Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal information collected through this website (https://www.theechosurfers.com) and our offline operations is:

2. Information We Collect

We collect only the personal information necessary to deliver high-quality surf lessons, retreats, camps, and customer support. Depending on how you interact with us, this may include:

• Identification and Contact Data: Full name, email address, phone/WhatsApp number, country of residence, and preferred language.
• Booking and Participation Details: Selected dates, surf skill level, height, weight, shoe size (for wetsuit and board sizing), and room preferences for surf retreats.
• Echo Kids Summer Camp Data: Child's full name, date of birth, swimming proficiency, authorized pickup contacts, and emergency contact numbers.
• Health and Safety Disclosures: Voluntary disclosures of medical conditions, physical limitations, or severe allergies strictly for ocean safety and emergency preparedness.
• Technical and Analytics Data: IP address (anonymized), browser type, device information, and pages visited, collected through privacy-focused European analytics.

3. Purposes and Legal Bases of Processing

Under European data protection law (GDPR Art. 6), we process your personal data under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Managing lesson reservations, accommodation bookings, camp enrollments, schedule adjustments, and communicating practical information.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Fulfilling mandatory sports activity insurance requirements, fiscal billing regulations, and Portuguese maritime authority safety protocols.
• Protection of Vital Interests (Art. 6(1)(d) GDPR): Responding to in-water medical emergencies or notifying emergency contacts in the rare event of injury.
• Legitimate Interests (Art. 6(1)(f) GDPR): Enhancing website security, optimizing digital performance, and answering general customer inquiries.

4. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Booking inquiries that do not result in a reservation: deleted within 90 days.
• Confirmed customer and participant records: retained for the duration of the current season plus required statutory insurance prescription periods.
• Invoices and tax-related documentation: retained for 10 years in compliance with Portuguese accounting legislation.

5. Third-Party Disclosures & Transfers

We never sell, rent, or trade your personal data. We disclose data solely to vetted service providers acting as data processors under strict GDPR data processing agreements:

• Transactional email services (Resend) for immediate confirmation and notification delivery.
• European-hosted analytics (PostHog EU) with strict IP anonymization and privacy safeguards.
• Authorized Portuguese sports insurance underwriters for participant coverage during water activities.

6. Your Rights Under GDPR

As a data subject in the European Union, you hold the following rights regarding your personal information:

• Right of Access: Request confirmation and a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data when no longer legally required.
• Right to Restriction of Processing: Request suspension of processing under specific legal grounds.
• Right to Data Portability: Receive your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object at any time to processing based on legitimate interests.

To exercise any of these rights, simply email us at hello@theechosurfers.com. We will respond within 30 days free of charge.

7. Supervisory Authority

If you believe our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Portuguese National Data Protection Commission:

Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal · Website: www.cnpd.pt