Privacy Policy

Draft template: have this reviewed by your data-protection counsel before relying on it. It describes the processing this platform actually performs; adjust to your final setup and the Surfcenter operating arrangement.

1. Controller

NP7 GmbH, Graskamp 8, 24217 Schönberg, Germany. Contact: experience@np-seven.com.

2. What we process, why, and on what basis

Account & registration

When you register or sign in we process your name and email to create your member account and your trip registration (Art. 6(1)(b) GDPR, pre-contract/contract). Sign-in uses a one-time magic link.

Bookings, payments & documents

To manage a booking we process trip details, your payment milestones, invoices and (where applicable) your billing address and travel-partner details (Art. 6(1)(b)). Payments are handled by bank transfer via our operating partner; we record which milestones are paid.

Trip requests, waiting lists & Signature Trip enquiries

On np-seven.com/trips you tick the trips you’re into and give us your first name (and, if you like, your last name), email and WhatsApp number. We store them with the trips you ticked (for the Signature Trip also the months that work and how many of you would come) and where you found the link, create your NP7 account and email you a login link, so you can see all trips, dates and prices. We use this to plan the trips with you and get back to you (Art. 6(1)(b) GDPR, steps you asked for before a contract). The box you tick there is your consent to NP7 trip offers and news by email and WhatsApp (Art. 6(1)(a)). For email it only takes effect once you tap the login link we send you (double opt-in). We keep the exact wording you agreed to, when you ticked it and when you confirmed it, to be able to show your consent. You can unsubscribe any time with the link in every email, on WhatsApp, or by emailing us; withdrawal doesn’t affect prior processing.

When you ask about a trip on the Signature Trip form or a trip’s waiting list we store your name, email, the weeks or months you picked and, only if you give them, your WhatsApp number, Instagram handle, riding level, how many of you would come and your note, plus where you found the link. We use them to answer you and plan the trip with you, by email or, if you gave us the number or handle, on WhatsApp or Instagram (Art. 6(1)(b) GDPR). That creates no booking and no payment. If no booking follows, we delete or anonymise a request once we no longer need it (see Retention); your account stays until you ask us to delete it.

Waiver & health declaration

If you sign a participation waiver we store your signature, name and the version/time signed, plus a technical audit record (IP, user-agent) to evidence consent (Art. 6(1)(b) and (f), legitimate interest in documenting agreements; health data only as you disclose it, Art. 9(2)(a)). The waiver includes a paragraph on photos and videos; see Photos and videos from your trip.

Marketing email (optional)

If you opt in, we send occasional news with your consent (Art. 6(1)(a)). You can withdraw any time via the unsubscribe link or by emailing us. Withdrawal doesn’t affect prior processing.

Photos and videos from your trip

We take photos and videos during our trips. You and your crew see them in your member gallery. Beyond that there are two levels, and they work differently.

• Our website and our own social media: when you sign your waiver, you agree that we may use photos and videos of you from that trip on our website (np-seven.com) and on our own social media channels (Instagram, Facebook, YouTube) as posts. This never covers paid ads. Earlier waivers said we may use photos and videos for our own promotion; we read those the same way, for this level only. For riders under 18 a parent or guardian signs the waiver.
• Paid ads: using photos or videos of you in paid ads (for example on Instagram and Facebook, through Meta) needs your separate yes. When you sign your waiver we ask you about ads, and you answer Yes or No. If you haven’t answered yet, we may also ask on your trip page or in our photos emails. Either answer is fine and changes nothing about your trip. For riders under 18 a parent or guardian answers.
• Legal basis: for our website and social media, your agreement in the waiver (§ 22 KUG) and our legitimate interest in showing what our trips are like (Art. 6(1)(f) GDPR). For paid ads, your consent (Art. 6(1)(a) GDPR; for pictures of you also § 22 KUG). Without that yes, no photo or video of you goes into a paid ad.
• Saying no: you can object to our website and social media use at any time (Art. 21 GDPR) with the switch “NP7 may share my photos on its website and social media” on your trip page (Photos tab) or by emailing experience@np-seven.com. We then stop using new material of you. You can withdraw your yes to ads, or turn a no into a yes, the same way, with the switch “Also in paid ads”. When you withdraw, we stop using the material in any new ad and take down ads that are still running as soon as we can. Neither affects use before it. If you said no on the waiver to our earlier question about photos (website, social media and ads together), or took back an earlier yes, we treat that as a no to both levels. For riders under 18 a parent or guardian changes it by emailing us.
• Recipients: the platforms where we publish: Meta Platforms Ireland Ltd. (Instagram, Facebook and Meta ads) and Google Ireland Ltd. (YouTube). What we publish there is public and those platforms process it under their own terms, which may include transfers outside the EU.
• How long: we use them for as long as they are useful for our marketing, or until you say no (see Saying no). We keep the record of your answers (when, and the exact wording you saw) for as long as we may need to show we had your permission.

Server logs & security

Our hosting provider processes technical access data (e.g. IP address, timestamp) to deliver and secure the site (Art. 6(1)(f)). We use bot-protection on sign-up forms to prevent abuse.

3. Cookies & local storage

We group cookies and similar local storage into three categories, which you control in the cookie banner (Art. 6(1)(a) for the optional ones):

• Essential (always on, no consent needed, Art. 6(1)(f)): a sign-in session cookie, a small preference for which section you’re viewing, and a record of your cookie choice.
• Analytics (off unless you opt in): our own first-party measurement of page views and the booking funnel. No third-party analytics tools, no advertising networks, and we store no IP address with it.
• Marketing (off unless you opt in): the Meta (Facebook) Pixel and the Google Ads tag. When enabled they share your interactions (e.g. pages viewed, registrations) with Meta Platforms Ireland Ltd. and Google Ireland Ltd. so we can measure and target our advertising. This sets third-party cookies and may transfer data to Meta and Google (incl. the USA, safeguarded by EU Standard Contractual Clauses). You can withdraw consent any time via the cookie banner; this does not affect prior processing.

To change or withdraw your choice, open the Cookie settings.

4. Processors & recipients

• Supabase: database, authentication & file storage (data-processing agreement in place).
• Vercel: application hosting & bot protection.
• Resend: transactional & (opted-in) marketing email delivery.
• Surfcenter: our operating partner for bookings & payments; receives the data needed to fulfil your trip.
• Meta Platforms Ireland: Facebook/Instagram advertising measurement (Meta Pixel), only if you opt into Marketing cookies.
• Google Ireland: Google Ads measurement of sign-ups from our search ads (Google Ads tag), only if you opt into Marketing cookies.
• Instagram, Facebook, YouTube and Meta ads: where we publish photos and videos of you: posts as agreed in your waiver unless you said no, and paid ads only if you said yes (see Photos and videos from your trip).

Where a processor operates outside the EU/EEA, transfers are safeguarded by EU Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account and booking data for the duration of our relationship and as long as statutory retention periods require (e.g. commercial/tax law), then delete or anonymise it. Marketing consent data is kept until you withdraw.

6. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. To exercise these, email experience@np-seven.com. You may also lodge a complaint with a supervisory authority (in Germany, your state’s data-protection authority).

7. Changes

We may update this policy as the platform evolves. The current version is always available here.