Privacy Policy

The protection of your personal data is very important to us. We process your personal data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and other applicable data protection provisions.

This privacy policy informs you about what personal data we collect when you visit our website and use our services, for what purposes we process this data and what rights you have.

Responsible

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Surf Spirit GmbH & Co. KGAt the steering wheel 7
33609 Bielefeld
Germany

Email: hello@surf-spirit.com
Telephone: +49 156 79505600

Your rights as a data subject

Under the applicable legal provisions, you have the following rights regarding the processing of your personal data:

Right to information about the personal data we process (Art. 15 GDPR)
Right to rectification of inaccurate or completion of incomplete personal data (Art. 16 GDPR)
Right to erasure of your personal data, provided that no legal retention obligations or other legal grounds preclude erasure (Art. 17 GDPR)
Right to restriction of processing under the conditions of Article 18 GDPR
Right to data portability pursuant to Article 20 GDPR, provided that the processing is based on consent or a contract and is carried out using automated means.
Right to object to the processing of your personal data pursuant to Article 21 GDPR, insofar as the processing is based on legitimate interests.

If the processing of your personal data is based on your consent, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Furthermore, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The supervisory authority responsible is, in particular, the one in your place of habitual residence, your place of work, or our company's registered office.

An overview of the data protection supervisory authorities in Germany can be found at:

https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Collection of general information when visiting our website

Server log files

When you access our website, i.e., if you do not register or otherwise submit information, general information is automatically collected. This information (server log files) includes, for example, the type of web browser, the operating system used, the domain name of your internet service provider, your IP address, and similar data.

They are processed in particular for the following purposes:

Ensuring a smooth connection to the website,
Ensuring the smooth operation of our website,
Evaluation of system security and stability as well as
for other administrative purposes.

We do not use your data to draw conclusions about you personally. Information of this kind may be statistically evaluated by us to optimize our website and the underlying technology.

Purpose of processing

The processing of server log files is carried out in particular for the purpose of

Provision and secure delivery of our website,
Ensuring system security and stability,
Error analysis and troubleshooting,
Prevention of abuse as well as
Technical optimization of our website.

Legal basis

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically flawless provision of our website.

Recipient

As part of the hosting process, personal data may be processed on our behalf by our hosting provider (Webflow). This processing takes place exclusively within the framework of an existing data processing agreement in accordance with Article 28 of the GDPR.

Storage duration

Server log files are only stored for as long as is necessary to ensure the secure operation of the website or as required by law.

Cookies and consent management

General information

Our website uses cookies and similar technologies to enable the use of certain functions, to ensure the security of the website, to carry out statistical analyses and to improve our marketing measures.
Cookies are small text files that are stored on your device and contain certain information. Some cookies are technically necessary, while others are only used after you have given your consent.
When you first visit our website, you can use our consent management to decide which categories of cookies and similar technologies you wish to consent to.
You can change or withdraw your consent at any time with effect for the future via the cookie settings of our website.

Types of cookies used

Depending on your selection, the following categories of cookies and similar technologies may be used on our website:
Technically necessary cookies
- These cookies are necessary to provide the basic functions of the website. Without them, certain areas or functions of the website cannot be used properly.
Analyse-Cookies
- Analytics cookies help us understand how visitors use our website. We use the information gathered solely for statistical analysis and to improve our online services.

Marketing-Cookies

Marketing cookies allow us to measure the success of our advertising campaigns, deliver personalized advertising, and tailor our offers to your interests.

Personalization cookies

These cookies allow us to save settings or preferences and thereby improve the user-friendliness of our website.

Legal basis

Technically necessary cookies are used on the basis of Section 25 Paragraph 2 TDDDG and Article 6 Paragraph 1 Letter f GDPR.
All other cookies and similar technologies are used exclusively on the basis of your consent in accordance with Section 25 Paragraph 1 TDDDG and Article 6 Paragraph 1 Letter a GDPR.

Storage duration

The storage duration of the cookies used depends on their specific purpose and can vary depending on the cookie. Session cookies are generally deleted after you close your browser. Persistent cookies remain stored on your device until they expire automatically or are deleted by you.
Further information on the specific cookies used and their storage duration can be found in the settings of our cookie consent tool.

Contact form

When you contact us via the contact form on our website, we process the personal data you provide exclusively for processing your request and for further communication with you.

Depending on the nature of your request, this may include the following data in particular:

First and Last Name
Email Address
Telephone number (if provided)
Content of your message
further information voluntarily submitted

Providing further information is voluntary.

