Privacy Policy

Yoga Surf Ocean — Last updated June 2026

This privacy policy is provided in English. It applies to all bookings and enquiries regardless of the language version of our website.

Who we are

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Portuguese Law no. 58/2019, and other applicable rules. We handle your data transparently, fairly and securely. We do not sell your personal data.

Data controller: Yoga Surf Ocean, Blanka Vasutova, NIF 325588791
R. Dr. Esteves de Oliveira 4, 2560-487 Silveira, Santa Cruz, Portugal
Email: info@yogasurfocean.com

What we offer

Yoga Surf Ocean is a small surf and yoga school in Santa Cruz, Portugal. We provide:

  • Group and private surf lessons (beginners and intermediates)
  • Surf coaching and surf guiding (more advanced surfers)
  • Yoga sessions — group, duo and private lessons with Blanka in Santa Cruz

We do not sell or provide accommodation, travel, transport or insurance as part of our service. We may suggest trusted local accommodation if you ask, but we do not share your personal data with accommodation providers unless you ask us to make an introduction and agree to it.

How bookings work

Because our lessons take place on the beach and depend on daily ocean and weather conditions, we confirm bookings personally rather than through instant online scheduling. You can reach us via the contact form on this website, by email, phone or WhatsApp. We agree the lesson type, date and meeting point with you, then confirm by message.

Before your first lesson, we may ask you to complete a short online confirmation (participant agreement, health declaration and, separately, optional photo consent). This helps us stay organised on the beach without relying on paper forms.

After we confirm your booking, we may send you a link to our payment instructions page (bank transfer details). That page does not collect personal data.

Our participant agreement (terms, waiver and booking rules) is published on our website. Electronic confirmation is collected separately on the confirmation form after we agree your lesson date.

What data we collect

We collect only what we need to run our school safely and legally. Data comes directly from you through our website forms, email, phone, WhatsApp, or pre-lesson confirmation.

Enquiries and bookings:

  • Name
  • Email address
  • Phone number / WhatsApp
  • Lesson type and dates, group size, message content (e.g. experience level, questions)
  • Whether you would like accommodation tips (we do not book accommodation for you)

Before your lesson (participant agreement):

  • Confirmation that you have read and accept our participant agreement / liability release
  • Health and fitness information relevant to your safety (e.g. injuries, medical conditions, pregnancy)
  • Emergency contact details
  • For participants under 18: parent or guardian name, contact details and confirmation on their behalf
  • Electronic confirmation (typed name and date) — a handwritten signature is not required

Payments and accounting:

  • Name on the booking
  • Payment method used (bank transfer or cash on the day)
  • Payment reference, amount and date
  • Tax identification number (NIF), only if you provide it for an invoice or receipt — common for Portuguese residents, optional for most visitors
  • Billing address, only if needed for a formal invoice

We do not routinely collect your nationality, date of birth or home address. Your phone country code is not treated as proof of nationality.

Website use:

  • IP address, browser type and basic usage data (through cookies and analytics, where you have consented)
  • Cookie preferences stored by our cookie banner

Photos and videos:

  • Images or footage taken during lessons, only used for marketing (website, Instagram, Facebook and similar) if you give separate, optional consent

Why we use your data and our legal basis

  • To handle your enquiry or booking — performance of a contract or steps before entering a contract (GDPR Art. 6(1)(b))
  • To communicate about your lesson (time, beach, weather, rescheduling) — performance of contract (Art. 6(1)(b))
  • Participant agreement and health information — performance of contract and legitimate interest in running safe lessons (Art. 6(1)(b) and (f)); for health data, your explicit consent where required (Art. 9(2)(a))
  • Accounting, tax and legal records — legal obligation (Art. 6(1)(c))
  • Marketing photos and videos on our website and social media — your separate, voluntary consent only (Art. 6(1)(a)); never a condition of taking part in a lesson
  • Website analytics — your consent through our cookie banner (Art. 6(1)(a))
  • General enquiries with no booking — legitimate interest in responding (Art. 6(1)(f))

Photos and video

We may take photos or videos during lessons for our own records or promotional use. Promotional use means our website, Instagram, Facebook and similar channels.

