Privacy Policy
Personal privacy settings
[rcb-consent type=“change“ tag=“a“ text=“Change privacy settings“]
[rcb-consent type=“history“ tag=“a“ text=“History of privacy settings“]
[rcb-consent type=“revoke“ tag=“a“ text=“Withdraw consent“ successmessage=“You have successfully withdrawn your consent. The page will now reload.“]
We value your trust and take the utmost care and apply the highest security standards to protect your personal data from unauthorised access. The processing of personal data on our website is carried out in accordance with the provisions of the General Data Protection Regulation (GDPR).
Data controller
Nalusurf Surf School/Surf Camp, Fuerteventura
Owner:
Ralf Geerdts, N.I.E. X3739459G
Address:
4 Calle Laja Blanca
35627 La Pared
Tel: +34 669 62 15 22
Email: info@nalusurf.de
If you have any questions regarding the collection, processing or use of your personal data, or if you wish to request information, rectification, restriction or erasure of data, please contact: info@nalusurf.de
Data processing on our website
When you visit our website, our web server temporarily records every visit in a log file. The following data is collected and stored until it is automatically deleted:
– IP address of the requesting computer
– Date and time of access
– Name and URL of the file accessed
– amount of data transferred
– Notification as to whether the retrieval was successful
– Identification data relating to the browser and operating system used.
This data is processed for the purposes of enabling the use of the website (establishing a connection), system security, technical administration, network infrastructure and optimising the website. We are unable to link this data to specific individuals. This data is not combined with other data sources; furthermore, the data is deleted following statistical analysis.
The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR.
Collection, processing and use of personal data
When processing data, your legitimate interests are always taken into account in accordance with the statutory provisions. Personal data is only collected if you voluntarily provide it to us when contacting us (such as your name, email address or postal address). We use the data you provide, without your separate consent, solely to answer your enquiries.
The legal basis for data processing is Article 6(1), first sentence, point (b) of the GDPR.
Use of functional cookies
To make your visit to our website as convenient as possible and to enable you to use certain functions, we use what are known as cookies. Cookies are small text files that are used as identifiers. We transfer these to your computer’s hard drive via your web browser and can read them whilst you are visiting our website (so-called „session cookies“). Please note that certain cookies are set as soon as you access our website. Our cookies are protected against access by third parties by your browser’s security settings. You can prevent cookies from being stored on your computer by adjusting the relevant settings in your browser. However, this may limit the functionality of our website for you.
The legal basis for data processing is Article 6(1), first sentence, point (f) of the GDPR.
We use the „Real Cookie Banner“ consent tool to manage the cookies and similar technologies (tracking pixels, web beacons, etc.) we use, and to manage consent in this regard. You can find details on how „Real Cookie Banner“ works at <a href="/en/“https://devowl.io/de/rcb/datenverarbeitung/“/" rel="“noreferrer“" target="“_blank“">https://devowl.io/de/rcb/datenverarbeitung/</a>.
The legal basis for the processing of personal data in this context is Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR. Our legitimate interest is the management of the cookies and similar technologies used, and the associated consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide personal data. If you do not provide personal data, we will be unable to manage your consents.
Using the online booking form and the enquiry form
When you use the online contact form, we collect personal data (such as your name, mobile number and email address) only to the extent that you provide it. We use your email address solely to process your enquiry. Your data will then be deleted unless you have consented to further processing and use, or a booking is made.
The legal basis for data processing is Article 6(1), first sentence, point (b) of the GDPR.
Google Analytics
We use Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics uses so-called „cookies“, which are text files stored on your computer that enable an analysis of your use of the website (e.g. to measure reach). The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there. However, as IP anonymisation is enabled on this website, your IP address will first be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On our behalf, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide us with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. In connection with the use of Google Analytics, in addition to metadata and communication data (e.g. device information and IP addresses), location data (information regarding the geographical position of a device or a person) may also be processed. Furthermore, usage data (e.g. visits to web pages, clicks, access times), contact details (e.g. email, telephone numbers), content data (e.g. entries in online forms) or master data (e.g. names, addresses) may also be processed.
Please note that on this website, Google Analytics has been enhanced with the code „gat._anonymizeIp();“ to ensure that IP addresses are collected anonymously (known as IP masking).
A connection to the Google Analytics servers is only established once you have consented to the use of Google Analytics. No Google Analytics cookies are set on your device prior to this. The information collected by the cookies may be sent to a Google server in the United States of America (USA) and stored there. There is no general adequacy decision by the European Commission for the USA certifying that the USA maintains an adequate level of data protection. By transmitting your personal data, there is a risk that US authorities may access it and process it for their own purposes. To protect your personal data, we have entered into so-called Standard Contractual Clauses („SCCs“) with Google. SCCs are data protection provisions adopted by the European Commission; their conclusion imposes legal obligations on the data importer, the fulfilment of which guarantees compliance with European data protection standards.
