ALGARVE WATERSPORT

Last updated: March 2026

This Privacy Policy explains how Algarve Watersport collects, uses, and protects your personal data when you visit our website, make a booking, or sign up for our newsletter. We take your privacy seriously and handle all data in line with the EU General Data Protection Regulation (GDPR).

If you have any questions about this policy, contact us at info@algarvewatersport.com.

1. Who We Are

The data controller responsible for your personal data is:

Algarve Watersport

Vila Calcas, Estrada da Albardeira, 8600-302 Lagos, Portugal

Email: info@algarvewatersport.com

Phone: +351 960 460 800

The data controller is the person or organisation that decides how and why personal data is processed. If you have questions about how we handle your data, the contact details above are where to start.

2. What Data We Collect

2.1 When You Make a Booking

When you book a camp or lesson through our booking system (BookingLayer), we collect:

Full name
Email address
Phone number
Nationality and date of birth (required for guest registration)
Dietary requirements and relevant health information (if provided)
Payment information (processed securely — we do not store full card details)
Booking details: dates, sport, accommodation type, number of guests
Marketing consent preference (whether you opted in to our newsletter)

2.2 When You Fill Out a Form on Our Website

When you submit a contact, camp request, or newsletter signup form, we collect:

Name and email address
Any information you choose to include in your message
Sport and interest preferences (if selected on newsletter forms)

2.3 When You Visit Our Website

Our website automatically collects technical data including:

Browser type and version
Operating system
IP address (anonymised where possible)
Pages visited, time spent, scroll depth
Referring website or ad that brought you to us

This data is collected via cookies and analytics tools (see Section 5).

2.4 When You Contact Us Directly

If you email or message us, we store your contact details and the content of your message in order to respond and follow up.

3. How We Use Your Data

3.1 To Process Your Booking

We use your booking data to confirm your reservation, process payment, send booking confirmations and pre-arrival information, manage your stay, and handle any changes or cancellations. This is necessary to fulfil the contract between us (Art. 6(1)(b) GDPR).

3.2 To Send Marketing Communications (With Your Consent)

If you opt in during booking or via our website, we will send you our monthly newsletter, early bird offers, flash deals, equipment discounts from the Kite-House shop, and seasonal camp news. We do this only with your explicit consent (Art. 6(1)(a) GDPR).

You can unsubscribe at any time by clicking the unsubscribe link in any email, or by emailing info@algarvewatersport.com. Opting out of marketing does not affect your booking confirmations or transactional communications.

3.3 To Improve Our Website and Marketing

We use anonymised analytics data to understand how visitors use our website and how to improve our content and advertising. This is based on our legitimate interest in running an effective business (Art. 6(1)(f) GDPR).

3.4 To Comply With Legal Obligations

In some cases we are required to retain data for legal, accounting, or tax purposes (Art. 6(1)(c) GDPR).

4. Third-Party Systems We Use

We use the following third-party services to run our business. Each acts as a data processor on our behalf, bound by GDPR-compliant data processing agreements:

BookingLayer

Our booking and reservation management system. Stores booking details, guest information, and payment records. All transactional communications (booking confirmations, payment reminders, pre-arrival emails) are sent via BookingLayer.

GoHighLevel (GHL)

Our marketing CRM system. Stores contact details, marketing consent status, and interest preferences for guests and leads. Used for newsletter campaigns, promotional emails, and audience segmentation. Only contacts who have given explicit marketing consent receive emails via this system.

n8n

Our automation platform. Used to transfer data securely between BookingLayer and GoHighLevel. Does not store personal data independently — it acts only as a data bridge between systems.

Google Analytics 4

Website analytics. Collects anonymised behavioural data about website visits. IP addresses are anonymised before storage. Used to understand traffic sources and improve website performance.

Opt out: tools.google.com/dlpage/gaoptout

Google Ads

Used for paid advertising. Conversion tracking cookies are placed when you arrive via a Google Ad. This data is used solely to measure campaign performance.

Meta (Facebook) Pixel

Used for paid advertising on Facebook and Instagram. Tracks visits and conversions to measure ad effectiveness and build retargeting audiences.

Opt out: facebook.com/ads/preferences

YouTube

We embed YouTube videos on our website. When you play a video, YouTube may collect data about your visit. We use YouTube’s enhanced privacy mode where possible.

5. Cookies

Our website uses cookies — small text files stored on your device. We use:

Essential cookies: required for the website to function (e.g. booking session cookies)
Analytics cookies: track anonymised visitor behaviour via Google Analytics
Advertising cookies: placed by Google Ads and Meta Pixel for ad performance tracking

You can manage your cookie preferences via the consent banner when you first visit our site, or through your browser settings at any time. Disabling certain cookies may limit some website functionality.

For a full list of cookies, see our Cookie Policy page.

6. How Long We Keep Your Data

Booking Data

We retain booking and guest records for 7 years after your stay, in line with Portuguese tax and legal requirements.

Marketing Data

We keep your email and marketing preferences on file for as long as you remain an active subscriber. If you unsubscribe, we retain only your email address on a suppression list to ensure we do not accidentally contact you again in the future.

Website Analytics Data

Anonymised analytics data is retained for up to 14 months, after which it is automatically deleted or further anonymised by Google Analytics.

Enquiry and Contact Data

If you contact us but do not make a booking, we retain your details for up to 2 years in case you return with further enquiries. You can request deletion at any time.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to access: request a copy of the personal data we hold about you
Right to rectification: ask us to correct inaccurate or incomplete data
Right to erasure: request deletion of your personal data (right to be forgotten)
Right to restriction: ask us to limit how we process your data in certain circumstances
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interests or for direct marketing
Right to withdraw consent: if processing is based on consent, you can withdraw it at any time without affecting previous processing

To exercise any of these rights, contact us at info@algarvewatersport.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD): cnpd.pt

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes SSL/TLS encryption on our website, restricted access to personal data within our team, and GDPR-compliant data processing agreements with all third-party systems we use.

While we take every reasonable precaution, no data transmission over the internet can be guaranteed 100% secure. If you have concerns about a specific communication, please contact us directly.

9. International Data Transfers

Some of our third-party service providers (including Google and Meta) may process your data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your data to the same standard as within the EU.

10. Children’s Data

Our services are primarily aimed at adults aged 18 and over. We do not knowingly collect personal data from children under 16 without verifiable parental consent. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time — for example, when we add new services or change how we process data. The most current version will always be available at algarvewatersport.com/en/privacy-policy/. The date at the top of this page shows when it was last revised.

If we make significant changes that affect how we use your personal data, we will notify active marketing subscribers by email.

12. Contact Us

For any privacy-related questions, data requests, or complaints: