Draft for review · 13 October 2026

Privacy Policy

1. Who is responsible

Benoit Mateus Oliveira, trading as Nazaré Surf Club, is responsible for the enquiry processing described here. Address: Rua da Escola, 4 — 2530-323 Lourinhã, Portugal. Contact: admin@nazaresurfclub.com.

2. Enquiries and readiness calls

We process your name, country or calling code, phone number and/or email, and any surfing experience you choose to provide to respond to your enquiry and arrange a readiness call. This processing supports steps taken at your request before a possible contract (GDPR article 6(1)(b)). Your surfing message is optional. A name and at least one contact method are needed to respond. Please do not send medical information through the public enquiry form.

Where enquiries are saved in our application, authorized administrators can review the details and internal qualification notes. Website hosting, database and email service providers process data as needed to operate the enquiry service. We do not use the enquiry to automatically enrol you in a marketing mailing list or make a solely automated decision with legal or similarly significant effects.

3. Campaign attribution and analytics

We use validated campaign labels, the referring website hostname and the first public landing page for your browser tab to understand which sources lead to relevant enquiries. This attribution is based on our legitimate interest in assessing the effectiveness of our website (GDPR article 6(1)(f)). You may object to this processing.

Plausible Analytics, when enabled, records aggregate visits and enquiry events without analytics cookies or persistent visitor identifiers. Aggregate analytics are hosted in the EU. Form answers, contact details and application references are not sent to Plausible. See Plausible’s data policy.

The browser may retain a session-scoped enquiry retry token, campaign information and your analytics preference. The retry token prevents duplicate enquiries; it does not contain your contact details.

4. Retention and recipients

Enquiry information is retained only while needed to respond, manage a requested follow-up or satisfy a relevant legal obligation or legal claim. Campaign information should not be retained longer than needed for its stated purpose. If an enquiry becomes a booking, the applicable service and statutory record-retention requirements apply. This draft does not establish an unverified automatic deletion period.

Access is limited to people and service providers who need it for those purposes, and public authorities where disclosure is legally required. Before using a provider that transfers personal information outside the EEA, the controller must verify an applicable adequacy decision or appropriate GDPR safeguards. Provider-specific transfer and retention details must be confirmed before this draft is finalized.

5. Your rights

Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact us using the email above; we respond within the statutory period, normally one month, and explain any lawful extension.

You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), or the competent supervisory authority in your country. Your ability to complain does not depend on contacting us first.

6. Scope and legal basis

This notice covers public website enquiries and analytics. Separate information must be supplied before collecting participant health information, emergency details, waiver records or other data for coaching delivery. Photos, videos and testimonials for publicity require an appropriate separate permission; agreeing to coaching does not automatically authorize publicity.

Legal framework: Regulation (EU) 2016/679 (GDPR) and the applicable Portuguese data-protection legislation.