Privacy Policy

1. Who is responsible

The controller for kitesurfing.me is Frederik Goldbach, Julius-Hatry-Straße 1, 68163 Mannheim, Germany. Contact: kitesurfingaddictions2002@gmail.com. Full details are in our Impressum. Schools that run their own website on our software (for example kitesurfing.me/<school>) have their own privacy policy for that website.

2. When you visit kitesurfing.me

• Server logs (IP address, browser, referrer, timestamp) are recorded to run and secure the site, through our host Vercel. Stored max. 14 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website).
• Strictly necessary cookies: we remember your cookie choice, and when you open your personal booking page we set a cookie for that booking (__Host-bos_hub_…, at most 30 days) so the page stays open for you without a password. Legal basis: § 25(2) TDDDG (strictly necessary) and Art. 6(1)(b) and (f) GDPR. Everything else below needs your consent.
• Ambassador links (only with your consent) — riders in our ambassador program share personal links (kitesurfing.me/r/…). When you open one, we count the click without storing anything on your device and without your IP address. If you click "Accept" in the cookie banner, we set a first-party cookie (km_amb, 30 days) holding only the rider's code, so that an enquiry or a booking you make on kitesurfing.me in that time is credited to that rider and they receive a share of our commission. The rider does not see your name or any of your details. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent); withdrawing consent via "Cookie settings" deletes the cookie.
• Google Analytics 4 (only with your consent) — if you click "Accept", we load Google Analytics, a web analytics service of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. It sets cookies (_ga, _ga_*, up to 14 months) and processes your IP address (which Google does not log or store for EU users), device and browser information, approximate location, the pages you view and how you interact with them. We use this only to understand which pages help people find a kite school. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, and EU Standard Contractual Clauses apply. We have concluded a data-processing agreement with Google; analytics data is retained for 14 months. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent). Before you choose, and if you click "Decline", no request is made to Google at all. You can withdraw your consent at any time via "Cookie settings" in the footer of every page; withdrawal does not affect processing before it.
• Map: on pages with a map, your browser loads map tiles directly from Mapbox Inc. (USA), which processes your IP address to deliver them. Transfer to the US relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR.
• Fonts are part of the site itself; no font service receives your data.

3. Booking requests to partner schools

When you request or book a course, camp or rental from a partner school on kitesurfing.me, we process:

• your name, email address and phone number, the offer, dates, number of participants and their level, any message you add, and your choices (for example WhatsApp updates or a review request). The booking form shows which details are required; without them we cannot pass your request on;
• later, on your booking page: participant details the school asks for (name, level, date of birth and, if you give it, weight, so the school can pick the right equipment), your acceptance of the school's waiver (who accepted it, when and which version, for a minor by a parent or guardian), change requests and the status of your booking.

Why and on what basis. We use this to pass your request to the school, show you its answer and your booking page, send you booking messages, and keep the record our commission with the school is based on. Legal basis: Art. 6(1)(b) GDPR (steps you asked for to get a booking) and, for our commission records, Art. 6(1)(c) and (f) GDPR. We are the controller for this processing on kitesurfing.me.

The school. The school you book with receives your booking details in its booking dashboard, which runs on our software, and uses them to provide the lesson. For its own use of your data the school is responsible. Our partner schools are currently in Kenya and Egypt, countries for which there is no EU adequacy decision; passing your details to the school you chose is necessary to carry out the booking you ask for (Art. 49(1)(b) GDPR). Please bear in mind that the level of data protection there may be lower than in the EU.

Messages. Booking emails are sent through Brevo (Sendinblue SAS, Paris, France); if you reply to one, your reply reaches the school through the same provider. If you tick the WhatsApp option, the same messages may also be sent by WhatsApp, through our technical provider Zernio (Girona, Spain) and the WhatsApp Business Platform of Meta; this involves a transfer to Meta in the USA, covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Requests for camps and rentals reach us as a message, and we pass them on to the school by email or WhatsApp.

Review request. Only if you tick the box, the school may send you one message after your course asking for a review. Legal basis: Art. 6(1)(a) GDPR; you can withdraw this at any time by replying to us or the school.

Payment. You pay the school directly. kitesurfing.me does not process any payment or card data.

4. Enquiries to other schools

If you send an enquiry to a listed school through our form (name, email, message, the school, and optionally dates, number of people and level), we store it and forward it to that school, usually by email, otherwise through a contact channel the school publishes (for example WhatsApp). From then on the school handles its own communication with you. Legal basis: Art. 6(1)(b) GDPR.

5. Contributions

If you send us data (prices, spot information, photos) and optionally your email or Instagram handle, we store what you submit to check and publish it. Published photos are publicly accessible. Legal basis: Art. 6(1)(a) and (f) GDPR. Please only send photos of people who agreed to it.

6. Data about listed schools and their contacts

We list schools with publicly available business information (name, address, website, contact details, prices and courses). Where a person is named or is the contact for a school, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in transparent market information and in offering schools to verify their listing or become partners). We contact schools by email (through Brevo, France) and by Instagram message (through Zernio, Spain, and Meta). Schools can object at any time and ask for correction or removal: see our terms.

7. Reports of illegal content

If you report content (see Report content), we process your report and, if you give them, your name and email address to handle it, confirm receipt and tell you our decision. We tell the person whose content is affected who reported it only where that is strictly necessary. Legal basis: Art. 6(1)(c) GDPR with Art. 16 and 17 of the Digital Services Act.

8. Service providers we use

• Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Edge delivery may process IP addresses for routing and DDoS protection. Transfer to the US is covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
• Database and file storage: Supabase, hosted in the EU (Frankfurt, Germany, AWS eu-central-1): listings, booking requests and bookings, enquiries, contributions and uploaded photos.
• Workflow automation: n8n, self-hosted in Germany, for internal processing of enquiries and contributions.
• Email: Brevo (Sendinblue SAS, Paris, France).
• WhatsApp and Instagram messages: Zernio (Girona, Spain) as technical provider; Meta (WhatsApp, Instagram), with transfers to the USA covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
• Map: Mapbox Inc., USA (section 2).
• Web analytics, only with consent: Google Ireland Ltd., Dublin, Ireland (section 2).

Our service providers process data on our behalf under data processing agreements (Art. 28 GDPR). Outside the EU/EEA, data goes to the USA on the safeguards named above, and to the partner school you book with (section 3). We do not sell your data, we do not run advertising networks that profile you, and saying no to cookies never stops the site from working.

9. How long we keep data

• Server logs: 14 days. Google Analytics data (with consent): 14 months.
• Enquiries and camp or rental requests: 24 months, then deleted.
• Booking requests and bookings: as long as needed for the booking, for questions or claims about it and for our commission accounting with the school, and as long as commercial and tax law requires us to keep accounting records (in Germany up to 10 years). Then they are deleted.
• Contributions: while the listing exists; your name or handle is removed on request.
• Reports of illegal content: as long as needed to handle the report and any challenge of our decision.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20), and you can withdraw any consent at any time with effect for the future. To use these rights, email kitesurfingaddictions2002@gmail.com.

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. If we use your data for direct marketing, you can object at any time without giving reasons.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

11. Changes to this policy

We update this policy when kitesurfing.me changes. The current version always lives at this URL, with the date at the top.