Privacy Policy | Kitesurf Culture

1Who we are

This website, kitesurfculture.com (the “Site”), is operated by Gabriele Fabrizio Sbalbi, an individual, who runs the project Kitesurf Culture (“we”, “us”).

We are the data controller of the personal data described in this policy: we decide why and how it is used. You can reach us about anything concerning your data at [email protected] or with the contact form. We are not required to appoint a Data Protection Officer; this address is our privacy contact.

This policy applies to the Site, our newsletter, our forms and, when you create one, your Kitesurf Culture account and the services linked to it. It explains what we collect, why, on which legal basis, who receives it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the Lithuanian Law on Legal Protection of Personal Data and the ePrivacy rules on cookies. It should be read with our Terms and Conditions and our Cookie Policy.

2The short version

You can read the Site without giving us any personal data. We only ask for data when you use a feature: write to us, subscribe, comment, create an account or buy a paid service.
To create an account we need only your email address and a password (or your Google or Facebook sign-in). Your name, country, picture and the rest of your profile are optional and you add them when you want.
We do not sell your personal data, and we do not use it for automated decisions that have legal effects on you.
Analytics cookies and similar tracking run only if you accept them in the cookie banner. You can change your mind at any time.
Newsletters need your confirmation (double opt-in) and every email has an unsubscribe link.
You can ask us to access, correct, export or delete your data, and to stop using it, at any moment.

3What we collect, why and on which legal basis

The table lists each way we use personal data. “Legal basis” refers to Article 6(1) GDPR: (a) your consent, (b) a contract with you or steps you ask for before one, (c) a legal obligation, (f) our legitimate interests, which we balance against your rights.

