PRIVACY POLICY – SURF GARAGE CLUB DEPORTIVO

Last updated: 09/12/2025

Surf Garage Club Deportivo (hereinafter, “Surf Garage”), with Tax ID (CIF) G19369669, registered address at C/ Usandizaga 29, Bajo 3, 20002 San Sebastián (Gipuzkoa), Spain, and contact email admin@surfgaragesansebastian.com, is responsible for processing the personal data provided through this website, forms, the NUBAPP/RESASPORT platform, sports activities, and communications with our users.

This Policy explains how we collect, use, and protect your personal information in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. DATA WE COLLECT

We may collect the following categories of data:

a) Identification and Contact Data

• Full name

• ID number (DNI/NIE), when required for insurance, school sports, or administrative procedures

• Phone number

• Email address

• Postal address

• Handwritten or digital signature

b) Children’s Data

For camps, surfskate, skate, and other children’s activities:

• Child’s full name

• Date of birth

• School grade

• Parent or legal guardian details

• Information necessary for the child’s safety (allergies, relevant medical notes voluntarily provided by guardians)

c) Contractual and Administrative Data

• Contracted services (membership, board storage, classes, camps, rentals, events)

• Attendance or booking history

• Signed contractual documentation (SEPA mandates, authorizations, liability waivers)

d) Payment Data (depending on the contracted service)

1. Membership / Board Storage / Skate & Surfskate Classes

For recurring services we collect:

• IBAN

• Account holder name

• SEPA mandate signature

The IBAN is used exclusively for managing authorized recurring payments.

2. Surf Equipment Rentals

For occasional rentals and leasing:

• Card number and expiry date, stored securely and tokenized within NUBAPP

These data are used solely as a guarantee or deposit to cover damages, losses, or contractual breaches, according to the signed rental agreement.
Surf Garage does not directly store full card numbers outside the secure system.

e) Browsing Data

• IP address

• Browser and device type

• Pages visited and session duration

• Cookies (see Cookie Policy)

f) Images

Photos or videos may be taken during children’s activities or events only with the express consent of the parent or legal guardian.

2. PURPOSES OF PROCESSING

We use personal data for:

a) Service Provision

• Managing memberships and fees

• Managing rentals, classes, camps, and club activities

• Controlling access to facilities

• Handling bookings and information requests

• Providing customer service and resolving incidents

b) Payment Management

• SEPA direct debits (membership, classes, board storage)

• Processing one-time payments

• Applying authorized deposits in rental agreements

c) Legal Compliance

• Administrative, accounting, and sports-related obligations

• Insurance requirements

• Communication with public authorities when necessary

d) Communications

• Informing about schedule changes, services, or incidents

• Sending information about club activities and updates

• Sending commercial communications only where consent has been given

e) Security and Prevention

• Ensuring proper use of facilities

• Detecting or preventing fraud, damage, or misuse

3. PROCESSING OF CHILDREN’S DATA

At Surf Garage, children’s data receive special protection:

• Prior consent from parents or legal guardians is required.

• Only strictly necessary information is requested.

• Images are never used without express authorization.

• Guardians may withdraw consent at any time.

4. DATA SHARING

We do not sell personal data.

We may share data only with:

a) Service Providers

• NUBAPP/RESASPORT platform

• Web hosting and email providers

• Payment processors

• Secure storage systems

• Accounting and administrative support

All under data processing agreements compliant with GDPR.

b) Public Authorities or Sports Entities

Only when necessary:

• Sports federations

• Insurance companies

• Local government or official bodies

• Judicial requirements

5. DATA RETENTION PERIODS

• Contractual documentation: duration of the relationship + legal retention periods

• SEPA mandates: duration + 3 years

• Card data for rentals: only during the deposit period

• Children’s data: during the activity + statutory limitation period

• Contact data: until consent is withdrawn

• Accounting records: according to applicable legislation

6. USER RIGHTS

You may exercise the following rights at any time:

• Access to your data

• Rectification of inaccurate data

• Erasure where applicable

• Restriction of processing

• Objection to processing or commercial communications

• Data portability

• Withdrawal of consent

To exercise your rights:

📧 admin@surfgaragesansebastian.com
📞 +34 608 923 097
📬 C/ Usandizaga 29, Bajo 3 – 20002 San Sebastián, Spain

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. DATA SECURITY

We implement technical and organizational measures to:

• Protect data against unauthorized access

• Prevent loss, alteration, or destruction

• Ensure confidentiality and security

• Maintain card data under secure tokenized systems

However, no technology is completely infallible, and we apply reasonable measures to minimize risks.

8. INTERNATIONAL TRANSFERS

If any service provider is located outside the European Economic Area (EEA), we will apply:

• Appropriate safeguards

• Standard Contractual Clauses

• Other mechanisms approved by the European Commission

9. POLICY UPDATES

We may update this Policy to reflect legal changes or internal improvements.
The current version will always be available on our website.

10. CONTACT

Surf Garage Club Deportivo
C/ Usandizaga 29, Bajo 3
20002 San Sebastián (Gipuzkoa), Spain

📧 admin@surfgaragesansebastian.com
📞 +34 608 923 097