Privacy policy

1. Who we are

SurfRental Aljezur is a surf equipment rental service based in Aljezur, Faro district, Portugal. We are the data controller for the personal information described in this policy.

Contact: hello@surfrental-aljezur.com

2. What data we collect

When you contact us to book a rental, we collect:

• Name — to identify your booking and greet you on delivery
• Email address — to confirm your booking and send follow-up communications
• Phone number (optional) — to coordinate delivery timing via WhatsApp or SMS
• Accommodation address — to deliver and pick up your gear
• Booking dates — to manage our inventory and schedule deliveries
• Surfing experience level — to recommend appropriate gear

We do not collect payment card details. Payments are handled in person (cash) or via MBWay / bank transfer through your own banking provider.

3. Why we collect it

We use your data for the following purposes:

• Service delivery: To fulfil your rental booking — delivering the right gear to the right place at the right time.
• Communication: To confirm bookings, coordinate delivery/pickup, and answer your questions.
• Follow-up: To send a one-time post-rental email asking for feedback. You can opt out of this at any time.

We do not use your data for marketing, profiling, or automated decision-making unless you explicitly opt in to receive updates from us.

4. Legal basis

Under the General Data Protection Regulation (GDPR), we process your data on the following legal bases:

• Contractual necessity: Processing is necessary to fulfil the rental service you requested (Article 6(1)(b)).
• Legitimate interest: Post-rental feedback requests are based on our legitimate interest in improving our service (Article 6(1)(f)).
• Consent: Any marketing communications beyond a one-time follow-up are sent only with your explicit consent (Article 6(1)(a)).

5. How we store your data

Your data is stored securely in EU-based services. We do not transfer data outside the European Economic Area.

We retain booking data for 24 months after your last rental to handle repeat bookings and any outstanding queries. After this period, data is securely deleted unless you have an active booking or have requested otherwise.

6. Your rights

Under GDPR, you have the right to:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Ask us to correct any inaccurate data.
• Erasure— Ask us to delete your data ("right to be forgotten").
• Restriction — Ask us to limit how we use your data.
• Portability — Receive your data in a structured, machine-readable format.
• Object — Object to processing based on legitimate interest.

To exercise any of these rights, email us at hello@surfrental-aljezur.com. We respond to all requests within 30 days.

7. Cookies

This website uses minimal cookies. We do not use advertising or third-party tracking cookies.

• Essential cookies: Required for the website to function (e.g., session handling). These cannot be disabled.
• Analytics: We may use privacy-respecting analytics to understand how visitors use our site. No personal data is collected, and no data is shared with third parties.

8. Third parties

We do not sell, rent, or share your personal data with third parties for their marketing purposes. The only third parties with potential access to your data are:

• Hosting provider: Our website is hosted on EU-based infrastructure.
• Email provider: Used solely to send booking confirmations and follow-ups.

9. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically.

10. Contact & complaints

If you have questions about this policy or wish to make a complaint, contact us at hello@surfrental-aljezur.com.

You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

Last updated: March 2026