The legal basis for this processing and the transfer of your personal data to Google in the USA is your consent in accordance with Article 6(1), first sentence, point (a) and Article 49(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time. You can do so by adjusting your privacy settings for our website via the following link: [Link]
You can prevent cookies from being stored by adjusting the settings in your browser software; however, please note that in this case you may not be able to make full use of all the features of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), as well as prevent Google from processing this data, by clicking on the link below (http://tools.google.com/dlpage/gaoptout?hl=de) Download and install the browser plug-in available.
You can also prevent Google Analytics from collecting data by clicking on the following link. An opt-out cookie will then be set, which prevents your data from being collected when you visit this website. This is particularly recommended when accessing our site via mobile devices.
Further information on the terms of use and data protection can be found at www.google.com/analytics/terms/de.html or at www.google.com/intl/de/analytics/privacyoverview.html.
Google Fonts
We use Google Fonts, provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), on our website to ensure consistent font display – so-called web fonts provided by Google. When you visit a page, your browser loads the required fonts into its cache in order to display text and fonts correctly. To do this, the browser you are using must establish a connection to Google’s servers. As a result, Google becomes aware that our website has been accessed via your IP address. The use of Google Fonts is in the interests of a consistent and attractive presentation of our online content. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR.
If your browser does not support web fonts, a default font from your computer will be used. For more information on Google Fonts, please see https://developers.google.com/fonts/faq?tid=231550647513.
Google reCAPTCHA
On this website, we also use the reCAPTCHA feature provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland („Google“). This is a feature provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland („Google“). The primary purpose of this feature is to distinguish between input entered by a natural person and input generated maliciously through machine-based and automated processing. The service involves the transmission of the IP address, referrer URL (the address of the page from which the visitor has come), information about the operating system, cookies, mouse movements and keystrokes, time spent on the site, user device settings (e.g. language settings, location, browser, etc.) and, where applicable, any other data required by Google for the reCAPTCHA service.
When using Google reCAPTCHA, personal data may also be transferred to the servers of Google LLC in the USA. There is no general adequacy decision by the European Commission for the USA certifying that the USA provides an adequate level of data protection. By transferring your personal data, there is a risk that US authorities may access it and process it for their own purposes. To protect your personal data, we have entered into so-called Standard Contractual Clauses („SCCs“) with Google. SCCs are data protection provisions adopted by the European Commission; their conclusion imposes legal obligations on the data importer, and their implementation guarantees compliance with European data protection standards.
The legal basis for this processing and the transfer of your personal data to the USA is your consent in accordance with Article 6(1), first sentence, point (a) and Article 49(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time. You can adjust your privacy settings for our website via the following link: [Link]
Further information on Google reCAPTCHA and Google’s privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/
Google Tag Manager
We use Google Tag Manager, provided by Google Inc., on our website. For the European region, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for Google Tag Manager.
Google Tag Manager allows us to integrate and manage website tags centrally via a single user interface. Tags are small sections of code that, for example, track your activity on our website. Buttons can also be integrated using these tags.
Tag Manager itself is a domain that does not set any cookies or store any data, but merely acts as an administrator. In the Tag Manager account settings, we have consented to Google receiving anonymised data from us. However, this data relates solely to our use of Tag Manager and does not include your personal data. Google Tag Manager itself does not process any personal data relating to you as a visitor to our website.
For more information about Google Tag Manager, please visit: https://support.google.com/tagmanager/answer/9323295?hl=de
Google Maps
Nalusurf integrates maps from the “Google Maps” service provided by Google and processes user data in this context. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; website: https://cloud.google.com/maps-platform.
We use Google Maps to show you the location of our company, as well as the possible routes and transport options for getting here.
In connection with the use of Google Maps, metadata and communication data (e.g. device information and IP addresses) as well as location data (information regarding the geographical position of a device or a person) are processed in particular. However, usage data (e.g. website visits, clicks, access times), contact details (e.g. email, telephone numbers), content data (e.g. entries in online forms) or master data (e.g. names, addresses) may also be processed.
Please note that when using a mobile device, your location data settings on that device may also affect the scope of the data collected.
A connection to the Google Maps servers is only established once you have consented to the use of Google Maps via the integrated button for the service. No Google Maps cookies are set on your device prior to this. The information collected by the cookies is usually sent to a Google server in the United States of America (USA) and stored there. There is no general adequacy decision by the European Commission for the USA certifying that the USA has an adequate level of data protection. By transmitting your personal data, there is a risk that US authorities may access it and process it further for their own purposes. To protect your personal data, we have entered into so-called Standard Contractual Clauses („SCCs“) with Google. SCCs are data protection provisions adopted by the European Commission; entering into them imposes legal obligations on the data importer, the fulfilment of which guarantees compliance with European data protection standards.
