PRIVACY POLICY
Last updated: May 2026
1. Introduction
Welcome to Moana Surf School. We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), Portuguese Law no. 58/2019 of 8 August, and Portuguese Law no. 41/2004 of 18 August (ePrivacy).
This Privacy Policy explains how we collect, use, store and protect your information when you visit our website, make a booking, or interact with us.
2. Data Controller
The data controller responsible for your personal data is:
Moana Surf School
Moana Surf School Unipessoal Lda.
NIF 515565288
Estrada do Abano, Praia do Guincho, 2755-144 Cascais, Portugal
Email: info@moanasurfschool.com
Phone: +351 964 449 436
Website: https://moanasurfschool.com
3. What Data We Collect
We may collect the following categories of personal data:
• Identity data: name, date of birth (where relevant for age requirements)
• Contact data: email address, phone number
• Booking data: service booked, dates, group size, special requests
• Payment data: payment method, transaction reference (we do not store full credit card numbers)
• Technical data: IP address, browser type, device information, pages visited
• Communication data: messages sent through contact forms, email, or WhatsApp
• Media data: photos and videos taken during lessons (with consent)
• Health data: medical conditions, physical limitations, or allergies disclosed for safety purposes (Art. 9 GDPR — processed only with your explicit consent and solely to ensure your safety during water-based activities)
• Emergency contact data: name and phone number of a designated emergency contact (where provided)
4. How and Why We Use Your Data
We process your data based on the following legal grounds under Article 6 GDPR:
Contract Performance (Art. 6(1)(b) GDPR)
• Processing bookings, reservations and payments
• Communicating lesson schedules, changes and confirmations
• Providing the booked services (surf lessons, equipment rental, activities)
Legitimate Interest (Art. 6(1)(f) GDPR)
• Improving our website and services based on usage patterns
• Responding to inquiries and customer support
• Website analytics (anonymized/aggregated where possible)
Consent (Art. 6(1)(a) GDPR)
• Marketing communications (newsletters, offers)
• Non-essential cookies (analytics, marketing, embedded content)
• Publication of photos/videos featuring participants
Legal Obligation (Art. 6(1)(c) GDPR)
• Retaining booking and payment records for tax and accounting purposes
5. Cookies
Our website uses cookies and similar technologies. For full details on which cookies we use, their purposes and how to manage your preferences, please see our separate Cookie Policy.
Non-essential cookies are only activated after you have given explicit consent through our cookie consent banner.
6. Third-Party Services
We use the following third-party services that may process personal data:
• Google Analytics (GA4) — website analytics (data processed in the EU/EEA where possible)
• Google Maps — location display on our website
• Instagram / Meta — embedded social media content
• YouTube — embedded video content
• WhatsApp (Meta) — customer communication
7. Data Retention
We retain your personal data only as long as necessary:
• Booking and payment records: 5 years
• Contact form inquiries: 12 months after the inquiry is resolved
• Marketing consent records: until consent is withdrawn
• Analytics data: maximum 14 months
• Photos/videos: until consent is withdrawn, or upon request
8. Your Rights Under GDPR
Under the GDPR, you have the right to:
• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Request erasure of your data (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7(3))
To exercise any of these rights, contact us at: info@moanasurfschool.com
We will respond to your request within 30 days.
9. Supervisory Authority
If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese data protection authority:
CNPD — Comissão Nacional de Proteção de Dados
Av. D. Carlos I, 134 — 1.o, 1200-651 Lisboa, Portugal
Website: https://www.cnpd.pt
Email: geral@cnpd.pt
10. Children’s Data
We offer surf lessons and camps for children aged 5+. Under Portuguese law (Law no. 58/2019), the age of consent for information society services is 13 years. For children under 13, we require parental or guardian consent before processing any personal data.
Photos and videos of minors are only published with explicit written consent from their parent or legal guardian.
11. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. Our website uses SSL/TLS encryption.
12. Contact
Moana Surf School
info@moanasurfschool.com
+351 964 449 436
Estrada do Abano, Praia do Guincho, 2755-144 Cascais, Portugal