Privacy Policy
Last updated: March 2026
1. Overview
This privacy policy explains how Rapture Surfcamps ("we", "us", "our") collects, uses, and protects your personal data when you visit our website rapturecamps.com or use our services. We are committed to protecting your privacy and handling your data transparently in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Data Controller
The data controller responsible for the processing of your personal data is:
Rapturecamps Unipessoal Lda
Avenida do Infante 50
9004-521 Funchal
Portugal
You can reach us via our contact form.
3. Data We Collect
We may collect and process the following types of personal data:
Contact information: name, email address, phone number — collected when you make a booking, fill out a contact form, or subscribe to our newsletter.
Booking data: travel dates, camp preferences, dietary requirements, surf experience level — necessary to process and personalise your stay.
Payment data: processed securely through our payment provider. We do not store credit card numbers or bank account details on our servers.
Usage data: IP address, browser type, device information, pages visited, time spent on site — collected automatically via cookies and analytics tools.
Communication data: messages you send via our contact forms, email, WhatsApp, Telegram, or live chat.
4. How We Use Your Data
We process your personal data for the following purposes:
• To process and manage your booking and communicate about your reservation
• To respond to enquiries via contact forms, email, WhatsApp, Telegram, or live chat
• To improve our website, services, and user experience
• To send marketing communications such as newsletters and offers (only with your explicit consent)
• To analyse website traffic and user behaviour in aggregate
• To comply with legal and regulatory obligations
5. Legal Basis for Processing
We process your personal data based on the following legal grounds under the GDPR:
Contract: processing necessary to fulfil a booking or respond to your enquiry (Art. 6(1)(b) GDPR).
Consent: for marketing communications, analytics cookies, and marketing cookies. You can withdraw consent at any time (Art. 6(1)(a) GDPR).
Legitimate interest: to improve our services, ensure website security, and prevent fraud (Art. 6(1)(f) GDPR).
Legal obligation: to comply with tax, accounting, and other regulatory requirements (Art. 6(1)(c) GDPR).
6. Cookies & Tracking
Our website uses cookies and similar technologies. When you first visit our site, a cookie consent banner allows you to choose which categories of cookies to accept. Your preferences are stored in a cookie called rc_consent and can be changed at any time via the "Manage Cookies" link in the footer.
We use the following categories of cookies:
Necessary cookies: required for the website to function. These include our consent cookie (rc_consent) and session-related cookies. They cannot be disabled.
Analytics cookies: help us understand how visitors use our site. We use Google Analytics 4 (via Google Tag Manager) which sets cookies such as _ga and _ga_*. These are only loaded after you give consent.
Marketing & third-party cookies: enable embedded content from third-party services such as review widgets (Elfsight) and live chat (Zoho Desk). These may set their own cookies and are only loaded with your consent.
7. Third-Party Services
We use the following third-party services that may process your data. Each service has its own privacy policy:
Vercel (vercel.com) — website hosting and content delivery. Vercel processes server logs including IP addresses. Data is processed in the EU and US.
Google Tag Manager & Google Analytics 4 (analytics.google.com) — website analytics and tag management. Collects anonymised usage data. Only activated when you consent to analytics cookies.
Bunny CDN (bunny.net) — content delivery network for video and media files. May process IP addresses for delivery optimisation. No personal data is stored.
Elfsight (elfsight.com) — displays customer review widgets from Google and other platforms. May set cookies when loaded. Only activated with marketing cookie consent.
Zoho Desk (zoho.eu) — live chat support widget. May process your name, email, and chat messages. Only loaded with marketing cookie consent.
Zoho Campaigns (zoho.eu) — email marketing and newsletter management. Stores your email address and name when you subscribe. You can unsubscribe at any time via the link in each email.
Zoho Bookings (zoho.eu) — online scheduling for meetings and calls. Processes the data you provide when booking a session.
8. International Data Transfers
Some of our third-party service providers (such as Google and Vercel) may transfer data outside the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the provider is certified under an adequacy framework.
9. Data Retention
We retain personal data only as long as necessary to fulfil the purposes for which it was collected:
• Booking data: retained for 7 years after the completion of your stay for accounting and legal purposes.
• Marketing data (newsletter subscribers): retained until you unsubscribe.
• Analytics data: retained for 14 months (Google Analytics default).
• Chat and support data: retained for 12 months after your last interaction.
• Cookie consent preferences: retained for 12 months.
10. Your Rights
Under the GDPR and applicable data protection laws, you have the following rights:
• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data.
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — withdraw your consent at any time (this does not affect processing that occurred before withdrawal).
To exercise any of these rights, please reach out via our contact form. We will respond within 30 days.
You also have the right to lodge a complaint with a supervisory authority if you believe your data has been processed unlawfully.
11. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes:
• SSL/TLS encryption for all data transmitted to and from our website.
• Access controls limiting who within our team can view personal data.
• Regular review of our data processing practices and security measures.
12. Children's Privacy
Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this page with the "Last updated" date shown at the top.
14. Contact
For questions, concerns, or requests regarding this privacy policy or your personal data, contact us at:
Rapture Surfcamps
Reach us via our contact form.
