Privacy Policy

Data controller

• Identity: Clube Surf Arteixo (trading as «Arteixo Surf Club»)
• NIF: G70585567
• Address: Avd. da Prensa nº 9, ground floor. 15143. Arteixo (A Coruña)
• Phone: 697 469 097
• Email: clubsurfarteixo@gmail.com

Purpose and legal basis

Personal data collected through the enrolment form and website is processed for the following purposes:

• Managing the contractual relationship with members, students and families (registration, classes, camps, billing).

• Communications related to club activities (schedule changes, sports events, seasonal information).

• Compliance with legal obligations (sports federation, tax management, risk prevention).

The legal basis for processing is the performance of the enrolment or booking contract, the legitimate interest in managing the sports activity, and compliance with legal obligations.

Retention period

Data will be kept for the duration of the contractual relationship and, once ended, for the legally required periods (minimum 5 years for billing data, in accordance with Spanish tax legislation).

Disclosure of data to third parties

Data will not be shared with third parties except where legally required or necessary to provide the contracted service (banks for direct debit payments, Federación Galega de Surf for processing sports licences).

Security measures

The club applies appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access or unlawful processing, in accordance with Article 32 of the GDPR:

• All information exchanged with this website travels encrypted via the secure HTTPS/TLS protocol.

• Card payments are processed entirely on the secure BBVA Virtual POS payment gateway (Redsys), certified to the PCI-DSS standard. Your card details are entered directly into the bank's secure environment: the club never sees, processes or stores them.

• Sensitive bank details for direct debit (IBAN) are stored encrypted, and access to personal data is restricted to authorised staff according to their role.

Minors

Processing the data of children under 14 requires the express consent of the mother, father or legal guardian, in accordance with Article 7 of the LOPDGDD. For children aged 14 to 18, the holder may give their consent, although it is recommended to inform the family.

Rights of the data subject

You may exercise the following rights by writing to the club at the postal address or at clubsurfarteixo@gmail.com, attaching a copy of your ID:

• Access: know what personal data we are processing about you.

• Rectification: correct inaccurate or incomplete data.

• Erasure: request deletion of your data when it is no longer necessary.

• Portability: receive your data in a structured, commonly used format.

• Objection: object to the processing of your data on grounds relating to your particular situation.

• Restriction: request restriction of processing in certain circumstances.

Applicable regulations

The processing of your personal data is governed by Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and by Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD). This website also complies with Law 34/2002, on Information Society Services and Electronic Commerce (LSSICE).

Complaint to the supervisory authority

If you believe that the processing of your personal data infringes applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6. 28001 Madrid — www.aepd.es.