Last updated: 2026-10-26 · Version 1.3 · Previous version

Privacy Policy

1. Who We Are

The data controller for personal data collected through www.surfcampsportugal.pt (“Surf Camps Portugal”, “we”, “us”) is NAJEEB UR RAHMAN (Surf Camps Portugal), empresário em nome individual, NIF 318149664, R HEROIS GRANDE GUERRA N 104 ST DRT, 2500-216 CALDAS DA RAINHA, Portugal. We are an online intermediary for surf lessons, schools, camps and stays in Portugal. See our Legal Notice.

2. Data We Collect

Contact information: full name, email address, WhatsApp number — collected when you submit a booking request or inquiry.
Your review-email choice: whether you asked us not to send the post-stay review email.
Travel details: travel dates, party size, skill level, budget range, and any message you include in a booking request.
Payment and invoice records: booking fee amount, currency, Stripe payment identifiers, and the invoice we issue you (with your tax number if you give it). We do not store full card numbers — these are handled exclusively by Stripe.
If you are a Partner: your business’s legal name, NIF, address, contact details, registration numbers (AL / RNET / RNAAT), any insurance details you give us, and the record of your acceptance of the Partner Terms — the version, the date and time, the email of the person who accepted, and the IP address used.
Usage data: page views, referrer, and approximate location (country/region level). Collected via Plausible Analytics, which is cookieless and anonymised, and via Google Analytics 4, which operates according to your cookie choices — see section 7.
Acquisition information: with your consent, how you reached our site — campaign tags in the link you followed, any advertising click identifier it carried, the website that linked to you, and the page you arrived on. It is stored in your browser and, if you send a booking request or an enquiry, recorded alongside that request. See section 7.
Communications: records of emails sent between Surf Camps Portugal, you, and partner camps as part of the booking process.

3. How We Use Your Data

Purpose	Lawful basis
Processing booking requests and inquiries	Pre-contractual steps at your request (Art. 6(1)(b))
Sharing anonymised booking details with selected partner camps	Contract performance (Art. 6(1)(b))
Releasing full contact details to the selected camp after the booking fee is paid	Contract performance (Art. 6(1)(b))
Processing booking fee payments via Stripe	Contract performance (Art. 6(1)(b))
Fraud prevention and anti-abuse (rate limiting, honeypot)	Legitimate interests (Art. 6(1)(f))
Accounting and tax obligations (payment records, invoices)	Legal obligation (Art. 6(1)(c))
One post-stay email asking for a review of the place you stayed or surfed with	Legitimate interests (Art. 6(1)(f)) — helping other travellers choose. You can refuse it on the request form, and every such email has an unsubscribe link
Partners: identity, tax and registration details, insurance details	Contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)), including the rules on advertising registered accommodation
Partners: the record of accepting the Partner Terms (version, time, email, IP address)	Legitimate interests (Art. 6(1)(f)) — being able to prove which terms were agreed, and when
Cookieless, aggregated analytics (Plausible) to improve the site	Legitimate interests (Art. 6(1)(f)) — no cookies, no individual profiles
Google Analytics 4 — analytics cookies	Your consent (Art. 6(1)(a)) — you can withdraw it at any time, see section 7
Google Analytics 4 — limited cookieless measurement where analytics cookies are declined	Legitimate interests (Art. 6(1)(f)) — no cookies, no individual profiles
Recording how a visitor reached the site, and attaching it to a booking request or enquiry	Your consent (Art. 6(1)(a)) — you can withdraw it at any time, see section 7

We do not send marketing emails. The only non-booking email we send a traveller is the one post-stay review request described above, which you can refuse.

4. Data Sharing

We share your data with the following parties:

Selected partner camp: Before you pay the booking fee — only your first name, travel dates, party size, skill level, and any message. After you pay it — your full name, email, and WhatsApp number. The partner acts as an independent data controller for their own processing.
Stripe: Payment processor. Your payment card data is handled exclusively by Stripe under their own privacy policy and PCI-DSS certification.
Supabase: Database and storage infrastructure, hosted in EU region.
Vercel: Hosting and edge infrastructure.
Resend: Transactional email delivery.
Plausible Analytics: Privacy-first, cookieless analytics. No personal data is sent to Plausible.
The Portuguese Tax Authority (AT): invoice data, and Partner data where the law requires us to report it.
Google (Google Analytics 4): Website analytics, under a Data Processing Agreement, operating according to your cookie choices. Data may be transferred to and processed in the United States under the EU–US Data Privacy Framework. This website does not use advertising cookies, remarketing tags or advertising-personalisation signals, and we do not use Google Analytics for advertising purposes. See our Cookie Policy for details.

We do not sell your data to third parties.

5. Data Retention

Booking requests and associated contact data: retained for 2 years from the booking request date for accounting and dispute resolution purposes, then deleted.
Payment and invoice records: retained for 10 years, as Portuguese tax law requires (VAT Code, Art. 52).
Partner identity details and Partner Terms acceptance records: for as long as the Partner agreement lasts, and afterwards for as long as needed to meet legal obligations or to establish or defend legal claims.
Communication logs: retained for 2 years.
Acquisition information: considered current for 30 days in your browser, after which we stop using it and it is removed the next time you visit — see section 7. Where it was attached to a booking request, it forms part of that request’s record and is retained for the same 2 years.
Plausible analytics: anonymised aggregate data only, with no individual retention limit.
Google Analytics 4: user-level and event-level data is retained for the period configured on our Google Analytics property, after which Google deletes it. Aggregated reports are not subject to that limit.

6. Your Rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erasure (“right to be forgotten”) — subject to legal retention obligations.
Object to processing based on legitimate interests.
Data portability — receive your data in a structured, machine-readable format.
Lodge a complaint with the Portuguese data protection authority (CNPD): cnpd.pt.

To exercise your rights, email us at support@surfcampsportugal.pt. We respond within one month.

7. Cookies and Your Analytics Choice

We use one strictly necessary storage entry to remember your cookie choice. Plausible Analytics sets no cookies at all.

With your consent we also store one entry recording how you reached the site — campaign tags in the link you followed, any advertising click identifier it carried, the website that linked to you, and the page you arrived on. It is kept in your browser, and if you send a booking request or an enquiry it is recorded alongside that request so we know which sources bring travellers to us. We consider it current for 30 days; after that we stop using it and it is removed the next time you visit the site. Browser storage has no built-in expiry, so if you do not return the entry may remain until you or your browser clear it. If you decline, or withdraw a previous acceptance, nothing is stored, nothing is read, and any existing entry is deleted straight away — information already recorded against a booking request you sent us stays part of that request under the retention periods in section 5. This information is not used for advertising and is not shared with any advertising network.

We use Google Analytics 4 to understand how our website is used and to improve our services. Google Analytics operates according to your cookie choices. If analytics cookies are not accepted, analytics cookies are not stored or accessed on your device, although limited cookieless measurement may still be processed by Google in accordance with our consent settings. We never grant advertising-related consent.

You can change or withdraw your choice at any time using the Cookie settings link in the footer of any page. Changing your preference to decline analytics cookies prevents further use of analytics cookies. Existing cookies may remain on your device until they expire or you remove them through your browser. See our Cookie Policy for the full list.

8. Changes to This Policy

We will update this policy when our practices change, show the new version and date at the top, and keep earlier versions available.