WindTrail OÜ
Privacy Policy
1. Who is responsible for processing your data?
The controller responsible for processing personal data collected via the website [Website URL] is the company WindTrail OÜ, registered under number [Estonian registration number], with its registered office at [registered office address] (hereinafter "WindTrail", "we").
For any question relating to this policy or to exercise your rights, you can contact us at [dedicated data protection e-mail address].
2. What data do we collect, why, and for how long?
The table below summarises the categories of data processed as part of our booking and kitesurf coaching trip organisation activities.
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Identity and contact details (name, e-mail, phone, address) | Booking management, communication before/during the trip | Performance of the contract | Duration of the relationship + 5 years (contractual limitation period) |
| Booking and payment data (processed by the payment provider, not stored in clear text by WindTrail) | Payment processing, invoicing | Performance of the contract / legal obligation (accounting) | 10 years (accounting obligations) |
| Health data: allergies, physical fitness, ongoing treatments | Traveller safety during coaching sessions | Explicit consent (Art. 9(2)(a) GDPR) | Duration of the trip + 1 year, then deleted |
| Photos and videos taken during the stay | Communication (website, social media) if consent given | Consent | 3 years from collection, revocable at any time |
| Browsing data (cookies, IP address, pages visited) | Website operation, audience measurement, targeted advertising where applicable | Legitimate interest (essential cookies) / Consent (analytics and advertising cookies) | 13 months maximum (cookies) |
| E-mail address for the newsletter | Sending news and promotional offers | Consent | Until unsubscribed |
3. A special note on health data
The medical information we ask for before each trip (allergies, treatments, physical fitness for kitesurfing) constitutes health data within the meaning of Article 9 of the GDPR, benefiting from enhanced protection. It is only collected with your explicit consent, obtained separately from acceptance of the terms and conditions of sale, and is accessible only to the coaches running your trip and, in the event of a medical emergency, to local emergency or medical personnel. It is never used for any other purpose (marketing, statistics) or kept for longer than one year after your trip.
4. Who is your data shared with?
Your data may be shared with the following categories of recipients, strictly limited to what is necessary for the performance of the contract:
- Online payment providers: [provider name — e.g. Stripe, Mollie]
- Local accommodation providers (hotels, camps) and transport suppliers, only the information necessary for your stay (name, dates)
- Financial guarantee provider and insurers mentioned in our Terms & Conditions
- Website hosting and e-mail service providers: [names of technical providers]
- Accountant and tax authorities, as part of our legal obligations
We never sell your data to third parties for commercial purposes.
5. Is your data transferred outside the European Union?
If any of our technical providers (website hosting, e-mailing tool) is located outside the European Economic Area, this transfer is governed by standard contractual clauses adopted by the European Commission or any other equivalent mechanism guaranteeing an adequate level of protection. The list of these providers is available on request at the address indicated in Article 1.
6. How is your data secured?
We implement reasonable technical and organisational measures (restricted access, secure website connection, passwords, backups) to protect your data against unauthorised access, loss or disclosure. As no system is infallible, we would inform you without undue delay in the event of a data breach likely to result in a risk to your rights and freedoms, in accordance with Article 34 of the GDPR.
7. What are your rights?
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access: obtain confirmation that your data is being processed and receive a copy of it
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request the deletion of your data, within the limits of our legal retention obligations (accounting in particular)
- Right to restriction of processing
- Right to data portability: receive your data in a structured, commonly used format
- Right to object, in particular to processing for direct marketing purposes
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (health data, photos, newsletter)
To exercise these rights, contact us at the address indicated in Article 1. You also have the right to lodge a complaint with the Estonian supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon — AKI), or, if you reside in France, with the French Data Protection Authority (CNIL), in accordance with Article 77 of the GDPR, which allows you to contact the authority of your country of residence.
8. Cookies and trackers
On your first visit to our website, a banner allows you to accept or decline non-essential cookies (audience measurement, advertising). Cookies strictly necessary for the website to function (booking basket, language preference) do not require consent. You can change your preferences at any time via the "Manage my cookies" link available at the bottom of the page, or by configuring your browser.
9. Updates to this policy
This privacy policy may be updated to reflect changes in our practices or in the regulations. The date of the last update appears at the bottom of this page. We encourage you to review it regularly. Last updated: [date]