Purpose of processing

Your data will be processed in order to

To process your request,
to get in touch with you,
To answer follow-up questions
to provide you with information about our offers as well as
If necessary, to prepare pre-contractual measures or a later contract conclusion.

Legal basis

The processing of your request is based on the following criteria, depending on the content of your request:

Article 6 paragraph 1 letter b GDPR, insofar as the contact is made in connection with the initiation or execution of a contract,

Article 6 paragraph 1 letter f GDPR, insofar as our legitimate interest lies in processing general inquiries and efficient communication with interested parties.

Recipient

We use Webflow as a technical service provider to offer our contact form. Personal data may be processed within the framework of an existing data processing agreement in accordance with Article 28 GDPR.

Your data will only be shared beyond this point if it is necessary to process your request, if there is a legal obligation to do so, or if you have given your consent.

Storage duration

We only store your personal data for as long as is necessary to process your request or as required by law.

If a contractual relationship is established as a result of your inquiry, your data will be stored within the framework of the statutory retention periods.

obligation to provide

Providing your personal data is voluntary.

Please note, however, that we can only process your request if you provide us with the necessary information, in particular your contact details and the content of your request.

Jotform

For certain forms on our website, especially application forms as well as feedback and survey forms, we use the serviceJotform Inc.

Depending on the type of form, the following personal data may be processed in particular:

Name
Contact details
Application documents
Freitextangaben
other voluntarily submitted information

The data is processed exclusively for handling your specific request, for carrying out the application process, or for evaluating feedback.

Legal basis

Article 6 paragraph 1 letter b GDPR (applications or pre-contractual measures)

Article 6 paragraph 1 letter f GDPR (feedback and general communication)

Recipient

Jotform processes personal data as a data processor.

Third-country transfer

Where personal data is processed outside the European Economic Area, this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

Storage duration

Personal data will only be stored for as long as is necessary to process your request or due to legal retention obligations.

Mailchimp

When you subscribe to our newsletter, we process the personal data you provide in order to regularly send you information about our offers, trips, news and other company-related content.

We use the service to send our newsletter.MailchimpThe provider isThe Rocket Science Group LLC, an Intuit Inc. company, 405 N Angier Ave. NE, Atlanta, GA 30308, USA.

As part of the newsletter registration process, we process in particular the following data:

First and last name (if provided)
Email Address
Time of registration
Confirmation of registration (double opt-in)
Technical information for registration

Provided you have consented to this, Mailchimp may also conduct statistical analyses of the use of our newsletter. This includes, in particular, information about whether newsletters were opened and which links were clicked. These analyses are used exclusively to optimize our newsletters and our information offerings.

Legal basis

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR.

You can withdraw your consent at any time with effect for the future via the unsubscribe link in each newsletter or by notifying us.

Recipient

The recipient of the data is The Rocket Science Group LLC (Mailchimp) as a data processor.

Third-country transfer

Personal data may also be processed in the USA. Insofar as personal data is processed outside the European Economic Area, this is done on the basis of theEU-U.S. Data Privacy Frameworkas well as – where necessary – the standard contractual clauses approved by the European Commission.

Further information can be found at:

https://mailchimp.com/legal/privacy/

Bookings via Bookinglayer

We use the booking platform to process our travel bookings.BookinglayerThe provider is theBookinglayer B.V., Netherlands.

The following personal data may be processed as part of a booking:

First and Last Name
Address
Telephone number
Email Address
Travel and booking data
Arrival and departure dates
Emergency contact
Food preferences and intolerances
Voluntarily provided health information, insofar as this is necessary for the execution of the booked trip (e.g. allergies or intolerances)
Surf level
Yoga level
Comments
Travel preferences
Payment information
further information required for the execution of the contract

The data is processed solely for the preparation, execution and handling of your travel booking.

To the extent necessary for the execution of your trip, personal data may be shared with service providers. These include, in particular, accommodations, local partner companies, transfer service providers, surf and yoga instructors, or other service providers involved in your booked trip.

Legal basis

The processing is based on Art. 6 para. 1 lit. b GDPR and – insofar as statutory retention obligations exist – Art. 6 para. 1 lit. c GDPR.

Recipient

The recipients of the data are Bookinglayer B.V. and – insofar as necessary for the execution of your trip – the respective service providers involved.

