Legal
Privacy and cookie policy
Last updated: 29 September 2026.
Origem Surf School respects your privacy. This policy explains, in plain terms, what personal data we collect when you use the site origemsurfschool.com, our forms and our lessons, what we use it for, who we share it with, how long we keep it and what your rights are. It complies with Regulation (EU) 2016/679 (GDPR), Law no. 58/2019 (implementation of the GDPR in Portugal) and Law no. 41/2004 (privacy in electronic communications), in the versions in force in 2026.
1. Who the controller is
The controller of your data is Origem Surf School, a surf school operating in Cascais, Lisbon and Sintra.
- Email: info@origemsurfschool.com
- Phone: +351 210 990 816 · WhatsApp: +351 914 011 673
You can use any of these contacts for privacy questions and to exercise your rights. Given the scale of the activity we are not required to appoint a Data Protection Officer (Encarregado de Protecção de Dados); the person responsible for running the school answers these requests.
2. What data we collect and what for
2.1. Booking and contact requests
When you fill in the booking or contact forms we collect your name, email, mobile number, message, the type of lesson requested and the page from which you sent the request.
- Purpose: to reply to the request, arrange the lesson, confirm dates and send the necessary information.
- Legal basis: pre-contractual steps and performance of the contract (Article 6(1)(b) of the GDPR).
- Retention: 24 months after the last contact; if the lesson takes place, billing data is kept for 10 years for a tax obligation.
2.2. Students and parents or guardians
To give the lessons safely we may ask for information on surf level, whether you can swim, health conditions relevant to taking part in sport and, for minors, the parent or guardian's details and their authorisation.
- Purpose: safety in the water, fitting the lesson to the student and meeting the obligations of personal accident insurance.
- Legal basis: performance of the contract and legal obligations; health data is processed only with your explicit consent (Article 9(2)(a)), which you may refuse, in which case the lesson is subject to the coach's assessment.
- Minors: lessons for children are contracted by the parent or guardian. We do not ask for data directly from children under 13; below that age consent is always given by the person exercising parental responsibilities (Article 16 of Law no. 58/2019).
2.3. Newsletter
If you subscribe to the newsletter we store your email on the Mailchimp platform.
- Purpose: to send news, clinic schedules and campaigns from the school.
- Legal basis: consent (Article 6(1)(a)), which you may withdraw at any time through the "unsubscribe" link in every email.
- Retention: until you unsubscribe.
2.4. Technical and security data
When you submit a form we record the IP address and the browser type to prevent automated submissions (spam) and abuse. Access to the site's management area is logged as well.
- Legal basis: legitimate interest in the security of the site (Article 6(1)(f)).
- Retention: 12 months.
2.5. Audience measurement
Only with your consent do we load Google Tag Manager and Google Analytics, which use cookies to count visits and see which pages are viewed most (see section 6).
- Legal basis: consent, given in the cookie banner and revocable at any time in "Cookie settings", in the footer.
2.6. Social networks and WhatsApp
If you contact us by WhatsApp, Instagram or Facebook, the conversation takes place on those platforms, which process your data under their own policies (Meta Platforms Ireland). We use those messages only to reply to you.
3. We do not make automated decisions
We do not carry out profiling and we do not make solely automated decisions with legal effects on you.
4. Who we share the data with
We never sell personal data. We use service providers (processors) that process the data on our behalf, under contracts that comply with Article 28 of the GDPR:
- Vercel Inc. — site hosting and content delivery (servers in the European Union and in the USA).
- Supabase — the database where booking requests and the site images are kept (European Union region).
- Resend — sending the alert emails for new requests.
- Intuit Mailchimp — newsletter management (USA).
- Google Ireland Ltd. — Google Tag Manager and Google Analytics, only with consent; YouTube for the embedded videos, which load only when you click "play".
- The insurer and the Portuguese Surfing Federation (Federação Portuguesa de Surf) — when necessary for personal accident insurance and for the sporting framework of the activity.
- Public authorities — when the law requires us to.
International transfers. Some providers are in the United States. In those cases the transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework for certified companies and, subsidiarily, on the standard contractual clauses approved by the European Commission, with additional measures when necessary. You can ask us for a copy of the applicable safeguards.
5. How long we keep the data
We keep the data only for as long as needed for the purpose for which it was collected, according to the periods stated in section 2. Once the period ends, the data is erased or anonymised. Booking requests may be erased earlier if you ask (see your rights).
6. Cookies and similar technologies
When you enter the site we show a banner that lets you accept or refuse, with equal ease, non-essential cookies. Without your consent we only use what is strictly necessary for the site to work. Your choice is stored in your browser for 12 months and you can change it in "Cookie settings", in the footer of any page.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| origem-cookie-consent | Essential (local storage) | Store your choice about cookies | Until it is changed |
| _ga, _ga_* | Measurement (Google), only with consent | Distinguish visitors and count visits in aggregate | Up to 13 months |
| YouTube cookies | Third parties, only after you play a video | Operation of the video player (privacy-enhanced mode) | Set by YouTube |
| Mailchimp cookies | Third parties, only if you subscribe to the newsletter | Process the subscription on the Mailchimp site | Set by Mailchimp |
You can also block or delete cookies in your browser settings. Blocking essential cookies may stop parts of the site from working.
7. Your rights
Under Articles 15 to 22 of the GDPR you have the right to:
- Access the data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase the data ("right to be forgotten"), when it is no longer needed or you withdraw consent;
- Restrict processing in certain situations;
- Portability: receive the data you gave us in a structured, commonly used format;
- Object to processing based on legitimate interest, including direct marketing, at any time;
- Withdraw consent at any time, without affecting the lawfulness of processing already carried out.
To exercise these rights, write to info@origemsurfschool.com. We reply within a maximum of one month, extendable by a further two months in complex cases, and we may ask you to confirm your identity. Exercising your rights is free of charge.
If you consider that your rights have not been respected, you may lodge a complaint with the supervisory authority: Comissão Nacional de Protecção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.
8. How we protect the data
The site is served exclusively over HTTPS. Requests are kept in a database with access restricted by keys stored only on the server; the management area requires a hashed password, may require a second authentication factor and logs every action. The forms have protection against automated submissions. Our providers apply equivalent technical and organisational measures. If a personal data breach presents a high risk to you, we will notify you without delay, in accordance with Article 34 of the GDPR.
9. Links to other sites
The site may contain links to third-party sites (social networks, partners, YouTube). We do not control those sites or their privacy practices; we recommend reading the relevant policies.
10. Changes to this policy
We may update this policy to reflect legal changes or changes to our services. The date of the last update appears at the top. If the changes are significant, we give notice on the site or by email when we have your contact details.