The legal basis for this processing and the transfer of your personal data to Google Maps in the USA is your consent in accordance with Article 6(1), first sentence, point (a) and Article 49(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time. You can do this by adjusting your privacy settings for our website via the following link: [Link]
Detailed information on data processing on Google Maps, as well as on how to exercise your rights as a data subject vis-à-vis Google Maps, can be found at: https://policies.google.com/privacy. Information on how to opt out can be found at: https://tools.google.com/dlpage/gaoptout?hl=de. Information on settings for the display of advertisements can be found at: https://adssettings.google.com/authenticated.
YouTube
Nalusurf embeds video content from Google’s “YouTube” service and processes users’ data in this context. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
We use YouTube to show you video content.
In connection with the use of YouTube video content, metadata and communication data (e.g. device information and IP addresses) in particular are processed. However, usage data (e.g. visits to web pages, clicks, times of access), contact details (e.g. email, telephone numbers), content data (e.g. entries in online forms) or master data (e.g. names, addresses) may also be processed.
We use YouTube in enhanced privacy mode. According to YouTube, this mode ensures that YouTube does not store any information about users of our website until they have consented to the processing of their data or have viewed the video. However, enhanced privacy mode does not necessarily prevent YouTube from sharing data. YouTube establishes a connection to the Google DoubleClick network regardless of whether you watch a video or not.
A connection to YouTube’s servers is only established once you have consented to the use of YouTube via the embedded preview image of the service. No YouTube cookies are set on your device prior to this. Please note that it is possible for this data to be linked to other data (in some cases, including data on other devices). This risk is particularly likely if you have a YouTube account and are logged in to YouTube. To avoid further data linking, we recommend that you log out of YouTube before visiting our company website.
The information collected by the cookies is usually sent to a Google server in the United States of America (USA) and stored there. There is no general adequacy decision by the European Commission in respect of the USA certifying that the USA provides an adequate level of data protection. By transmitting your personal data, there is a risk that US authorities may access it and process it for their own purposes.
The legal basis for data processing in connection with the embedding and display of preview images is Article 6(1), first sentence, point (f) of the GDPR.
The legal basis for the processing carried out by YouTube and the transfer of your personal data to YouTube in the USA is your consent in accordance with Article 6(1), first sentence, point (a) and Article 49(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time. You can do this by adjusting your privacy settings for our website via the following link: [Link]
You can find detailed information on data processing in the privacy policy at: https://policies.google.com/privacy. For information on how to opt out, please see: https://tools.google.com/dlpage/gaoptout?hl=de. You can find information on the settings for displaying adverts at: https://adssettings.google.com/authenticated.
Nalusurf maintains an online presence on the social network „Facebook“ and processes users’ data in this context. The service provider is Facebook Inc, 1601 Willow Road, Menlo Park, California 94025; Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland.
[We/Company Name] uses Facebook to provide information about the company and to communicate with active users via the network. Furthermore, data may be processed through the use of Facebook for market research and advertising purposes. This is carried out, for example, on the basis of tracking, which may involve, amongst other things, interest- or behaviour-based profiling or the use of cookies. Remarketing and audience measurement are also employed, for which, for example, access statistics – which identify returning visitors – are compiled.
In connection with the use of our online presence on Facebook, the following types of data may be processed: Personal details and contact details (e.g. name, address, email address, telephone number), content data (e.g. entries in online forms, use of the messaging function), usage data (e.g. visits to web pages, clicks, access times), metadata and communication data (e.g. device information, IP addresses).
With regard to data processing on our Facebook fan page, [we/Company Name] and Facebook Ireland are joint controllers in accordance with Article 26 of the GDPR. The legal basis for the processing of personal data is Article 6(1)(f) of the GDPR. You may exercise your data subject rights directly with Facebook or with [us/company name]. Under the GDPR, the primary responsibility for the processing of Insights data lies with Facebook, and Facebook fulfils all obligations under the GDPR with regard to the processing of Insights data. You can find further information via the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
[We/Company Name], as the operator, do not make any decisions regarding the processing of Insights data or any other information arising from Article 13 of the GDPR, including the legal basis, the identity of the data controller and the retention period for cookies on users’ devices.