Third-country transfer

Where personal data is processed outside the European Economic Area, this is done exclusively on the basis of suitable safeguards in accordance with Art. 44 et seq. GDPR.

Storage duration

The data will only be stored for as long as is necessary for the performance of the contract and due to legal retention obligations.

Stripe / PayPal / Mollie

Payment processing

We use the following payment service providers to process payments:

Stripe Payments Europe Ltd.
PayPal (Europe) S.à r.l. et Cie, S.C.A.
Mollie B.V.

Depending on the payment method chosen, the personal data required for payment processing will be transmitted to the respective payment service provider.

This includes in particular:

Name
Billing address
Email Address
Booking number
Payment amount
Payment status

Credit card or bank account details are processed exclusively by the respective chosen payment service provider and are not stored by Surf Spirit.

Legal basis

The processing is based on Article 6 paragraph 1 letter b GDPR.

Recipient

The recipient of the data is the payment service provider you have selected.

Third-country transfer

Where personal data is processed outside the European Economic Area, this is done exclusively on the basis of suitable safeguards in accordance with Art. 44 et seq. GDPR.

Bank transfer

If payment is made by bank transfer, we process the payment data required for this purpose exclusively for the execution of the contractual relationship.

Legal basis

The processing is based on Article 6 paragraph 1 letter b GDPR.

Google Tag Manager

We use theGoogle Tag Manager der Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

The Google Tag Manager is used solely for the technical management and integration of other services and tracking technologies on our website. The Google Tag Manager itself does not create user profiles and does not process any personal data for analysis or marketing purposes.

Purpose of processing

technical administration of the services used
efficient integration of tracking and analysis tools
Improving the maintainability of our website

Legal basis

Insofar as services requiring consent are integrated via the Google Tag Manager, their activation will only take place after your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

Google Ads Conversion Tracking

We use Google Ads Conversion Tracking.Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

This service allows us to track whether users have performed specific actions on our website after clicking on a Google ad. This enables us to measure the success of our advertising campaigns and optimize our online offerings.

Legal basis

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

Recipient

The recipient of the data is Google Ireland Limited. As part of providing the service, personal data may be transferred to companies within the Google group, in particular Google LLC in the USA.

Third-country transfer

Insofar as personal data is transferred to third countries, this is done on the basis of theEU-U.S. Data Privacy Frameworkas well as – where necessary – the standard contractual clauses of the European Commission.

Meta Pixel

We use the following on our websiteMeta Pixel der Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Irland.

The Meta Pixel allows us to analyze the effectiveness of our advertisements on Facebook and Instagram, create target groups for advertisements, and measure the success of our marketing measures.

In particular, information about your usage behavior on our website may be processed.

Legal basis

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

Recipient

The recipient of the data is Meta Platforms Ireland Limited. As part of providing the service, personal data may be transferred to Meta Platforms Inc. in the USA.

Third-country transfer

Further information can be found at:

https://www.facebook.com/privacy/policy/

Meta Conversion API

In addition, we use theMeta Conversion API, in order to transmit events server-side to Meta and improve the performance measurement of our advertising campaigns.

This may involve processing, in particular, technical information, event data, and details of actions performed on our website.

Legal basis

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

Recipient

The recipient of the data is Meta Platforms Ireland Limited.

Third-country transfer

‍

Meta Lead Ads

If you contact us or request information via a lead form on Facebook or Instagram, the personal data you provide will be processed to handle your request and to carry out pre-contractual measures.

Legal basis

Depending on the content of your request, processing is based on Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR.

Recipient

The recipient of the data is Meta Platforms Ireland Limited.

Third-country transfer

Google Analytics

Provided you have consented to this via our consent management system, we use [this information] on our website.Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics allows us to statistically analyze the use of our website and continuously improve our online services. This involves the use of cookies and similar technologies, which process information about website usage.

In particular, the following information can be processed:

shortened IP address
Date and time of page view
Visited pages and click behavior
Length of stay
Technical information about the device used, browser and operating system
Approximate location information
Referrer URL
Interactions with our website

Google processes this information on our behalf to compile reports on the use of our website and to provide other services related to website usage.

IP anonymization

IP anonymization is activated on our website. This means that your IP address is shortened within the European Union or the European Economic Area before further processing. Only in exceptional cases will the full IP address be transmitted to Google servers and shortened there.

Google Signals

If Google Signals is enabled and you have activated personalized advertising in your Google account, Google can create cross-device analyses. To the best of our knowledge, we do not currently use Google Signals. Should this feature be implemented in the future, it will be done exclusively within the framework of legal requirements.

