Privacy Policy

User Information in accordance with the GDPR and the LOPDGDD

User Information

WAVE & ROLL, S.L. (hereinafter, “Ultramarinos Surf School”) is the data controller responsible for processing the user’s personal data and informs you that this data will be processed in accordance with the provisions of Regulation (EU) 2016/679 of April 27 (GDPR), and Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

Data Controller

Identity: WAVE & ROLL, S.L. — Tax ID B75401448
Mailing address: Calle Adelaida Muro, 78, 1st Floor — 15002 A Coruña
Email: hola@surfultramarinos.com

Purpose of processing

Personal data provided through the Website will be processed for the following purposes:

To manage reservations for surf lessons, passes, and camps through the online booking system.
To manage the purchase of products from the merchandise catalog and process orders.
To manage Club/Academy memberships and associated recurring billing.
Respond to inquiries, requests for information, and contact forms.
Issue invoices and comply with applicable tax and accounting obligations.
Send commercial communications regarding activities, promotions, and news, only when the user has given their express consent.

Legal basis for processing

Performance of a contract: for reservations, product purchases, subscriptions, and service provision.
Compliance with a legal obligation: billing, accounting, and tax obligations.
Consent of the data subject: for sending commercial communications and managing inquiries via forms.
Legitimate interest: for improving services and preventing fraud.

Data retention

Personal data will be retained for as long as necessary to fulfill the purpose for which it was collected and to determine any potential liabilities that may arise from said purpose and the processing of the data. The provisions of the regulations on archives and documentation shall apply. In particular, data related to billing and accounting will be retained for the legally established period (minimum 6 years in accordance with the Commercial Code).

Data Recipients

Data will not be transferred to third parties, except where legally required. For the provision of the service, the data may be disclosed to the following data processors:

Stripe Payments Europe, Ltd. — payment gateway for classes, vouchers, products, and subscriptions.
Hosting provider — storage of the Website and databases.
Transactional email and marketing service providers — sending booking confirmations, invoices, and communications.
Shipping/courier company — delivery of orders from the merchandise catalog.
Tax and accounting advisory services — management of legal obligations.

Some of these providers may carry out international data transfers. In such cases, Ultramarinos Surf School guarantees that such transfers are carried out with the appropriate safeguards provided for in the GDPR (standard contractual clauses or adequacy decisions).

User rights

The user may exercise the following rights regarding their personal data at any time:

Right of access, rectification, erasure, and objection.
Right to restriction of processing.
Right to data portability.
Right not to be subject to automated decision-making.
Right to withdraw consent at any time.

To exercise these rights, users may submit a written request to Calle Adelaida Muro, 78, 1º — 15011 A Coruña, or via email to info@surfultramarinos.com, indicating “DATA PROTECTION” in the subject line and attaching a copy of your ID card or other identification document.

Likewise, users have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) if they believe that the processing of their data does not comply with current regulations.

Data Security

Ultramarinos Surf School implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing, including, among others, the pseudonymization and encryption of personal data where appropriate, as well as the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of the systems and services.

Accuracy of Data

The user guarantees that the personal data provided is accurate and is responsible for notifying any changes thereto. The user shall be solely liable for any direct or indirect damage or harm that may be caused to Ultramarinos Surf School or any third party as a result of filling out forms with false, inaccurate, incomplete, or outdated data.

Last updated: April 29, 2026