Privacy policy

This page describes what happens to the details you type into this site. It is written around the booking form, because that is where all of it is collected.

Who is responsible

The data controller is Buen Surf School, S.L., NIF B76325521, Calle Covadonga 25, 35010 Las Palmas de Gran Canaria, Spain. +34 637 629 812.

To exercise any of the rights described below, write to info@buensurf.com or come to the school.

What we collect, and why each piece

Your name, email and phone number. To confirm the booking, to send you the confirmation and any links it contains, and to reach you if the sea changes and your session has to move. Legal basis: performing the contract you entered into.

Each participant’s first name, last name and age. To know who is getting in the water, and to group a class by level and age. Age also determines whether a guardian’s consent is required. Legal basis: performing the contract, and our legal obligation around minors.

Height, weight and wetsuit size, if you give them. So an instructor can pick the right board volume and the right suit before you arrive. These are optional and the booking works without them. Legal basis: your consent, withdrawable at any time.

Surf level, and whether you are comfortable swimming in the sea. This is safety information. An instructor needs it before taking somebody into the Atlantic. Legal basis: performing the contract, and our legitimate interest in running sessions safely.

Anything you write in the notes field. People sometimes use it for injuries or medical conditions. If you do, that is health data, and it is used only to run your session safely and seen only by the instructors who need it. Legal basis: your explicit consent, given by choosing to write it there.

Guardian name and consent, where a participant is under 18. Legal basis: our legal obligation.

How you heard about us, if you tell us. To know which of our efforts work. Optional. Legal basis: your consent.

Marketing opt-in, if you tick it. Legal basis: your consent, withdrawable from any message we send.

What we do not collect

We do not take your card details. Payment happens on Stripe’s own checkout page and the card number never reaches this site or our servers.

This site sets no cookies of its own, and there is no analytics and no advertising pixel on any page. The Google reviews are shown by Elfsight, which is loaded from its own servers when you scroll to them, and is the one third party on the page. The cookie policy covers it in more detail.

Who else sees it

Stripe, to take the payment and to run subscriptions. Stripe is the payment processor and receives your name, email and the amount. Stripe’s own privacy notice covers what it does with them.

Our booking system, which holds the booking so the school knows who is coming and when.

Our hosting provider, which necessarily processes the request your browser makes.

We do not sell your details and we do not share them with anybody for advertising.

How long we keep it

Bookings and the records attached to them are kept while the booking is live, and then for as long as tax and accounting law requires us to keep records of a sale.

Marketing consent is kept until you withdraw it.

Pack credits are kept until they are used or until the pack’s window closes, because they are money you have already paid and we have to be able to honour them. The record of the purchase outlives the credits themselves, for the same accounting reasons as any other sale.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to it, or ask for it in a portable form. Write to us or call +34 637 629 812 and we will deal with it.

If you think we have handled your details badly and we have not put it right, you can complain to the Agencia Espanola de Proteccion de Datos, aepd.es.

Changes

If this policy changes, the date at the top changes with it.