Last updated: 28 August 2026

The protection of your personal data is important to us. SURFERS ISLAND S.L. processes personal data in accordance with the General Data Protection Regulation (GDPR), applicable Spanish data protection law and other applicable legal requirements.

This Privacy Policy explains what personal data we may collect, why we process it, how we store and protect it, with whom it may be shared and what rights you have as a data subject.

1. Data controller

SURFERS ISLAND S.L.
C/ Melindraga 23
35626 Morro Jable
Fuerteventura, Spain

Tax identification number (CIF): B-35994268

Owners / contact persons:
Sarah and Troy Black

Phone: +34 618 200 710
Email: info@surfers-island.de

2. Personal data

Personal data means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.

Depending on how you interact with us, we may process the following categories of personal data:

- Name and surname.
- Postal address, where required.
- Email address.
- Telephone number.
- Accommodation details.
- Age, height and weight where required for equipment selection or activity planning.
- Booking and course information.
- Information contained in messages, enquiries and other communications.
- Technical data such as IP address, browser type, operating system and information about your interaction with our website.
- Photos or videos taken during activities, where applicable and permitted.

Please do not provide health information or other special categories of personal data unless this is necessary for the safe organisation of an activity. If such information is necessary, we will explain why it is required and process it in accordance with applicable data protection law.

3. Purposes and legal bases

We process personal data only to the extent necessary for the following purposes:

- To respond to enquiries and communication requests.
- To process and manage course bookings.
- To organise lessons, equipment, transfers and other requested services.
- To contact you by email, telephone, WhatsApp or SMS in connection with your enquiry or booking.
- To process payments and issue invoices.
- To manage customer service and business administration.
- To comply with legal and tax obligations.
- To protect our legal rights and prevent fraud or misuse.
- To improve the security, functionality and performance of our website.
- To analyse website usage where the required consent has been obtained or where another lawful basis applies.
- To use photos or videos for marketing purposes where the necessary consent or other lawful basis exists.

The legal basis for processing may include:

- Performance of a contract or steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.
- Compliance with a legal obligation, Article 6(1)(c) GDPR.
- Our legitimate interests, Article 6(1)(f) GDPR, where these interests are not overridden by your rights and freedoms.
- Your consent, Article 6(1)(a) GDPR, where consent is required.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. Website use and IP addresses

You can generally visit our website without creating a user account or directly submitting personal data.

When you access our website, technical information such as your IP address may be processed by our hosting and technical service providers. This processing may be necessary to deliver the website, maintain its security and detect technical problems.

We do not use the IP address alone to identify you unless identification is required for a specific lawful purpose, such as responding to a security incident or complying with a legal obligation.

5. Booking and contact forms

The following information may be requested through our booking or contact forms:

Mandatory information:

- Name.
- Email address.
- Telephone number.

Optional information:

- Age.
- Height.
- Weight.
- Accommodation name or location, where required for equipment selection or hotel pickup.
- Additional information relevant to your course or enquiry.

We use this information to contact you, process your enquiry or booking and organise the requested course, equipment and transfer.

After submitting a form, we may contact you via email, telephone, WhatsApp or SMS. Please be aware that WhatsApp and SMS are external communication services and may involve processing by their respective providers.

If you provide information voluntarily in a form or message, we process it for the purpose of handling your enquiry or booking and providing the requested service.

6. Communication by email, telephone, WhatsApp or SMS

You may contact us by email, telephone, WhatsApp, SMS or post.

Information sent to us through these channels may include personal data. We process this information to respond to your enquiry, manage your booking and provide customer support.

Please do not send unnecessary confidential or sensitive information through ordinary email, WhatsApp or SMS.

7. Data storage and service providers

We use selected technical and business service providers to operate our website and manage our business.

These providers may process personal data on our behalf, for example for:

- Website hosting and technical infrastructure.
- Booking and customer management.
- Payment processing.
- Email, telephone, WhatsApp or SMS communication.
- Cloud storage and document management.
- Website analytics.
- Website security and maintenance.

Where required by law, we enter into appropriate data processing agreements with service providers acting as processors. We take reasonable steps to ensure that service providers process personal data only for authorised purposes and maintain appropriate confidentiality and security measures.

8. Google Sheets

We may use Google Sheets to manage bookings, customer information, course planning and related administration.

Depending on the configuration and location of the relevant services, data may be processed by Google Ireland Limited and other Google entities acting on its behalf.

We use such services only for business purposes and limit access to people who need the information for the organisation and administration of our services.

Google’s privacy information is available at:

https://policies.google.com/privacy

9. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some cookies are technically necessary for the operation, security and basic functionality of the website. Other cookies, such as analytics, advertising, embedded content or social media technologies, may require your prior consent.

Where consent is required, these cookies will not be activated before you provide consent. You can accept or reject optional cookie categories through our cookie consent tool. You can also withdraw or change your consent at any time through the available cookie settings.