Purpose of processing

We use Google Analytics to

to better understand the use of our website,
to statistically evaluate reach and user behavior,
To identify sources of error
to optimize content and user-friendliness as well as
to measure the success of our marketing efforts.

Legal basis

The processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

You can withdraw or adjust your consent at any time with effect for the future via the cookie settings of our website.

Recipient

The recipient of the data is Google Ireland Limited. As part of providing the service, the transfer of personal data to companies within the Google group, in particular Google LLC in the USA, cannot be ruled out.

We have a data processing agreement with Google in accordance with Article 28 GDPR.

Third-country transfer

Insofar as personal data is transferred to third countries, in particular to the USA, this is done on the basis of theEU-U.S. Data Privacy Frameworkas well as – where necessary – the standard contractual clauses approved by the European Commission.

Further information can be found at:

https://policies.google.com/privacy

https://business.safety.google/privacy/

Storage duration

The storage period for data processed by Google Analytics depends on the settings we have made within our Google Analytics account and is only as long as is necessary for the aforementioned analysis purposes.

Objection and revocation

You can withdraw or change your consent at any time via the cookie settings of our website with effect for the future.

Integration of YouTube

On some pages of our website, we embed videos from the platform.YouTubeone provider is theGoogle Ireland LimitedGordon House, Barrow Street, Dublin 4, Ireland (“Google”). Processing may also be carried out by the following as part of the provision of services:Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Simply accessing a page that embeds a YouTube video can establish a connection to Google or YouTube servers. In this process, your IP address, technical information about your browser and device, and information about your visit to the respective website may be processed.

If you play an embedded video or are simultaneously logged into your Google or YouTube account, Google may associate further information with your user account. We have no control over this data processing.

Purpose of processing

The integration of YouTube serves to...

to provide audiovisual content on our website,
to convey information clearly and
to make our online services more user-friendly.

Legal basis

Insofar as consent is required for the integration of YouTube, processing is carried out exclusively on the basis of your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.

You can withdraw or adjust your consent at any time with effect for the future via the settings of our cookie consent tool.

Recipient

The recipient of the data is Google Ireland Limited. As part of providing the service, personal data may be transferred to companies within the Google group, in particular to Google LLC in the USA.

Third-country transfer

Further information on data processing by Google can be found at:

https://policies.google.com/privacy

Storage duration

We have no control over the type and duration of personal data processing by Google or YouTube. Further information can be found in Google's privacy policy.

Updates and changes to this privacy policy

We reserve the right to amend this privacy policy as needed to adapt it to changes in legal requirements, regulatory requirements, or changes to our website, our services, or the technologies used.

The version of the privacy policy published on our website at the time of your visit applies.

Status: July 2026

Contact for data protection

If you have any questions about the processing of your personal data or about exercising your data protection rights, you can contact us at any time:

Surf Spirit GmbH & Co. KGAt the steering wheel 7
33609 Bielefeld
Germany

Email: hello@surf-spirit.com

‍

Privacy Policy

Responsible

Your rights as a data subject

Collection of general information when visiting our website

Server log files

Purpose of processing

Legal basis

Recipient

Storage duration

Cookies and consent management

General information

Types of cookies used

Marketing-Cookies

Personalization cookies

Legal basis

Storage duration

Contact form

Purpose of processing

Legal basis

Recipient

Storage duration

obligation to provide

Jotform

Legal basis

Recipient

Third-country transfer

Storage duration

Mailchimp

Newsletter

Legal basis

Recipient

Third-country transfer

Bookings via Bookinglayer

Legal basis

Recipient

Third-country transfer

Storage duration

Stripe / PayPal / Mollie

Payment processing

Legal basis

Recipient

Third-country transfer

Bank transfer

Google Tag Manager

Purpose of processing

Legal basis

Google Ads Conversion Tracking

Legal basis

Recipient

Third-country transfer

Meta Pixel

Legal basis

Recipient

Third-country transfer

Meta Conversion API

Legal basis

Recipient

Third-country transfer

Meta Lead Ads

Legal basis

Recipient

Third-country transfer

Google Analytics

IP anonymization

Google Signals

Purpose of processing

Legal basis

Recipient

Third-country transfer

Storage duration

Objection and revocation

Integration of YouTube

Purpose of processing

Legal basis

Recipient

Third-country transfer

Storage duration

Updates and changes to this privacy policy

Contact for data protection