When you…	Data	Why	Legal basis	How long
Visit the Site	IP address, browser and device type, pages requested, date and time, referring page (server logs)	Deliver the pages, keep the Site secure, find and stop abuse and errors	Legitimate interest (f)	Up to 90 days, longer only to investigate a security incident
Write to us (contact form, email)	Name, email address, topic, message, the spot or page you mention, IP address	Read and answer your request, correct the content of the Site	Legitimate interest (f) and, if you ask for a service, steps before a contract (b)	Up to 24 months after the last message
Subscribe to the newsletter	Email address, name (optional), a confirmation token	Send you news, new articles and spot updates; prove that you confirmed	Consent (a), given by sending the form and confirming by email	Until you unsubscribe or withdraw consent; then only the minimum needed to prove consent and to not email you again
Comment on the blog	Name, email address (never published), comment, date, your notification choices; a Gravatar picture if your email has one. If you are signed in to your account you do not type a name or email: we use those of your account, show your current display name and picture next to the comment, and link the comment to your account	Publish and moderate your comment, notify you of replies if you ask, prevent spam	Consent (a) for what you submit and for notifications; legitimate interest (f) for moderation	While the comment stays online; deleted on request. When you delete your account, your comments stay online without the link to you and without your email address; ask us if you want them removed too
Contact a kite school from its page	Name, email address, topic, your message	Pass your request to the school you chose. About 5 days later we send you one email asking whether the school replied, and we keep your answer to check that the schools listed on the Site respond	Steps at your request before a contract (b); legitimate interest (f) for the follow-up email and the reply check	We keep a copy in our mailbox and the record of your request and answer for up to 12 months, then delete them. The school then keeps your message under its own policy
Create an account	Email address and password (stored only as a salted hash; none if you only sign in with Google or Facebook). We do not ask for your name when you sign up: until you choose a display name in your profile we use the first part of your email address as your name. The details you add later are optional: display name, country, nationality, the year you started kitesurfing, a short bio and a picture. We also keep the dates you registered, verified your email and last signed in, your privacy and notification choices and, if you tick the box when signing up, your newsletter choice	Provide your account and the member area, verify your email, keep the account secure (including limiting repeated sign-in attempts by IP address and email), contact you about it	Contract (b); legitimate interest (f) for security and abuse prevention	While the account is open. When you delete it, it is removed at once from the live Site; copies in backups disappear in the normal backup cycle. We keep only what we must keep by law or to defend a claim
Break the rules, or we need to protect other users	The status of your account (active or blocked), the reason and date if we block it, an internal note written by our team, and whether we hide your profile from other members	Stop abuse, spam and fraud, keep a record of what we decided and why, and answer you if you ask us to review it	Legitimate interest (f)	While the account is open. Notes and reasons are visible only to our team and are deleted with the account,, except what we need to defend a legal claim. You can ask to see them (right of access)
Sign in with Google or Facebook	The identifier of your Google or Facebook account, your email address, your name and your profile picture address, as far as that service provides them (Facebook gives us an email address only if it has confirmed one). We never receive your Google or Facebook password	Create your account, let you sign in without a password, and show your picture if you have not uploaded one	Contract (b), at your request; the provider processes your data under its own policy	While the account is open; the link is removed when you delete the account
Add a kite spot or a kite school, or save spots on your lists (home spots, Been there with the optional year, Want to go)	What you submit (names, descriptions, location, contact details of the school, links, photos), the date, and the link between the entry and your account. Your home spots, Been there and Want to go are lists tied to your account	Review and publish the entry, prevent spam and abuse, show you your own lists, stats and badges, and let you find your submissions. Other members only see anonymous totals (for example how many riders call a spot home), never your name	Contract (b); legitimate interest (f) for moderation, accountability and keeping the database reliable	Your lists are deleted with your account. A spot or school you submitted becomes part of our database once approved and stays online after you delete your account: it is then no longer linked to you and the email address you submitted it with is erased. You cannot edit or delete approved spots yourself; write to us to correct or remove one
Share a photo of a kite spot	The photo (the location and camera data stored in the file are removed), your caption, the spot, the date, the date you confirmed that you have the right to share it, our decision, and the link between the photo and your account. If you allow it in your privacy settings, your display name is shown as the author	Check, publish and credit the photo, answer removal requests, prevent abuse, and award contribution badges	Contract (b); consent (a) for showing your name as the author, which you can withdraw in your privacy settings; legitimate interest (f) for moderation	Photos waiting or refused are deleted when you remove them or delete your account. A photo we published stays in the spot gallery after you delete your account: it is then no longer linked to you and your name is no longer shown. You can ask us to remove a published photo at any time
Claim or manage a kite school listing	The link between your account and the school, the school details you edit (description, contact details, services, affiliations), and a confirmation link we send to the school’s own email address to check the claim, and the photos and map position you set	Verify that you represent the school and publish your edits	Contract (b); legitimate interest (f) for verifying claims and protecting schools from false edits	While you manage the school. When you delete your account the school stays listed and is no longer linked to you
Review a kite school, answer a review of your school, or report a review	The stars, the text, the dates and the link between the review and your account. Your display name is shown publicly with the review (if your profile is not visible to others, the review is shown as written by “a kitesurfer”). The answer of a school is shown with the name of the school. A report stores the reason, your optional note, the date and who sent it: only our team sees reports	Publish reviews and answers, let the school answer, tell the school that a new review arrived and tell you when the school answered (by email), moderate reviews and handle reports	Contract (b); legitimate interest (f) for moderation, reports and preventing abuse	While the review is online: you can edit or delete it at any time. When you delete your account your reviews stay online without your name; ask us if you want them removed too. Reports are kept while the review they concern is online
Buy a paid plan	Billing name and address, email, VAT number, plan, payment status and invoices. We never see or store your full card number: it goes to our payment provider	Take payment, issue invoices, keep accounts, handle refunds	Contract (b); legal obligation (c) for tax and accounting records	Invoices and accounting records for the period required by Lithuanian tax and accounting law
Accept analytics cookies	Pseudonymous usage data: pages viewed, time, approximate location, device, browser, an identifier stored in a cookie	Understand how the Site is used and improve it	Consent (a), required also by Art. 5(3) of the ePrivacy Directive	Cookies up to 2 years; data in the analytics tool up to 14 months
Use a form with the anti-spam check	The checkbox result, your IP address and technical signals processed by Cloudflare Turnstile	Stop bots and abuse of our forms	Legitimate interest (f)	As set by Google, see its privacy policy
View maps, forecasts, videos and avatars	Your IP address and browser details, sent to the provider that serves the map tiles, the Windy forecast, the YouTube video or the Gravatar image	Show you the content of the page	Legitimate interest (f); consent (a) where the provider sets cookies and you have been asked	As set by each provider
Use “Near me” on the schools page	The position your browser gives, only after you click the button and allow it	Sort the schools by distance, show where you are on the map and, if you click “Directions”, open the route in Google Maps	Consent (a), by clicking and allowing it	We do not receive or store it: it stays in your browser, and Google gets it only if you click “Directions”
Report content or complain	Your name, email, what you report and why	Handle notices about illegal content, copyright and complaints, and keep a record	Legal obligation (c) and legitimate interest (f)	Up to 3 years, or until a related claim is settled

We also keep the data we need to defend legal claims and to comply with law (for example a lawful request from a public authority), under legitimate interest (f) and legal obligation (c).

Giving us data is voluntary. If you do not, you can still read the Site, but we cannot provide the feature that needs it (for example we cannot send a newsletter without an email address).

4Where the data comes from

Mostly from you, directly. We also receive: the technical data your browser sends; for school and business listings, details provided by the business or its representative; and information from the payment provider about the status of your payment. We do not buy personal data lists.

