Privacy Policy

1. Who we are

This Privacy & Cookie Policy explains how Passaro Kitesurf & Wingfoil school (NIF/NIPC 517 387 280, Barão 9, Lote 1, 2510-662 Vau, Óbidos, Portugal) (“we”, “us”, “our”) collects, uses and protects your personal data when you visit passarokite.com or book a lesson, rental or camp with us. We are the data controller under the EU General Data Protection Regulation (GDPR).

2. What we collect

Booking and enquiry details you give us (name, email, phone/WhatsApp, city/country, lesson or camp preferences), messages you send us, and — with your consent — website usage data via cookies (see section 5).

3. How and why we use it

To answer enquiries and arrange your lessons, rentals or camps (to perform our agreement with you); to send you our newsletter if you opt in (consent); and to measure and improve our website and advertising where you have accepted the relevant cookies (consent). We rely on our legitimate interest to run and secure the site.

4. Email marketing

Our newsletters are sent through Brevo and MailerLite, our email service providers. You can unsubscribe at any time using the link in every email, or by contacting us. We never sell your email address.

5. Cookies

Cookies are small files stored on your device that help the site work and let us understand how it is used. You can manage your preferences through our cookie banner, or disable cookies in your browser settings (this may affect some features). We use:

• Necessary cookies — required for the site and forms to function.
• Anti-spam protection — Google reCAPTCHA protects our forms against spam; Google processes technical data (IP address, browser information) for this purpose.
• Analytics cookies — Google Analytics 4 (Google tag / gtag.js), to measure traffic and improve content.
• Marketing cookies — Google Ads (conversion measurement), to measure and improve our advertising. These are set only if you accept marketing cookies.

6. Who we share your data with

We share data only with the service providers that help us run our business, acting on our behalf: our email platform (Brevo, MailerLite), our analytics and advertising platform (Google), our contracted marketing provider, our payment provider, and our website host. We do not sell your personal data to third parties.

7. Data retention

We keep your personal data only as long as necessary for the purposes above, or as required by law (for example, accounting records). Newsletter data is kept until you unsubscribe.

8. International transfers

Some of our providers (e.g. Google, Brevo, MailerLite) may process data outside the European Economic Area. Where they do, appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the EU-US Data Privacy Framework are in place.

9. Your rights

Under the GDPR you have the right to access, correct, delete or restrict your data, to object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, email us at hello@passarokite.com.

10. Data security

We take reasonable technical and organisational measures to protect your data against loss, misuse or unauthorised access. No method of transmission over the internet is completely secure, but we work to keep your information safe.

11. Children

Lessons for minors must be arranged by a parent or legal guardian, who provides any personal data on the minor’s behalf. We do not knowingly collect data directly from children.

12. Changes & contact

We may update this policy from time to time; the latest version will always be on this page. For any privacy question or complaint, contact hello@passarokite.com. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD, cnpd.pt).