The transfer of data to Facebook is governed by the European Commission’s Standard Contractual Clauses, supplemented by the Facebook-EU Data Transfer Addendum, which is available at https://www.facebook.com/legal/EU_data_transfer_addendum. Although, under the Facebook-EU Data Transfer Addendum, Facebook Ireland is the data controller, we would like to point out that it cannot be ruled out that the information collected by the cookies may be sent to a Facebook server in the United States of America (USA) and stored there. There is no general adequacy decision by the European Commission for the USA certifying that the USA offers an adequate level of data protection. By transferring your personal data, there is a risk that US authorities may access it and process it for their own purposes.
Please note that it is possible for this data to be linked to other data (in some cases, including data on other devices). This risk is particularly high if you have a Facebook account and are logged in to Facebook. To avoid further data linking, we recommend that you log out of Facebook before visiting our company page.
Further information can be found in Facebook Ireland’s Privacy Policy, available at: https://www.facebook.com/about/privacy
Nalusurf maintains an online presence on the social network „Instagram“ and processes users’ data in this context. The service provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA; website: https://www.instagram.com.
Nalusurf uses Instagram to provide information about the company and to communicate with active users on the platform. Furthermore, data may be processed through the use of Instagram for market research and advertising purposes. This is carried out, for example, on the basis of tracking, which may involve, amongst other things, interest- or behaviour-based profiling or the use of cookies. Remarketing and reach measurement are also utilised, for which, for example, access statistics – which identify returning visitors – are compiled.
In connection with the use of our online presence on Instagram, the following types of data may be processed: Personal details and contact details (e.g. name, address, email address, telephone number), content data (e.g. entries in online forms, use of the messaging function), usage data (e.g. visits to web pages, clicks, access times), metadata and communication data (e.g. device information, IP addresses).
Instagram is a Facebook product. With regard to data processing on our Instagram fan page, we and Facebook are joint controllers under Article 26 of the GDPR. The legal basis for the processing of personal data is Article 6(1)(f) of the GDPR. You may exercise your data subject rights directly with Facebook or with us. Under the GDPR, the primary responsibility for the processing of Insights data lies with Facebook, and Facebook fulfils all obligations under the GDPR with regard to the processing of Insights data. Further information is available via the following link: https://www.facebook.com/legal/terms/page_controller_addendum
As the operator, we do not make any decisions regarding the processing of Insights data or any other information arising from Article 13 of the GDPR, including the legal basis, the identity of the data controller and the retention period for cookies on users’ devices.
The transfer of data to Instagram is governed by the European Commission’s Standard Contractual Clauses, supplemented by the Facebook-EU Data Transfer Addendum, available at https://www.facebook.com/legal/EU_data_transfer_addendum. Although, under the Facebook-EU Data Transfer Addendum, Facebook Ireland is the data controller, we would like to point out that it cannot be ruled out that the information collected by the cookies may be sent to a Facebook server in the United States of America (USA) and stored there. There is no general adequacy decision by the European Commission for the USA certifying that the USA offers an adequate level of data protection. By transferring your personal data, there is a risk that US authorities may access it and process it for their own purposes.
Please note that it is possible for this data to be linked to other data (in some cases, including data on other devices). This risk is particularly high if you have an Instagram account and are logged in to Instagram. To avoid further data linking, we recommend that you log out of Instagram before visiting our company page.
Further information can be found in Facebook Ireland’s Privacy Policy, available at: https://www.facebook.com/about/privacy
Our safety standards
Your personal data is transmitted via the internet on our website using the SSL (Secure Socket Layer) security system. This technology offers a high level of security and is therefore also used, for example, by banks to protect data during online banking. We protect our website and other systems against the loss, destruction, unauthorised access, alteration or disclosure of your data by unauthorised persons through technical and organisational measures.
Rights of those affected
Under the GDPR, you are entitled to the following statutory rights as a data subject, provided that the relevant conditions are met:
- Right to access the data we hold about you in accordance with Article 15 of the GDPR,
- Right to rectification of inaccurate data pursuant to Article 16 of the GDPR,
- Right to erasure of data stored by us in accordance with Article 17 of the GDPR,
- Right to restrict the processing of data held by us in accordance with Article 18 of the GDPR,
- Right to data portability under Article 20 of the GDPR,
- The right to withdraw, at any time, any consent that may have been given to us, in accordance with Article 7(3) of the GDPR; this means that we may no longer continue to process data on the basis of that consent in future.
- The right to lodge a complaint with a competent supervisory authority in accordance with Article 77 of the GDPR if you believe that the processing of your personal data infringes the provisions of the GDPR.
Right to object
Where your personal data is processed on the basis of legitimate interests in accordance with Article 6(1), first sentence, point (f) of the GDPR, you have the right, in accordance with Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds for doing so arising from your particular situation.
If you wish to exercise your right to object, simply send an email to: info@nalusurf.de
