Privacy Policy
How Kitesurf Culture collects, uses and protects your personal data, and the rights you have over it.
Last updated:
1Who we are
This website, kitesurfculture.com (the “Site”), is operated by Gabriele Fabrizio Sbalbi, sole trader (individual activity), trading as Kitesurf Culture (“we”, “us”), [street and number], Vilnius, Lithuania (certificate no. [individual activity certificate / business certificate number]).
We are the data controller of the personal data described in this policy: we decide why and how it is used. You can reach us about anything concerning your data at [email protected] or with the contact form. We are not required to appoint a Data Protection Officer; this address is our privacy contact.
This policy applies to the Site, our newsletter, our forms and, when you create one, your Kitesurf Culture account and the services linked to it. It explains what we collect, why, on which legal basis, who receives it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the Lithuanian Law on Legal Protection of Personal Data and the ePrivacy rules on cookies. It should be read with our Terms and Conditions and our Cookie Policy.
2The short version
- You can read the Site without giving us any personal data. We only ask for data when you use a feature: write to us, subscribe, comment, create an account or buy a paid service.
- We do not sell your personal data, and we do not use it for automated decisions that have legal effects on you.
- Analytics cookies and similar tracking run only if you accept them in the cookie banner. You can change your mind at any time.
- Newsletters need your confirmation (double opt-in) and every email has an unsubscribe link.
- You can ask us to access, correct, export or delete your data, and to stop using it, at any moment.
3What we collect, why and on which legal basis
The table lists each way we use personal data. “Legal basis” refers to Article 6(1) GDPR: (a) your consent, (b) a contract with you or steps you ask for before one, (c) a legal obligation, (f) our legitimate interests, which we balance against your rights.
| When you… | Data | Why | Legal basis | How long |
|---|---|---|---|---|
| Visit the Site | IP address, browser and device type, pages requested, date and time, referring page (server logs) | Deliver the pages, keep the Site secure, find and stop abuse and errors | Legitimate interest (f) | Up to 90 days, longer only to investigate a security incident |
| Write to us (contact form, email) | Name, email address, topic, message, the spot or page you mention, IP address | Read and answer your request, correct the content of the Site | Legitimate interest (f) and, if you ask for a service, steps before a contract (b) | Up to 24 months after the last message |
| Subscribe to the newsletter | Email address, name (optional), a confirmation token | Send you news, new articles and spot updates; prove that you confirmed | Consent (a), given by sending the form and confirming by email | Until you unsubscribe or withdraw consent; then only the minimum needed to prove consent and to not email you again |
| Comment on the blog | Name, email address (never published), comment, date, your notification choices; a Gravatar picture if your email has one | Publish and moderate your comment, notify you of replies if you ask, prevent spam | Consent (a) for what you submit and for notifications; legitimate interest (f) for moderation | While the comment stays online; deleted on request |
| Contact a kite school from its page | Name, email address, topic, your message | Pass your request to the school you chose | Steps at your request before a contract (b) | We keep a copy in our mailbox for up to 12 months. The school then keeps it under its own policy |
| Create an account | Email address, username, password (stored only as a salted hash), first and last name, and the optional details you choose to add (city, country, address, phone), your preferences, the date you registered and verified | Provide your account and the member services, keep it secure, contact you about it | Contract (b); legitimate interest (f) for security | While the account is open; deleted within 30 days after you close it, except what we must keep by law or to defend a claim |
| Post content as a member (reviews, spots, photos, listings) | What you submit, your username or name, date, the account it comes from | Publish it, show who wrote it, moderate it and handle reports | Contract (b); legitimate interest (f) for moderation and legal defence | While it is published; when you delete it or your account it is removed or anonymised; copies in backups disappear in the normal backup cycle |
| Manage a business listing (school, shop, stay) | Your name, role, business name, address, phone, email, website, proof that you represent the business | Verify and publish the listing, give you the business tools | Contract (b) | While the listing is active, then as above |
| Buy a paid plan | Billing name and address, email, VAT number, plan, payment status and invoices. We never see or store your full card number: it goes to our payment provider | Take payment, issue invoices, keep accounts, handle refunds | Contract (b); legal obligation (c) for tax and accounting records | Invoices and accounting records for the period required by Lithuanian tax and accounting law |
| Accept analytics cookies | Pseudonymous usage data: pages viewed, time, approximate location, device, browser, an identifier stored in a cookie | Understand how the Site is used and improve it | Consent (a), required also by Art. 5(3) of the ePrivacy Directive | Cookies up to 2 years; data in the analytics tool up to 14 months |
| Use a form with the anti-spam check | The checkbox result, your IP address and technical signals processed by Google reCAPTCHA | Stop bots and abuse of our forms | Legitimate interest (f) | As set by Google, see its privacy policy |
| View maps, forecasts, videos and avatars | Your IP address and browser details, sent to the provider that serves the map tiles, the Windy forecast, the YouTube video or the Gravatar image | Show you the content of the page | Legitimate interest (f); consent (a) where the provider sets cookies and you have been asked | As set by each provider |
| Use “Near me” on the schools page | The position your browser gives, only after you click the button and allow it | Sort the schools by distance, show where you are on the map and, if you click “Directions”, open the route in Google Maps | Consent (a), by clicking and allowing it | We do not receive or store it: it stays in your browser, and Google gets it only if you click “Directions” |
| Report content or complain | Your name, email, what you report and why | Handle notices about illegal content, copyright and complaints, and keep a record | Legal obligation (c) and legitimate interest (f) | Up to 3 years, or until a related claim is settled |
We also keep the data we need to defend legal claims and to comply with law (for example a lawful request from a public authority), under legitimate interest (f) and legal obligation (c).
