PRIVACY POLICY AND LEGAL ANNOUNCEMENT, AND COOKIE POLICY

PEÑA TXURI SURF ESKOLA S.L.
Last updated: 4 October 2026

This page contains the Legal Notice, Privacy Policy and Cookie Policy for www.escueladesurfsopelana.com.

Legal Notice · Privacy Policy · Cookie Policy

1. Website owner

In accordance with Article 10 of Spanish Law 34/2002 on information society services and electronic commerce, this website is owned by:

Company: PEÑA TXURI SURF ESKOLA S.L.
Tax ID (CIF): B95925418
Registered office: C/ Loiola Ander Deuna 130, 48600 Sopela (Bizkaia), Spain
Activity centre: Arrietara Beach, Sopela (Bizkaia), Spain
Telephone: +34 600 300 244
Email: ptxsurfeskola@gmail.com
Commercial Registry: Bizkaia Commercial Registry, volume 5835, folio 21, section 8, sheet BI-72940, entry 1.
Tourism register: Basque Register of Tourism Companies and Activities (REATE), NBI00030. Activity: active and adventure tourism.

2. Purpose and terms of use

The website provides information about Peña Txuri Surf Eskola services and allows users to request information or access booking processes. Access entails acceptance of this notice. Users must use the website lawfully, diligently and with respect for third-party rights. Bookings are also governed by the General Booking and Contracting Terms and Conditions and the Cancellation and Changes Policy.

3. Intellectual and industrial property

The texts, photographs, designs, trademarks, logos, code and other website content are protected by intellectual and industrial property law. Reproduction, distribution, public communication or alteration is not authorised without prior permission or a legal entitlement. Third-party signs and content belong to their respective owners.

4. Liability and links

Peña Txuri Surf Eskola endeavours to keep information accurate and the service available, but cannot guarantee the complete absence of errors, interruptions or harmful elements. It is not liable for use contrary to the law or this notice. Links to external booking services, maps or social networks are provided for convenience; their content and conditions are the responsibility of their respective operators.

5. Applicable law

This notice is governed by Spanish law. Where the user is a consumer, jurisdiction will lie with the courts determined by mandatory consumer-protection rules. Nothing in this notice restricts rights that cannot legally be waived.

PRIVACY POLICY

1. Data controller

Controller: PEÑA TXURI SURF ESKOLA S.L.
Tax ID: B95925418
Address: C/ Loiola Ander Deuna 130, 48600 Sopela (Bizkaia), Spain
Privacy and rights contact: ptxsurfeskola@gmail.com · +34 600 300 244.

2. Processing, purposes and legal bases

  • Enquiries and contact forms: to handle requests, reply to messages and take pre-contractual steps. The legal bases are steps requested before entering a contract and the legitimate interest in handling communications related to the activity.
  • Bookings and services: to manage participants, availability, payments, changes, safety, insurance, incidents and after-sales service. The legal bases are performance of the contract and related legal obligations.
  • Billing, accounting and tax: to issue and retain invoices and supporting documents. The legal basis is compliance with legal obligations.
  • Marketing communications: to send news, activities and offers only after specific consent. Consent may be withdrawn at any time without affecting earlier processing.
  • Security and abuse prevention: to protect the website, prevent spam, detect fraudulent use and retain technical evidence. The legal basis is the legitimate interest in keeping the service secure.
  • Analytics and advertising: to measure website and campaign use after the user accepts the relevant cookie categories. The legal basis is consent.

3. Participant, minor and health data

Bookings for minors must be made or authorised by a responsible adult. Only data necessary to organise and provide the activity appropriately and safely will be requested.

If details about injuries, allergies, medication, disability or other health information are needed to adapt an activity, deal with an accident, process insurance or apply a medical exception, information will be provided at the point of collection and access will be restricted. Depending on the case, processing will rely on explicit consent, protection of vital interests, the establishment or defence of legal claims, or another applicable legal basis.

4. Categories of data

We may process identification and contact details, booking and participant details, payment and billing information, communications, consent records, technical browsing data and, only where necessary, information relevant to activity safety or adaptation. We do not request more data than necessary.

5. Recipients and service providers

Data may be disclosed to public authorities, courts, insurers, healthcare providers or law-enforcement bodies where legally required or necessary to manage an incident. Hosting and website maintenance, email, forms and automation, booking and payment, storage and management, antispam security, analytics and marketing providers may also access data as processors under the required contractual safeguards. Depending on the services used and consent given, these may currently include WordPress/Elementor, Gmail, n8n, Google, Mailchimp, Checkfront, Akismet and Microsoft Clarity.

6. International transfers

Some technology providers may process data outside the European Economic Area. Where this occurs, recognised safeguards will be used, such as an adequacy decision, the EU-US Data Privacy Framework for participating organisations, Standard Contractual Clauses or other valid mechanisms. Further information may be requested using the contact details above.

7. Retention

  • Enquiries: for as long as needed to reply and then for applicable liability periods.
  • Bookings and contracts: during the contractual relationship and subsequent statutory periods.
  • Billing and commercial documentation: generally six years; tax documents are kept for applicable tax periods, normally four years, without prejudice to special periods.
  • Marketing: until consent is withdrawn; evidence of consent or withdrawal is kept for applicable liability periods.
  • Medical or safety data: only as long as needed for adaptation, care, insurance or an incident and then blocked for applicable liability periods.

8. Rights

You may request access, rectification, erasure, objection, restriction and portability, and may withdraw consent, by writing to ptxsurfeskola@gmail.com or to the postal address above. Additional information may be requested where necessary to verify identity. You may also lodge a complaint with the Spanish Data Protection Agency.

9. Accuracy, security and updates

Users must provide accurate data and notify changes. Technical and organisational measures proportionate to risk are applied to prevent unauthorised access, loss, alteration or disclosure. This policy will be reviewed when processing, providers or legislation changes.

COOKIE POLICY

A cookie is a small file stored by a website on the user’s device. This policy also covers similar technologies, such as browser local storage.

Consent and operation. Technologies required to remember privacy choices and language may operate without consent. Analytics and advertising cookies remain denied until the user accepts them. Before that choice, Google and Microsoft Clarity may receive cookieless measurement signals without advertising identifiers through Consent Mode. Users can accept, reject or configure categories from the banner.

Technologies used:

  • Complianz (cmplz_*). First-party functional cookies that store the consent choice and categories for 365 days.
  • WPML (wp-wpml_current_language). A first-party functional cookie that remembers the selected language for 1 day.
  • Google Analytics (_ga and _ga_*). First-party analytics cookies used to distinguish users and maintain session state. Their default duration is up to 2 years, subject to browser limits. They are created only after analytics cookies are accepted.
  • Microsoft Clarity (_clck and _clsk). First-party analytics cookies that associate page views with a pseudonymous identifier and a session. Their observed durations are 1 year and 1 day respectively. They are created only after analytics cookies are accepted.
  • Google Ads (_gcl_au and _gcl_ls local storage). Advertising and conversion measurement technologies. They are created only after marketing cookies are accepted and are deleted when that consent is withdrawn.

Some pages include external services such as Google Maps, Instagram or the Checkfront booking platform. These services may process data when users open or interact with their content, according to their own settings and policies.

Changing or withdrawing consent. Users can reopen the “Cookie preferences” panel at any time to change or reject categories. When consent is withdrawn, the website removes the analytics and advertising identifiers under its control. Cookies can also be deleted through the browser settings.

Further information: Google Privacy Policy and Microsoft Privacy Statement.