www.theechosurfers.com) and our offline operations is:

2. Information We Collect

We collect only the personal information necessary to deliver high-quality surf lessons, retreats, camps, and customer support. Depending on how you interact with us, this may include:

• Identification and Contact Data: Name, email address and WhatsApp number.
• Booking and Participation Details: Selected week, number of guests and room type for retreats; selected weeks and meal option for Echo Kids; and any message you add to the form.
• Echo Kids Summer Camp Data: Child's full name and age, an emergency contact number, and the image and outings authorizations given in the enrollment form.
• Health Information: Food allergies and relevant medical information that you choose to share in the Echo Kids enrollment form.
• Technical and Analytics Data: Browser type, device information and pages visited, collected through PostHog (EU) analytics and the Meta Pixel.

3. Purposes and Legal Bases of Processing

Under European data protection law (GDPR Art. 6), we process your personal data under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Managing lesson reservations, accommodation bookings, camp enrollments, schedule adjustments, and communicating practical information.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Fulfilling insurance and fiscal billing obligations.
• Protection of Vital Interests (Art. 6(1)(d) GDPR): Responding to in-water medical emergencies or notifying emergency contacts in the rare event of injury.
• Legitimate Interests (Art. 6(1)(f) GDPR): Enhancing website security, optimizing digital performance, and answering general customer inquiries.

4. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking inquiries that do not result in a reservation: deleted within 90 days.
• Confirmed customer and participant records: retained for the duration of the current season plus required statutory insurance prescription periods.
• Invoices and tax-related documentation: retained for 10 years in compliance with Portuguese accounting legislation.

5. Third-Party Disclosures & Transfers

We never sell, rent, or trade your personal data. This website uses the following service providers:

• Transactional email services (Resend) for immediate confirmation and notification delivery.
• European-hosted analytics (PostHog EU).
• Meta Platforms (Meta Pixel) for website visit measurement.

6. Your Rights Under GDPR

As a data subject in the European Union, you hold the following rights regarding your personal information:

• Right of Access: Request confirmation and a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data when no longer legally required.
• Right to Restriction of Processing: Request suspension of processing under specific legal grounds.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object at any time to processing based on legitimate interests.

To exercise any of these rights, simply email us at hello@theechosurfers.com. We will respond within 30 days free of charge.

7. Supervisory Authority

If you believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Portuguese National Data Protection Commission:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal · Website: www.cnpd.pt