Privacy policy

1. Data controller

The controller of your data is Ignacio Floris Canal (BCN Surf School), NIF 47725048W, with registered address at Calle Rocafort 244, 08029 Barcelona. For any privacy matter you can write to us at hello@bcnsurfschool.es.

2. What data we process

• Identifying and contact data: first name, surname, email and phone.
• Booking data: activity, date, number of participants and data needed to provide the service.
• Payment data: payments are processed through our gateway; we do not store your full card details.
• Data you provide voluntarily when contacting us or taking part in the activities.

3. For what purpose and legal basis

• Manage your bookings and provide the service contracted (legal basis: performance of the contract).
• Deal with your enquiries and communicate with you (legal basis: your consent or legitimate interest).
• Comply with our legal, tax and accounting obligations (legal basis: legal obligation).
• Send you commercial communications (news, offers and school activities) when you have given us your consent (art. 6.1.a GDPR) or, if you are already a customer, about our own activities similar to the ones you booked (art. 21.2 LSSI and art. 6.1.f GDPR, legitimate interest). Either way you can unsubscribe with one click in any of those emails, or by writing to us.

How to stop receiving our marketing emails. Every email we send carries an unsubscribe link that works with a single click, no explanations needed. You can also write to us at hello@bcnsurfschool.es and we will take you off the list the same day. Unsubscribing from marketing does not affect your booking emails: you will keep receiving those, because they are part of the service you booked.

4. Data processors

In order to provide you with the service, we work with providers who act as data processors and comply with data protection regulations:

• Stripe, for the secure processing of payments.
• Google (Firebase / Firestore), for the technical management of bookings and the app.

These providers only process the data following our instructions and for the purposes indicated.

5. Data retention

We will keep your data for as long as the relationship with the school lasts and, afterwards, for the periods legally required to address possible liabilities (for example, tax-related). When they are no longer needed, we will delete them securely.

6. Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction and portability of your data, as well as withdraw the consent you have given. To do so, write to us at hello@bcnsurfschool.es stating the right you wish to exercise. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that we have not handled your request correctly.

7. Images and social media

During the activities we may capture images that we publish on our social media and website for promotional purposes, as detailed in our Terms and conditions. You can object to or request the removal of your image by writing to us at hello@bcnsurfschool.es.

8. Cookies and analytics

By default, this website does not set any analytics or advertising cookies. When you visit, you will see a cookie notice: these tools are only activated if you click “Accept”:

• Google Analytics 4 (Google Ireland Ltd.): website usage statistics to help us improve the site. Its cookies last a maximum of around 14 months.
• Meta Pixel (Meta Platforms Ireland Ltd.): measurement of our Facebook and Instagram campaigns. If you do not accept, the pixel is not loaded at all.

Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time. Recipients: Google and Meta, with possible transfers to the USA under the EU–US Data Privacy Framework. Changed your mind? Your choice is stored in your browser; clear this site’s data in your browser and the notice will appear again.

In addition, the site uses the strictly necessary technical cookies required for it to work, which do not require consent.

9. Data deletion

If you want to request the deletion of your personal data or the data associated with your app account, see the Delete data page.

10. Automated assistant on Instagram (messages and comments)

When you send a direct message or a comment to our Instagram account (@bcn_surfschool), your enquiry may be handled by an automated assistant based on artificial intelligence, supervised by our team. Here we explain how we process your data on that channel.

Controller. Ignacio Floris Canal (BCN Surf School), NIF 47725048W, Calle Rocafort 244, 08029 Barcelona — hello@bcnsurfschool.es.

What data we process. Only the data that the platform passes to us when you write to us:

• your Instagram username (and the public name on your profile);
• the content of the messages or comments you send to our account, including any personal data you choose to include in them;
• technical identifiers of the conversation provided by Meta’s platform, which are necessary in order to reply to you.

We do not access your follower list, your private posts or any other data from your account, and we do not combine this data with advertising profiles.

What we use it for (purpose). Exclusively to answer your enquiries about our activities (schedules, prices, bookings, conditions) and to provide customer service. We do not use this data for advertising, we do not build profiles with it and we do not sell it or disclose it to third parties for commercial purposes.

Legal basis (GDPR). The processing is based on art. 6.1.b GDPR (taking pre-contractual steps at your request, where your enquiry relates to contracting our activities) and on art. 6.1.f GDPR (our legitimate interest in dealing with communications that you yourself initiate by writing to us on Instagram; you may object at any time). We ask you not to send us health data or other special categories of data through this channel; if they are relevant to a booking, we will request them through the appropriate channel with the corresponding safeguards.

Who is involved in the processing (processors and platforms).

• Meta Platforms Ireland Ltd. — as the provider of Instagram and of the messaging API through which we receive and send messages. Meta also processes your data as an independent controller in its capacity as a social network, in accordance with its own privacy policy.
• Anthropic — as a data processor providing the artificial intelligence service (the Claude model) used to generate the assistant’s replies. Anthropic processes the content of the messages solely following our instructions in order to generate the reply, under a data processing agreement (DPA), and does not use this data to train its models.
• Google (Firebase / Google Cloud) — as a processor, for the technical hosting of the service.

Some of these providers may process data outside the European Economic Area (USA); in that case the transfers are covered by adequacy decisions (such as the EU–US Data Privacy Framework) or by Standard Contractual Clauses approved by the European Commission.

How long we keep it. We keep conversations for the time strictly necessary to deal with your enquiry and any follow-up and, at most, for 12 months from the last message, unless the conversation leads to a booking (in which case the booking data is governed by the general periods of this policy) or we need to keep it for the defence against claims. After that, it is deleted or anonymised.

Human oversight. The assistant is automated, but our team may review the conversations to ensure the quality of the replies and to deal with cases the assistant cannot resolve. The assistant does not take decisions with legal effects concerning you (art. 22 GDPR): bookings, payments and cancellations are always completed through the usual channels.

Your rights. You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). To delete the data from this channel, follow the instructions on the Delete data page.