I. PRIVACY POLICY AND DATA PROTECTION
In accordance with the applicable legislation, Isla Surf School Tenerife (hereinafter also referred to as the “Website”) is committed to adopting the technical and organisational measures necessary to ensure a level of security appropriate to the risk associated with the personal data collected.
Legislation Applicable to this Privacy Policy
This Privacy Policy complies with the current Spanish and European legislation regarding the protection of personal data on the Internet, in particular:
Identity of the Data Controller
The controller responsible for processing personal data collected through Isla Surf School Tenerife is:
Jonathan Méndez Peraza
Tax ID (NIF): 78.556.795-L
Address: Calle La Marina, 8, 5th Floor, 38400 Puerto de la Cruz, Santa Cruz de Tenerife, Spain
Telephone: +34 626 455 630
Email: isla.surfschool.tenerife@gmail.com
Processing of Personal Data
In accordance with the GDPR and the LOPD-GDD, personal data collected through the forms available on the Website will be incorporated into our processing activities for the purpose of facilitating, managing and maintaining the relationship established with Users, responding to enquiries, processing bookings and fulfilling any contractual obligations.
Where required by law, Isla Surf School Tenerife maintains a Record of Processing Activities in accordance with Article 30 of the GDPR.
Principles Governing the Processing of Personal Data
The processing of Users’ personal data is carried out in accordance with the principles established in Article 5 of the GDPR:
Categories of Personal Data
The Website processes only the personal data strictly necessary to provide its services, including identification and contact information.
Special categories of personal data, as defined in Article 9 of the GDPR, are not processed as a general rule.
However, where the User voluntarily provides information relating to health or any other special category of personal data—for example, to communicate a medical condition relevant to participation in a surf lesson—such data will only be processed with the User’s explicit consent and solely for the purpose of ensuring the safe provision of the contracted service.
Legal Basis for Processing
The legal basis for processing personal data is:
The User may withdraw consent at any time without affecting the lawfulness of processing carried out prior to such withdrawal.
Whenever data is requested through forms on the Website, the User will be informed whether providing specific information is mandatory because it is necessary to process the request or booking.
Purposes of the Processing of Personal Data
Personal data collected through Isla Surf School Tenerife is processed for the purpose of managing, facilitating and fulfilling the relationship established between the Website and the User, processing bookings, responding to enquiries and providing the requested services.
Personal data may also be used for administrative, operational, statistical and commercial purposes related to the activities of Isla Surf School Tenerife, including improving the Website, analysing its performance and personalising the content and services offered to Users.
Whenever personal data is collected, Users will be informed of the specific purpose or purposes for which their information will be processed.
Data Retention Period
Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected and to comply with any legal obligations applicable to Isla Surf School Tenerife.
Whenever personal data is collected, Users will be informed of the applicable retention period or, where this is not possible, of the criteria used to determine that period.
Recipients of Personal Data
Personal data will not be disclosed to third parties, except where required by law or where this is necessary for the provision of the contracted services (for example, payment service providers or hosting providers acting as data processors).
Whenever personal data is collected, Users will be informed of the recipients or categories of recipients of their data.
Should personal data be transferred to a third country or an international organisation, Users will be informed accordingly, together with information regarding the applicable safeguards in accordance with the GDPR.
Personal Data of Minors
In accordance with Article 8 of the GDPR and Article 7 of the Spanish Organic Law 3/2018, only persons aged 14 years or older may lawfully consent to the processing of their personal data.
Where the User is under the age of 14, the consent of a parent or legal guardian will be required.
Security and Confidentiality of Personal Data
Isla Surf School Tenerife has adopted the technical and organisational measures necessary to guarantee the security and confidentiality of personal data and to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The Website uses an SSL (Secure Socket Layer) certificate, ensuring that personal data transmitted between the User and the Website is encrypted and securely protected.
Although every reasonable effort is made to safeguard personal data, no Internet transmission can be guaranteed to be completely secure.
Should a personal data breach occur that is likely to result in a high risk to the rights and freedoms of individuals, Isla Surf School Tenerife will notify the affected Users without undue delay, in accordance with the GDPR.
All personal data will be treated as strictly confidential. Employees, collaborators and any third parties with authorised access are bound by confidentiality obligations.
Users’ Rights
Users may exercise the following rights recognised under the GDPR and applicable Spanish legislation:
To exercise any of these rights, Users may send a written request indicating “GDPR – www.islasurfschooltenerife.com“, including:
Requests may be sent to:
Postal address
Calle La Marina, 8, 5th Floor
38400 Puerto de la Cruz
Santa Cruz de Tenerife
Spain
isla.surfschool.tenerife@gmail.com
Links to Third-Party Websites
This Website may contain hyperlinks to third-party websites that are not owned or operated by Isla Surf School Tenerife.
These third-party websites have their own privacy policies and are solely responsible for their own data processing practices and the protection of any personal data collected through their websites.
Complaints to the Supervisory Authority
If the User believes that the processing of their personal data infringes applicable data protection legislation, they have the right to effective judicial protection and to lodge a complaint with the competent supervisory authority.
In Spain, the competent supervisory authority is the Spanish Data Protection Agency (AEPD):
Users residing in another Member State of the European Union may also lodge a complaint with the supervisory authority in their country of residence, place of work or where the alleged infringement occurred.
II. ACCEPTANCE OF AND CHANGES TO THIS PRIVACY POLICY
The User acknowledges that they have read and understood this Privacy Policy and agree to the processing of their personal data in accordance with the terms set out herein.
By accessing and using this Website, the User accepts this Privacy Policy.
Isla Surf School Tenerife reserves the right to modify this Privacy Policy at any time in response to legislative changes, case law, guidance issued by the Spanish Data Protection Agency or for any other legitimate reason.
Any amendments will become effective upon publication on this Website. Users are therefore encouraged to review this page periodically.
This Privacy Policy has been updated in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights.
This Privacy Policy was created on 9 July 2026.
