Privacy Policy

Draft template — have this reviewed by your data-protection counsel before relying on it. It describes the processing this platform actually performs; adjust to your final setup and the Surfcenter operating arrangement.

1. Controller

Surfcenter Experience B.V., Roegeweg 1, 9629 PA Steendam, Netherlands. Contact: experience@np-seven.com.

2. What we process, why, and on what basis

Account & registration

When you register or sign in we process your name and email to create your member account and your trip registration (Art. 6(1)(b) GDPR — pre-contract/contract). Sign-in uses a one-time magic link.

Bookings, payments & documents

To manage a booking we process trip details, your payment milestones, invoices and (where applicable) your billing address and travel-partner details (Art. 6(1)(b)). Payments are handled by bank transfer via our operating partner; we record which milestones are paid.

Waiver & health declaration

If you sign a participation waiver we store your signature, name and the version/time signed, plus a technical audit record (IP, user-agent) to evidence consent (Art. 6(1)(b) and (f) — legitimate interest in documenting agreements; health data only as you disclose it, Art. 9(2)(a)).

Marketing email (optional)

If you opt in, we send occasional news with your consent (Art. 6(1)(a)). You can withdraw any time via the unsubscribe link or by emailing us — withdrawal doesn’t affect prior processing.

Server logs & security

Our hosting provider processes technical access data (e.g. IP address, timestamp) to deliver and secure the site (Art. 6(1)(f)). We use bot-protection on sign-up forms to prevent abuse.

3. Cookies & local storage

We group cookies and similar local storage into three categories, which you control in the cookie banner (Art. 6(1)(a) for the optional ones):

• Essential (always on, no consent needed, Art. 6(1)(f)) — a sign-in session cookie, a small preference for which section you’re viewing, and a record of your cookie choice.
• Analytics (off unless you opt in) — our own first-party measurement of page views and the booking funnel. No third-party analytics tools, no advertising networks, and we store no IP address with it.
• Marketing (off unless you opt in) — the Meta (Facebook) Pixel. When enabled it shares your interactions (e.g. pages viewed, registrations) with Meta Platforms Ireland Ltd. so we can measure and target our advertising. This sets third-party cookies and may transfer data to Meta (incl. the USA, safeguarded by EU Standard Contractual Clauses). You can withdraw consent any time via the cookie banner; this does not affect prior processing.

4. Processors & recipients

• Supabase — database, authentication & file storage (data-processing agreement in place).
• Vercel — application hosting & bot protection.
• Resend — transactional & (opted-in) marketing email delivery.
• Surfcenter — our operating partner for bookings & payments; receives the data needed to fulfil your trip.
• Meta Platforms Ireland — Facebook/Instagram advertising measurement (Meta Pixel), only if you opt into Marketing cookies.

Where a processor operates outside the EU/EEA, transfers are safeguarded by EU Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account and booking data for the duration of our relationship and as long as statutory retention periods require (e.g. commercial/tax law), then delete or anonymise it. Marketing consent data is kept until you withdraw.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. To exercise these, email experience@np-seven.com. You may also lodge a complaint with a supervisory authority (in Germany, your state’s data-protection authority).

7. Changes

We may update this policy as the platform evolves. The current version is always available here.