Privacy Policy

1) What we collect

• Identity & contact: name, email, phone, country, emergency contact.
• Booking details: trip selection, dates, rooming, payment status (payments are processed by our partners; we don’t store full card numbers).
• Travel & safety info: dietary needs, allergies, medical considerations, passport number, insurance details.
• Comms & media: messages by email/DM/WhatsApp; photos/video captured during trips (see section 8).
• Usage data & cookies: IP, device, pages viewed, referrers, approximate location; cookies and similar tech (see section 9).
  
  

2) Why we use your data

• Provide the trip you booked and customer support.
   
• Safety & logistics, including coordinating with local guides, lodging and transport.
  
  
• Payments & accounting.
  
  
• Marketing (only if you opt-in / where permitted): newsletters, upcoming trips, offers.
  
  
• Analytics & site improvement.
  
  
• Legal/administrative: fraud prevention, compliance, enforcing terms.
  
  

3) Our legal bases (GDPR/LGPD style)

• Contract necessity: to process and deliver your booking.
  
  
• Consent: for marketing emails; for handling health/dietary info; for using recognisable photos/video in marketing (you can withdraw anytime).
  
  
• Legitimate interests: basic analytics, improving services, limited trip announcements to past guests (you can object).
  
  
• Legal obligation: invoices, tax, safety incident records.
  

 

4) Sensitive information (health/dietary)

If you choose to share health, allergy, or similar data, we use it only to keep you safe and tailor the trip. Access is restricted to staff who need it (e.g., trip leads, lodge partners). You can decline to provide this, but some services may be impacted.

 

5) Sharing your data

• Processors/partners: payment providers (e.g., Stripe/PayPal), booking platforms, email/SMS tools, cloud storage, analytics, local partners (lodging, transport, surf coaches) only as needed to run the trip.
  
  
• Legal & safety: if required by law or to protect rights/safety.
  
  
• No selling of personal data. For California residents, we do not “sell” or “share” personal information as defined by the CCPA/CPRA.
  
  

6) International transfers

We operate in multiple countries. When we transfer your data across borders, we use appropriate safeguards (e.g., EU Standard Contractual Clauses) or rely on adequacy decisions/ LGPD mechanisms. Details available on request.

 

7) Retention

• Booking & accounting records: typically 7 years (tax laws).
  
  
• Marketing data: until you unsubscribe or 24 months after last interaction.
  
  
• Health/dietary info: only for the trip window + a short safety window, then deleted.
  
  
• Media (photos/video): see consent in section 8. You can request removal.
  
  

8) Photos & video (media consent)

We often capture photos/video during trips. We’ll ask for your consent to use recognisable media in our marketing (website, socials, print). You can opt out at any time (before, during, or after the trip) by telling a trip lead or emailing swelladventures1@gmail.com. We’ll avoid posting/ will remove content where you’re identifiable upon request.

 

9) Cookies & tracking

We use cookies for site functionality, preferences, analytics (e.g., Google Analytics), and occasionally ads (e.g., Meta Pixel). Where required, we display a cookie banner so you can consent or manage preferences. You can also disable cookies in your browser.

 

10) WhatsApp & community channels

If you join our WhatsApp groups/channels, your phone number and messages may be visible to other members. Please share only what you’re comfortable with. Group rules prohibit harassment or spam; we may remove users who breach rules. You can exit any time.

 

11) Security

We use reasonable technical and organizational measures: encryption in transit, access controls, least-privilege access, staff training. No system is 100% secure; if we detect a breach that risks your rights, we’ll notify you and regulators as required.

 

12) Your rights

Depending on where you live (GDPR, LGPD, CCPA/CPRA), you may have rights to:

• Access, correct, delete your data.
  
  
• Portability (receive your data in a usable format).
  
  
• Restrict or object to certain processing (e.g., direct marketing).
  
  
• Withdraw consent at any time (doesn’t affect past processing).
  
  
• California: opt out of “sale/share”; limit use of sensitive information; non-discrimination for exercising rights.
  To exercise rights, email swelladventures1@gmail.com. We’ll verify identity and respond within the legal timeframe.
  
  

13) Children

Our services are not directed to children under 16 (or the age required by your country). For minors on family trips, a parent/guardian must book and provide any necessary data/consents.

 

14) Third-party links

Our site may link to external sites (airlines, insurers, payment providers). We’re not responsible for their privacy practices.

 

15) Changes

We may update this Policy. We’ll post the new version with a new effective date and, for material changes, we’ll notify you by email or site notice.

Contact:
Questions or requests: swelladventures1@gmail.com .