Privacy policy

1. Data controller

The controller of your personal data is BI Consulting sp. z o.o., with its registered office at ul. Trylińskiego 2, Olsztyn, Poland, tax identification number (NIP): 7393979101, which operates the Skanda Surf project.

For matters concerning personal data, contact us at rodo@skandasurf.pl.

2. Data we process

Depending on how you contact us, we may process your phone number, profile name or name provided in a messenger, the content of your message, and information needed for a booking, purchase or service request — for example the selected date and time, number of boards and life-jacket information.

When an eFoil is collected and returned, we may take photographs or recordings of the equipment and its identifying marks and send them in the WhatsApp or SMS/MMS conversation relating to the booking. These materials document the condition and completeness of the setup; as a rule, we do not record the customer’s image.

The SUP booking form prepares a message that you send yourself through WhatsApp or SMS. Information entered in the form is not stored in a separate database on the Skanda Surf website.

When you use the website, basic technical data may also be processed, including the IP address, browser type, request time and error information, to the extent necessary for the website’s operation, security and maintenance.

3. Purposes and legal bases

• handling enquiries and agreeing the conditions of a booking, purchase or service — taking steps at your request before entering into a contract (Article 6(1)(b) GDPR);
• performing a booking, rental, sale or service — performance of a contract (Article 6(1)(b) GDPR);
• settlements and accounting records — compliance with legal obligations (Article 6(1)(c) GDPR);
• website security, documenting the condition of rented equipment, and establishing, pursuing or defending claims — the controller’s legitimate interests (Article 6(1)(f) GDPR);
• marketing contact — only after separate, voluntary consent, which can be withdrawn at any time (Article 6(1)(a) GDPR).

4. Who may receive the data

We do not sell personal data or share it with other organisations for their own marketing purposes. Where necessary, data may be processed by hosting and IT providers, telecommunications operators, payment providers, accounting firms and legal advisers.

If you choose WhatsApp, your data is transmitted through the WhatsApp service operated by the Meta group and is also subject to that provider’s privacy rules. Some technology services may involve data processing outside the European Economic Area under mechanisms provided for by the GDPR.

Data may be passed to a commercial partner, for example in connection with an equipment purchase, only when necessary to handle your enquiry and agreed with you.

5. Retention periods

• data concerning an enquiry that does not lead to a contract — generally up to 12 months from the last contact;
• data connected with a contract, booking, sale or service — for the duration of performance and until any relevant limitation periods expire;
• accounting documents — for the period required by law;
• data processed on the basis of consent — until consent is withdrawn, unless the purpose ends earlier;
• technical data and logs — for the period necessary to maintain the security and proper operation of the website.

6. Your rights

You have the right to request access to, rectification or erasure of your data, or restriction of its processing, and in appropriate cases the right to data portability and to object. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of earlier processing.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

7. Voluntary provision of data

Providing data is voluntary, but the information required to contact you and arrange a booking is necessary for us to respond and provide the service.

We do not make decisions about users solely by automated means and do not use profiling.

8. Cookies and analytics

The Skanda Surf website uses Google Analytics 4, provided by Google Ireland Limited, with Google Consent Mode implemented. The Google tag is present on the website, but consent for analytics, advertising and personalisation storage is denied by default.

Until you voluntarily consent, Google Analytics does not store analytics cookies or start full measurement. In denied mode, limited technical signals without cookie identifiers may be sent and used to produce modelled aggregate statistics.

Google Analytics helps us prepare aggregate traffic statistics and understand which pages are useful. For this purpose, it may process online identifiers and information about the device, browser, pages visited and approximate location. We do not use Google Analytics for advertising or personalisation.

The legal basis for analytics processing is consent (Article 6(1)(a) GDPR). You may refuse or change your choice at any time through the “Cookie settings” link in the website footer.

Links to WhatsApp, Google Maps and social media lead to external services. Their providers may use their own technologies and privacy rules after you open those services.

9. Changes to this policy

This policy may be updated when the website, range of services or applicable law changes. The current version will always be available at this address.