This Privacy & Cookie Policy explains how LOBA SURFCAMP, LDA ("LOBA", "we", "us") collects, uses and protects your personal data when you use our website or contact us, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Portuguese data-protection law.

1. Who we are (Data Controller)

LOBA SURFCAMP, LDA
NIPC (tax ID): 519066731
Rua 25 de Abril, n.º 11, 2530-342 Marteleira, Portugal
Email: geral@lobasurfcamp.com

2. What data we collect

  • Trip-request forms: name, email, phone (optional), group size, preferred dates, chosen package, your needs, any message, and — on our group pages — your organisation or company name.
  • Trip estimator: when you use our price estimator, you provide your name and email and select your group size, nights, accommodation and activities. When the estimate is shown, these details are sent to us as a trip enquiry so we can follow up with a real quote.
  • Communications: information you share when you contact us by email or WhatsApp.
  • Technical data: standard server/hosting logs (e.g. IP address, browser type, pages requested).
  • Analytics & marketing data (only with your consent): information about your device and how you use the site — pages viewed, sections reached, buttons and links clicked, forms started, the estimator being used, and enquiries submitted — collected through cookies and similar technologies (see section 7).

3. Why we use it & legal basis

  • To respond to your request and prepare a quote — steps prior to a contract at your request (Art. 6(1)(b) GDPR).
  • To organise and deliver your trip once booked — performance of a contract.
  • To communicate with you about your trip — legitimate interest / contract.
  • To comply with legal and accounting obligations — legal obligation.
  • To keep the website secure and working — legitimate interest.
  • To measure and improve how the website is used (analytics) — your consent (Art. 6(1)(a)).
  • To measure and improve our advertising on Instagram/Facebook and TikTok, including audiences for retargeting — your consent (Art. 6(1)(a)).

Where we rely on consent, you can withdraw it at any time — see section 7.

4. Sharing your data & international transfers

We do not sell your data. We share it only with providers who help us run our service, and only as needed:

  • Web3Forms — delivers our website forms and the estimator enquiry to our inbox. It processes the details you submit (name, email, phone, message, trip details).
  • Google — Google Tag Manager and Google Analytics 4 (analytics, only with your consent); Google Workspace/Gmail, which hosts the inbox that receives your enquiry.
  • Meta (Facebook/Instagram) — Meta Pixel, for advertising measurement and audiences, only with your consent.
  • TikTok — TikTok Pixel, for advertising measurement and audiences, only with your consent.
  • Our website host, and accommodation, transport and activity partners, strictly as needed to arrange your trip.

International transfers. Some of these providers (Google, Meta, TikTok, Web3Forms) may process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework. If you do not consent to analytics and marketing cookies, no data is sent to Google Analytics, Meta or TikTok through our website.

5. How long we keep it

  • Enquiries that don't become bookings: up to 24 months, then deleted.
  • Bookings: for the duration of our relationship plus the periods required by law (e.g. 10 years for tax and accounting records in Portugal).
  • Analytics data: in Google Analytics, event and user data are retained for 14 months, after which user-level data is deleted (aggregated reporting remains available).
  • Your cookie choice: stored in your browser until you change or clear it.

6. Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, and the right to data portability and to withdraw consent at any time. To exercise these rights, email geral@lobasurfcamp.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados — cnpd.pt).

7. Cookies & similar technologies

On your first visit we show a banner. Nothing other than strictly necessary storage is used until you choose. You can accept all, reject all, or pick categories — and you can change your cookie preferences at any time.

We use three categories:

  • Necessary (always on). Only what the site needs to work — for example remembering your cookie choice. No tracking. This is stored in your browser (loba-consent) and is not shared.
  • Analytics (your consent). Google Analytics 4, loaded through Google Tag Manager, to understand how the site is used and improve it (e.g. _ga cookies, typically up to 2 years).
  • Marketing (your consent). Meta Pixel and TikTok Pixel, to measure our ads and build audiences for advertising on Instagram/Facebook and TikTok (e.g. _fbp, typically around 3 months; _ttp, typically up to 13 months).

If you reject, these tools are not loaded and no data is sent to them. We use Google Consent Mode, so your choice is passed on to the tools we use. Rejecting does not stop you from using the website or contacting us.

8. Security

We take reasonable technical and organisational measures to protect your data against loss, misuse or unauthorised access, including HTTPS across the whole website.

9. Changes

We may update this policy from time to time. The latest version will always be available on this page. See our Terms & Conditions for booking terms.