Privacy policy

Data controller

Miguel Abad Jiménez · Tax ID (NIF) 32081385L · Paseo José Acosta 11, 38679 La Caleta, Adeje, Santa Cruz de Tenerife (Spain) · info@aftersurfguide.com · +34 711 56 63 78.

What data we process and how we obtain it

We process three kinds of data:

• Data you give us when preparing an enquiry in the WhatsApp configurator: the experience you are interested in, the number of people, the date you have in mind, the options you select and any free-text message you write. If that message includes personal data (your name, allergies, needs), we process that too.
• Your name and phone number are not collected on this website: you provide them directly when you open the conversation in WhatsApp, a third-party service with its own privacy policy.
• Technical data: a session cookie (PHPSESSID) to remember your language and protect the form; in the web server log, your IP address for a limited period; in the application's internal log, only a hashed value derived from your IP (not the IP itself) and the outcome of the request. The content of your message is not logged.

What we use it for and the legal basis

We use your data to:

• Handle your enquiry and, where applicable, arrange the booking with the company that runs the experience — basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
• Site security, abuse prevention and error diagnostics — basis: legitimate interest (Art. 6(1)(f) GDPR).
• The technical language and security cookie — strictly necessary, no consent required (Art. 22.2 LSSI-CE).

We do not use your data for advertising, profiling or automated decision-making.

Who it is shared with

Your data may be shared with:

• The partner company that runs the experience you enquire about, to check availability and arrange it. Only the data needed for that is passed on.
• Proton AG (Switzerland), as the email provider.
• WhatsApp / Meta, because the internal notification of your enquiry reaches the team via WhatsApp.
• The Constant Company, LLC (Vultr) (United States), as the hosting provider.

Data is not shared with any other third party and is never sold.

International transfers

Switzerland has an adequacy decision from the European Commission. Transfers to the United States (hosting) rely on the EU-US Data Privacy Framework and/or standard contractual clauses.

How long we keep the data

• Enquiries that do not lead to a booking: 12 months, then deleted.
• Enquiries that do lead to a booking: for as long as the arrangement lasts and, afterwards, for any legally required retention periods.
• Web server log: approximately 14 days.
• Application internal log (hashed IP value): approximately 12 weeks.
• Session cookie: deleted when you close your browser.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to info@aftersurfguide.com stating the right you wish to exercise. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Third-party services that load content

Some pages load external resources (OpenFreeMap map tiles and, on specific spots, third-party live cameras). The details are in our Cookie Policy, linked in the footer.

Changes to this policy

We may update this policy if the processing or the applicable law changes. The version in force is always the one published on this page.