2. What data we collect
- Server logs (IP address, browser, referrer, timestamp) — used to operate and secure the site. Stored max. 14 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
- Lead-form data (name, email, message, the school you contact) — when you send an enquiry to a school. We forward it to the school and store a copy for support. Legal basis: Art. 6(1)(b) GDPR.
- Cookies — we use only strictly necessary cookies required to run the site. We do not use analytics, tracking or marketing cookies, so no consent banner is needed. Legal basis: Art. 6(1)(f) GDPR / § 25(2) TDDDG (technically necessary).
- Contributions — if you submit data (prices, spot info, photos) and optionally your email or Instagram handle, we store what you submit to publish and verify it. Legal basis: Art. 6(1)(a) and (f) GDPR.
3. What we do NOT do
- We do not sell your data.
- We do not run third-party ad networks that profile you.
- We do not use dark-pattern consent — say no and the site still works.
4. Processors we use
We use a small number of vetted service providers. All are bound by Art. 28 GDPR data-processing agreements:
- Frontend hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Edge delivery may process IP addresses for routing and DDoS protection. Transfer to the US is covered by the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
- Database & file storage: Supabase, hosted in the EU region (Frankfurt, Germany — AWS eu-central-1). All application data (listings, contributions, uploaded photos, lead forms) is stored within the EU.
- Workflow automation: n8n, self-hosted in Germany. Used for internal data pipelines (processing contributions and routing enquiries to schools). No data leaves the EU.
- Interactive map: Mapbox (Mapbox Inc., USA). When you open a page with the map, your browser loads map tiles directly from Mapbox, which processes your IP address to deliver them. Transfer to the US relies on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. Legal basis: Art. 6(1)(f) GDPR.
- Google reviews: on a school's page we fetch ratings and reviews live from the Google Places API (Google Ireland Ltd.) on our server and display them with full attribution (author name, photo and a link to Google). We do not store these reviews. Legal basis: Art. 6(1)(f) GDPR.
Where data is transferred outside the EU/EEA (Vercel's edge network and the Mapbox map tiles), we rely on the EU-US Data Privacy Framework and EU Standard Contractual Clauses pursuant to Art. 46 GDPR. We do not use email-marketing tools, analytics services, or AI/LLM providers for processing your personal data.
5. Data on listed kite schools
kitesurfing.me lists kite schools as a comparison service. We process publicly available business information (name, address, website, prices, course offerings) of schools as legal entities. Where individual contact persons are named, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in transparent market information). Schools can request removal or correction at any time — see Section 8.
6. How long we keep data
Server logs: 14 days. Lead-form data: 24 months, then deleted. Contributions: kept while the listing exists, attribution removed on request.
7. Your rights (GDPR)
You have the right to access (Art. 15), rectify (Art. 16), delete (Art. 17), restrict (Art. 18), and port (Art. 20) your personal data, as well as the right to object (Art. 21) and to withdraw consent at any time. To exercise any of these, email kitesurfingaddictions2002@gmail.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
8. Opt-out for listed schools
If you operate a kite school listed on this site and want your listing removed, corrected, or updated, email kitesurfingaddictions2002@gmail.com with proof of association (e.g. email from the school's official domain). We process such requests within 14 days.
9. Changes to this policy
We may update this policy as the service evolves. The current version always lives at this URL with the "Last updated" date at the top. Material changes will be communicated by banner or email.