We only use identifiable images of you for marketing if you opt in through a separate, optional consent — for example a checkbox on a pre-lesson confirmation form. We do not require this consent to run your lesson. You can withdraw consent at any time by emailing info@yogasurfocean.com; we will stop using your images for new posts and will remove them from channels we control where reasonably possible.

If you do not opt in, we avoid using you in marketing content or we use images where you are not clearly identifiable.

Who we share data with

We do not sell your data. We share it only with trusted providers who help us run the school, and only to the extent needed:

  • Formspree (USA) — processes contact and booking form submissions from our website
  • WhatsApp / Meta (USA/Ireland) — if you contact us or we message you via WhatsApp
  • Google (USA/Ireland) — Google Analytics (GA4), Google Maps embeds, Google Fonts; analytics only after cookie consent
  • Google Tag Manager — manages analytics and marketing tags on our site, where enabled
  • Our website hosting provider — stores and delivers the yogasurfocean.com website
  • Our email provider — delivers and stores business email at info@yogasurfocean.com
  • Our accountant / tax adviser — accounting and tax compliance in Portugal
  • Our bank — when you pay by bank transfer from your own banking app; we do not collect or store your card or banking credentials on our website
  • Public authorities — when required by law (e.g. tax authority)

Each provider acts as a data processor or independent controller under their own terms and privacy policies. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions, as applicable.

How long we keep your data

  • Active bookings and lesson communication: for the duration of our relationship and up to 3 years after your last lesson or contact
  • General enquiries with no booking: up to 12 months
  • Participant agreements and health declarations: up to 5 years after the lesson, for safety and liability records
  • Accounting and tax records (invoices, payment records): as required by Portuguese law, typically 10 years
  • Marketing photo consent records: for as long as we use the images, plus up to 3 years after withdrawal of consent
  • Analytics data: according to our Google Analytics settings and your cookie choices, typically up to 14 months
  • Cookie consent choices: as stored by our cookie banner, usually up to 12 months

When retention periods end, we delete or anonymise your data unless we must keep it longer for legal reasons.

Cookies and analytics

Our website uses cookies and similar technologies. Some are essential for the site to work; others help us understand how visitors use the site.

Essential cookies may include WordPress session cookies, cookie-consent preferences and security-related cookies. These do not require consent.

Analytics cookies (Google Analytics 4, measurement ID G-54PCC982VZ) are used only if you accept them through our cookie banner (Cookie Law Info or equivalent). They help us see page visits, form interest and general traffic patterns. You can change your choice at any time via the cookie settings on our site or your browser settings.

We do not use advertising or remarketing cookies on this website.

Embedded content

Some pages include content loaded from other websites, such as Google Maps (meeting points and location), videos in our gallery, and links to Instagram and Facebook. That content may collect data, use cookies or track interaction as if you visited those sites directly. Please refer to their privacy policies for details.

Children

Minors may take part in lessons with a parent or guardian. We collect a parent or guardian’s name and contact details, and their confirmation of the participant agreement and health information on the child’s behalf. Marketing photo consent for a minor must be given by a parent or guardian.

Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request erasure in certain circumstances
  • Restrict processing in certain circumstances
  • Data portability, where applicable
  • Object to processing based on legitimate interests
  • Withdraw consent at any time (e.g. for marketing photos or analytics cookies), without affecting prior lawful processing
  • Lodge a complaint with a supervisory authority

To exercise your rights, email info@yogasurfocean.com. We respond within one month.

Supervisory authority (Portugal): Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows the current version. Significant changes will be reflected on this page.

Contact

Questions about this privacy policy or your personal data: info@yogasurfocean.com