Privacy Policy
Last updated: 19 April 2026
How Kaboti Surf collects, uses, and protects your personal data in accordance with GDPR.
1. Who we are
Kaboti Surf ("we", "us", "our") operates the website kabotisurf.com and provides surf lessons, surf camps, and water sports activities in Playa Blanca, Lanzarote, Spain. For any privacy-related enquiry you can contact us at info@kabotisurf.com or +34 647 44 81 35.
2. Data we collect
We collect personal data you provide directly when you make a booking, contact us, or subscribe to our newsletter: name, email address, phone number, preferred dates, experience level, and any message you send. We also collect technical data automatically (IP address, browser type, pages visited) through cookies and analytics tools.
3. Why we use your data (legal basis)
We process your data to (a) fulfil your booking and provide our services — contractual necessity; (b) respond to enquiries — legitimate interest; (c) send marketing emails — only with your explicit consent; (d) comply with Spanish tax and accounting law — legal obligation; (e) analyse site usage and improve our services — legitimate interest, subject to your cookie preferences.
4. Cookies
We use essential cookies required for the site to function and, with your consent, analytics cookies to understand how visitors use the site. You can accept or reject non-essential cookies via the consent banner shown on your first visit, and change your choice at any time by clearing your browser storage.
5. Sharing your data
We share data only with trusted processors strictly necessary to deliver our services: payment providers (Redsys, Stripe), email delivery providers, our database hosting (Supabase), and Spanish tax authorities when legally required. We never sell your personal data.
6. International transfers
Some of our processors may store data outside the European Economic Area. In those cases, transfers are protected by Standard Contractual Clauses approved by the European Commission.
7. How long we keep your data
Booking records are retained for the period required by Spanish tax law (typically 6 years). Marketing contacts are kept until you unsubscribe. Enquiry messages are deleted within 24 months.
8. Your rights under GDPR
You have the right to access, rectify, erase, restrict, or port your personal data, and to object to processing or withdraw consent at any time. To exercise these rights, email info@kabotisurf.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
9. Security
We use industry-standard measures (HTTPS encryption, access controls, hosted infrastructure with EU data residency where possible) to protect your data, but no method of transmission over the internet is 100% secure.
10. Changes to this policy
We may update this policy occasionally. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via the site banner.