The exact cookies and technologies used depend on the current configuration of our website, Shopify, our theme and third-party services. Further information is provided in our Cookie Policy and cookie consent tool.

10. Website analytics

If Google Analytics or another analytics service is active on our website, it may collect information about how visitors use the website, such as:

- Date and time of access.
- Approximate location or country.
- Referring website.
- Pages visited.
- Session duration.
- Browser type.
- Operating system.
- Device and technical information.
- Interaction with the website.

Analytics and similar technologies are used only in accordance with the applicable legal requirements and, where required, after obtaining your prior consent.

Where applicable, analytics data is configured to reduce the collection of personal data, including IP anonymisation or equivalent privacy settings.

11. Shopify

Our website is hosted and technically operated using Shopify services.

Shopify may process personal data necessary to provide hosting, security, technical infrastructure, checkout and related ecommerce functions.

Shopify may process or transfer data internationally in accordance with its applicable privacy documentation and contractual safeguards.

Shopify’s privacy information is available at:

https://www.shopify.com/legal/privacy

12. Google Maps

If Google Maps is embedded on one of our pages, Google may process technical information such as your IP address, the URL of the page visited, browser information and other information necessary to display the map.

Where required, Google Maps will be loaded only after the necessary consent has been obtained. If you do not consent, the map or related functions may not be available.

Google’s privacy information is available at:

https://policies.google.com/privacy

13. Google Fonts

If Google Fonts are loaded directly from Google servers, your browser may connect to Google and transmit technical information such as your IP address and the URL of the page visited.

Where possible, we will use locally hosted fonts to reduce unnecessary data transfers. The actual use of Google Fonts depends on the current theme and website configuration.

Google’s privacy information is available at:

https://policies.google.com/privacy

14. YouTube videos

If YouTube videos are embedded on our website, YouTube or Google may process technical information when the relevant video or page is loaded.

Where technically available, we use YouTube’s privacy-enhanced mode. This mode does not necessarily prevent all data processing.

Where required, embedded videos will be loaded only after the necessary consent has been obtained.

Google’s privacy information is available at:

https://policies.google.com/privacy

15. Social media links

Our website may contain links to our social media profiles.

These are ordinary links and do not automatically transmit personal data to the social media provider merely because you visit our website. If you click on a social media link, you will leave our website and the privacy policy of the relevant social media provider will apply.

16. Google Ads and conversion tracking

If Google Ads or conversion tracking is active on our website, Google may use cookies or similar technologies to measure the performance of advertising campaigns and determine whether a visitor has completed an action, such as submitting an enquiry.

Where required, these technologies will be activated only after the necessary consent has been obtained.

The exact processing depends on the current advertising and cookie configuration of our website.

Google’s privacy information is available at:

https://policies.google.com/privacy

17. Photos and videos

Photos or videos may be taken during courses or activities for documentation and marketing purposes, including use on our website, social media profiles and printed promotional material.

If you do not wish to be photographed or recorded, please inform us before the activity begins.

If a photo or video containing you has already been published and you would like to request its removal, please contact us at:

info@surfers-island.de

Photos or videos of minors will only be used where the required consent from a parent or legal guardian has been obtained.

18. Data retention

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

As a general rule:

- Enquiry and communication data is retained for as long as necessary to handle the enquiry and any related follow-up.
- Booking and customer administration data may be retained for up to five years after the last booking where this is necessary for legitimate business, legal or evidential purposes.
- Invoices and accounting records are retained for the period required by applicable tax and accounting law, currently generally up to ten years where applicable.
- Consent records may be retained for as long as necessary to demonstrate compliance.
- Data may be retained for longer where this is necessary to establish, exercise or defend legal claims.

When personal data is no longer required, it will be securely deleted or anonymised.

19. Data security

We use reasonable technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

No method of transmission or storage is completely secure. For this reason, we cannot guarantee absolute security.

20. Transfers outside the European Economic Area

Some service providers may process personal data outside the European Economic Area.

Where this occurs, we use an appropriate legal transfer mechanism and safeguards required by applicable data protection law, such as an adequacy decision, standard contractual clauses or another lawful mechanism.

21. Your rights

Subject to applicable legal requirements, you may have the following rights:

- Right of access to your personal data.
- Right to rectification of inaccurate or incomplete data.
- Right to erasure of your personal data.
- Right to restriction of processing.
- Right to object to processing based on legitimate interests.
- Right to data portability, where applicable.
- Right to withdraw consent at any time where processing is based on consent.
- Right to lodge a complaint with a supervisory authority.

To exercise your rights, please contact us at:

info@surfers-island.de

We may need to verify your identity before processing your request. We will respond within the period required by applicable law.

You also have the right to lodge a complaint with the Spanish Data Protection Authority:

Agencia Española de Protección de Datos (AEPD)

Website:
https://www.aepd.es/en

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, legal requirements or data processing activities.

The current version will be published on this page with the date of the latest update.