Privacy policy
Last updated:
This policy explains how we collect and use your personal data when you visit worksurfcanarias.com, apply for a stay or book with us. We process your data in line with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Who we are
The data controller is:
- Company: Focotech Innova SL (trading as Work & Surf Canarias)
- Tax ID (NIF): B23948086
- Registered address: CL. Covadonga, 78 - 35010 Las Palmas de Gran Canaria, Las Palmas
- Email: [email protected]
For any question about your data, write to us at [email protected].
2. What data we collect
When you apply through our form:
- Full name, age and sex (we ask for sex for information only; it is never a condition for being accepted)
- Occupation
- Phone number and email address
- Preferred month, room type and surf lesson slot
- If you share a room, who you will share it with (your partner or a friend)
- A link to one of your social media profiles
If you apply for a shared room, you confirm that the person travelling with you has agreed to you sharing their details with us. We will request the same information and documents for the person travelling with you as for the person making the booking, both in the application and when confirming the booking.
If you reach us through an ad or a tagged link, we also record which campaign brought you, together with your application.
If your application is selected and you book:
- ID or passport details, nationality, date of birth and home address
- Payment details, processed by our payment provider (we do not store your full card number)
When you browse our website: basic technical data such as IP address, browser and device type, collected through cookies and similar technologies. See section 9.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing your application, checking availability and making sure the group is balanced | Steps taken at your request before entering into a contract (art. 6.1.b) |
| Managing your booking, payment, stay, surf lessons and support during the stay | Performance of the contract (art. 6.1.b) |
| Registering guests with the Spanish authorities, as required for accommodation providers, and keeping invoices | Legal obligation (art. 6.1.c) |
| Sending you news about future seasons and new Work & Surf houses | Your consent (art. 6.1.a), which you can withdraw at any time |
| Keeping the website secure and understanding how it is used | Our legitimate interest (art. 6.1.f) and, for non-essential cookies, your consent |
We review applications as a whole, looking at the full profile. We do not make decisions based solely on automated processing.
4. How long we keep your data
- Applications not selected: up to 12 months, so we can contact you about other months. You can ask us to delete them earlier.
- Guests: for as long as the booking relationship lasts, and afterwards for the periods required by law (for example, 3 years for guest registration records and up to 6 years for accounting and tax records).
- Marketing: until you unsubscribe or withdraw your consent.
After these periods, we delete or anonymise your data.
5. Who we share your data with
We never sell your data. We only share it when needed to run our service:
- Service providers acting on our behalf, such as website hosting, form and email tools, CRM, payment processing and our local surf instructor (only your name and lesson slot). They process your data under a contract and only follow our instructions.
- Public authorities, when the law requires it, such as the Spanish guest registration system.
- Airbnb, only if you choose to book your confirmed stay through that platform. Airbnb then processes your data under its own privacy policy.
Some providers may store data outside the European Economic Area. In that case, we make sure the transfer is protected by an adequacy decision of the European Commission or by the Standard Contractual Clauses approved by it.
6. Your rights
You can ask us at any time to:
- Access the data we hold about you
- Correct data that is wrong or incomplete
- Delete your data
- Restrict or object to how we use it
- Receive your data in a portable format
- Withdraw your consent, without affecting processing done before
To exercise any of these rights, email [email protected]. We may ask you to verify your identity. We will reply within one month.
If you think we have not handled your data correctly, you can file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es or with the authority in your EU country of residence.
7. Security
We use technical and organisational measures to protect your data against loss, misuse and unauthorised access. Only people who need your data to manage your application or stay can access it.
8. Age
Our stays are only for adults. You must be at least 18 years old to apply.
9. Cookies
Our website uses cookies that are needed for it to work. We only use analytics or advertising cookies if you accept them in the cookie banner, and you can change your choice at any time. See our cookie policy for details.
10. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version. If the changes are important, we will let you know by email or on the website.