Last updated: 2026-08-24 · Version v1.2
Privacy Policy
1. Who We Are
Surf Camps Portugal (“we”, “us”, “our”) operates the website www.surfcampsportugal.pt. We act as a marketplace coordinator for surf camps, schools, and stays in Portugal. For the purposes of the GDPR, Surf Camps Portugal is the data controller for personal data we collect directly from you.
Contact us at: hello@surfcampsportugal.pt
2. Data We Collect
- Contact information: first name, email address, WhatsApp number — collected when you submit a booking request or inquiry.
- Travel details: travel dates, party size, skill level, budget range, and any message you include in a booking request.
- Payment metadata: deposit amount, currency, and Stripe payment identifiers. We do not store full card numbers — these are handled exclusively by Stripe.
- Usage data: page views, referrer, and approximate location (country/region level). Collected via Plausible Analytics, which is cookieless and anonymised, and via Google Analytics 4, which operates according to your cookie choices — see section 7.
- Acquisition information: with your consent, how you reached our site — campaign tags in the link you followed, any advertising click identifier it carried, the website that linked to you, and the page you arrived on. It is stored in your browser and, if you send a booking request or an enquiry, recorded alongside that request. See section 7.
- Communications: records of emails sent between Surf Camps Portugal, you, and partner camps as part of the booking process.
3. How We Use Your Data
| Purpose | Lawful basis |
|---|---|
| Processing booking requests and inquiries | Pre-contractual steps at your request (Art. 6(1)(b)) |
| Sharing anonymised booking details with selected partner camps | Contract performance (Art. 6(1)(b)) |
| Releasing full contact details to the selected camp after deposit paid | Contract performance (Art. 6(1)(b)) |
| Processing reservation deposits via Stripe | Contract performance (Art. 6(1)(b)) |
| Fraud prevention and anti-abuse (rate limiting, honeypot) | Legitimate interests (Art. 6(1)(f)) |
| Accounting and legal obligations (transaction records) | Legal obligation (Art. 6(1)(c)) |
| Cookieless, aggregated analytics (Plausible) to improve the site | Legitimate interests (Art. 6(1)(f)) — no cookies, no individual profiles |
| Google Analytics 4 — analytics cookies | Your consent (Art. 6(1)(a)) — you can withdraw it at any time, see section 7 |
| Google Analytics 4 — limited cookieless measurement where analytics cookies are declined | Legitimate interests (Art. 6(1)(f)) — no cookies, no individual profiles |
| Recording how a visitor reached the site, and attaching it to a booking request or enquiry | Your consent (Art. 6(1)(a)) — you can withdraw it at any time, see section 7 |
We do not use your personal data for marketing unless you explicitly opt in.
4. Data Sharing
We share your data with the following parties:
- Selected partner camp: Before deposit — only your first name, travel dates, party size, skill level, and any message. After deposit — your full name, email, and WhatsApp number. The partner acts as an independent data controller for their own processing.
- Stripe: Payment processor. Your payment card data is handled exclusively by Stripe under their own privacy policy and PCI-DSS certification.
- Supabase: Database and storage infrastructure, hosted in EU region.
- Vercel: Hosting and edge infrastructure.
- Resend: Transactional email delivery.
- Plausible Analytics: Privacy-first, cookieless analytics. No personal data is sent to Plausible.
- Google (Google Analytics 4): Website analytics, under a Data Processing Agreement, operating according to your cookie choices. Data may be transferred to and processed in the United States under the EU–US Data Privacy Framework. This website does not use advertising cookies, remarketing tags or advertising-personalisation signals, and we do not use Google Analytics for advertising purposes. See our Cookie Policy for details.
We do not sell your data to third parties.
5. Data Retention
- Booking requests and associated contact data: retained for 2 years from the booking request date for accounting and dispute resolution purposes, then deleted.
- Payment records: retained for 7 years to meet Portuguese accounting and tax obligations.
- Communication logs: retained for 2 years.
- Acquisition information: considered current for 30 days in your browser, after which we stop using it and it is removed the next time you visit — see section 7. Where it was attached to a booking request, it forms part of that request’s record and is retained for the same 2 years.
- Plausible analytics: anonymised aggregate data only, with no individual retention limit.
- Google Analytics 4: user-level and event-level data is retained for the period configured on our Google Analytics property, after which Google deletes it. Aggregated reports are not subject to that limit.
6. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erasure (“right to be forgotten”) — subject to legal retention obligations.
- Object to processing based on legitimate interests.
- Data portability — receive your data in a structured, machine-readable format.
- Lodge a complaint with the Portuguese data protection authority (CNPD): cnpd.pt.
To exercise your rights, email us at hello@surfcampsportugal.pt. We respond within 30 days.
7. Cookies and Your Analytics Choice
We use one strictly necessary storage entry to remember your cookie choice. Plausible Analytics sets no cookies at all.
With your consent we also store one entry recording how you reached the site — campaign tags in the link you followed, any advertising click identifier it carried, the website that linked to you, and the page you arrived on. It is kept in your browser, and if you send a booking request or an enquiry it is recorded alongside that request so we know which sources bring travellers to us. We consider it current for 30 days; after that we stop using it and it is removed the next time you visit the site. Browser storage has no built-in expiry, so if you do not return the entry may remain until you or your browser clear it. If you decline, or withdraw a previous acceptance, nothing is stored, nothing is read, and any existing entry is deleted straight away — information already recorded against a booking request you sent us stays part of that request under the retention periods in section 5. This information is not used for advertising and is not shared with any advertising network.
We use Google Analytics 4 to understand how our website is used and to improve our services. Google Analytics operates according to your cookie choices. If analytics cookies are not accepted, analytics cookies are not stored or accessed on your device, although limited cookieless measurement may still be processed by Google in accordance with our consent settings. We never grant advertising-related consent.
You can change or withdraw your choice at any time using the Cookie settings link in the footer of any page. Changing your preference to decline analytics cookies prevents further use of analytics cookies. Existing cookies may remain on your device until they expire or you remove them through your browser. See our Cookie Policy for the full list.
8. Changes to This Policy
We will update this policy when our practices materially change. The “Last updated” date at the top reflects the most recent revision. Continued use of the site after an update constitutes acceptance of the new version.