5Who receives your data

We share personal data only when needed, and never for sale. Recipients are:

Service providers acting for us (processors): our hosting provider (Hostinger, servers in Germany), Cloudflare (content delivery, security and performance), our email provider (Titan Email) and, once paid plans start, Stripe for payments. They may use the data only on our instructions and under a data processing agreement.
Google: Google Analytics and Tag Manager (only with your consent). Google may act as an independent controller for part of this processing. If you choose “Sign in with Google”, Google also tells us who you are, under its own privacy policy.
Facebook (Meta): only if you choose “Sign in with Facebook”. Facebook learns that you signed in to our Site and tells us who you are, under its own privacy policy.
Embedded services: Stadia Maps (map tiles), Windy.com (wind forecast), YouTube (videos) and Gravatar by Automattic (avatars). They receive your IP address when their content loads, and may set their own cookies.
Kite schools, shops and stays that you choose to contact: they receive your message and become responsible for it under their own privacy policy.
Public authorities, courts and advisers (lawyers, accountants) when the law requires it or to defend a right.
A buyer of the Site, if the Site is ever sold or merged: your data would pass to the new owner, who must respect this policy, and you would be told in advance.

Your member profile is private. Today no other visitor or member can see your profile details. If we open community features later, you will choose what is visible in Settings → Privacy, you will be told before it starts, and the settings you saved will be respected.

What you publish yourself (a comment, a review, a spot, a school listing) can be read by anyone and may be copied by others. Please do not post personal data about third parties or sensitive data about yourself.

6Transfers outside the European Economic Area

Our own servers are in the EU (Germany). Some providers, such as Google, Cloudflare, Automattic and Stripe, are based in or may process data in the United States or other countries outside the EEA. We rely on an adequacy decision (for the United States, the EU-US Data Privacy Framework for certified companies) or, where there is none, on the Standard Contractual Clauses adopted by the European Commission, with additional safeguards where needed. You can ask us for a copy of the safeguards in place.

7Cookies and similar technologies

We use strictly necessary cookies to run the Site. Analytics cookies are set only after you accept them in the cookie banner. Details, the list of cookies and how to change your choice are in the Cookie Policy. You can open the settings again at any time with the “Cookie settings” link at the bottom of every page.

8Your rights

Whatever country you live in, you can ask us to:

access your data and receive a copy (Art. 15);
correct data that is wrong or incomplete (Art. 16);
erase your data (“right to be forgotten”) when the law allows it (Art. 17);
restrict the use of your data while a question is settled (Art. 18);
receive your data in a structured, common format and send it to another service (portability, Art. 20);
object to uses based on our legitimate interests, and to direct marketing at any time (Art. 21);
withdraw consent at any time, without affecting what was done before (Art. 7). For the newsletter, use the unsubscribe link in any email; for cookies, use “Cookie settings”.

As a member you can do most of this yourself, without writing to us: edit your details in Profile, download a copy of your data (JSON) and set your contact, newsletter and visibility choices in Settings → Privacy, and delete your account in Delete account.

To use a right, write to [email protected]. We may ask you to prove who you are, and we answer within one month (two more months if the request is complex, with an explanation). It is free unless the request is clearly unfounded or excessive.

You also have the right to lodge a complaint with a data protection authority, in particular in the EU country where you live or work or where the problem happened. Our lead authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, Vilnius, vdai.lrv.lt. We would appreciate the chance to solve the issue first.

We make no decision about you based only on automated processing, including profiling, that has legal or similarly significant effects.

9How we protect your data

We use measures that fit the risk: encrypted connections (HTTPS), passwords stored only as salted hashes, access limited to the people who need it, input checks and rate limits against abuse. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the authority as the law requires.

10Children

The Site is intended for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a young person has given us data, tell us and we will delete it.

11Visitors outside the EU

We offer the same rights to everyone. If you live in the United Kingdom, the UK GDPR gives you equivalent rights and you may complain to the Information Commissioner’s Office. If you live in a US state with a privacy law (for example California), you can ask to know, access, correct or delete your data, and we do not sell personal information or share it for cross-context behavioural advertising. We will not treat you differently for using these rights. If you live elsewhere, your local law may add rights; write to us and we will apply them as far as they apply.

12Links to other sites

The Site links to schools, shops, forecast tools, social networks and other sites we do not control. This policy does not cover them: read their privacy policies before you give them data.

13Changes to this policy

We update this policy when the Site, our services or the law change. The date at the top shows the current version. For important changes we will tell members and subscribers by email or with a notice on the Site before they apply, and ask for consent again where the law requires it.

14Contact

Questions or requests about your data: [email protected]
Gabriele Fabrizio Sbalbi, Kitesurf Culture