Giving us data is voluntary. If you do not, you can still read the Site, but we cannot provide the feature that needs it (for example we cannot send a newsletter without an email address).
4Where the data comes from
Mostly from you, directly. We also receive: the technical data your browser sends; for school and business listings, details provided by the business or its representative; and information from the payment provider about the status of your payment. We do not buy personal data lists.
5Who receives your data
We share personal data only when needed, and never for sale. Recipients are:
- Service providers acting for us (processors): our hosting provider (Hostinger, servers in Germany), Cloudflare (content delivery, security and performance), our email provider (Titan Email) and, once paid plans start, Stripe for payments. They may use the data only on our instructions and under a data processing agreement.
- Google: Google Analytics and Tag Manager (only with your consent) and reCAPTCHA (on forms). Google may act as an independent controller for part of this processing.
- Embedded services: Stadia Maps (map tiles), Windy.com (wind forecast), YouTube (videos) and Gravatar by Automattic (avatars). They receive your IP address when their content loads, and may set their own cookies.
- Kite schools, shops and stays that you choose to contact: they receive your message and become responsible for it under their own privacy policy.
- Public authorities, courts and advisers (lawyers, accountants) when the law requires it or to defend a right.
- A buyer of the Site, if the Site is ever sold or merged: your data would pass to the new owner, who must respect this policy, and you would be told in advance.
What you publish yourself (a comment, a review, a public profile) can be read by anyone and may be copied by others. Please do not post personal data about third parties or sensitive data about yourself.
6Transfers outside the European Economic Area
Our own servers are in the EU (Germany). Some providers, such as Google, Cloudflare, Automattic and Stripe, are based in or may process data in the United States or other countries outside the EEA. We rely on an adequacy decision (for the United States, the EU-US Data Privacy Framework for certified companies) or, where there is none, on the Standard Contractual Clauses adopted by the European Commission, with additional safeguards where needed. You can ask us for a copy of the safeguards in place.
7Cookies and similar technologies
We use strictly necessary cookies to run the Site. Analytics cookies are set only after you accept them in the cookie banner. Details, the list of cookies and how to change your choice are in the Cookie Policy. You can open the settings again at any time with the “Cookie settings” link at the bottom of every page.
8Your rights
Whatever country you live in, you can ask us to:
- access your data and receive a copy (Art. 15);
- correct data that is wrong or incomplete (Art. 16);
- erase your data (“right to be forgotten”) when the law allows it (Art. 17);
- restrict the use of your data while a question is settled (Art. 18);
- receive your data in a structured, common format and send it to another service (portability, Art. 20);
- object to uses based on our legitimate interests, and to direct marketing at any time (Art. 21);
- withdraw consent at any time, without affecting what was done before (Art. 7). For the newsletter, use the unsubscribe link in any email; for cookies, use “Cookie settings”.
To use a right, write to [email protected]. We may ask you to prove who you are, and we answer within one month (two more months if the request is complex, with an explanation). It is free unless the request is clearly unfounded or excessive.
You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work or where the problem happened. Our lead authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, vdai.lrv.lt. We would appreciate the chance to solve the issue first.
We make no decision about you based only on automated processing, including profiling, that has legal or similarly significant effects.
9How we protect your data
We use measures that fit the risk: encrypted connections (HTTPS), passwords stored only as salted hashes, access limited to the people who need it, input checks and rate limits against abuse. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the authority as the law requires.
10Children
The Site is intended for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a young person has given us data, tell us and we will delete it.
11Visitors outside the EU
We offer the same rights to everyone. If you live in the United Kingdom, the UK GDPR gives you equivalent rights and you may complain to the Information Commissioner’s Office. If you live in a US state with a privacy law (for example California), you can ask to know, access, correct or delete your data, and we do not sell personal information or share it for cross-context behavioural advertising. We will not treat you differently for using these rights. If you live elsewhere, your local law may add rights; write to us and we will apply them as far as they apply.
12Links to other sites
The Site links to schools, shops, forecast tools, social networks and other sites we do not control. This policy does not cover them: read their privacy policies before you give them data.
13Changes to this policy
We update this policy when the Site, our services or the law change. The date at the top shows the current version. For important changes we will tell members and subscribers by email or with a notice on the Site before they apply, and ask for consent again where the law requires it.
14Contact
Questions or requests about your data: [email protected]
Gabriele Fabrizio Sbalbi, Kitesurf Culture, [street and number], Vilnius, Lithuania