Last updated: 15 October 2026

1. Data controller

The controller responsible for personal data processed through https://swsurf.com/ and SW Surf bookings is:

• Business name: Sunset Waves Surf
• Website: https://swsurf.com/
• Responsible person: Mohamed Bahnini
• Postal address: Imi Ouaddar 80500, Morocco
• Email: [email protected]
• Telephone and WhatsApp: +212 653 783 218

2. Scope

This policy explains how SW Surf collects and uses personal data when someone visits the website, creates an account, submits an enquiry, makes or pays for a booking, contacts SW Surf, rents equipment, buys optional media, or exercises a privacy right.

3. Data collected

Depending on the interaction, SW Surf may collect:

• identity and contact data, such as name, email address, WhatsApp or telephone number;
• booking data, including requested date, service, number and ages of participants, session preference and booking history;
• safety and suitability information, such as swimming ability, surfing experience and information voluntarily provided because it is necessary for participation;
• logistics data, such as pickup, delivery, accommodation or meeting location;
• rental data, including preferred equipment, height, approximate weight, wetsuit size, equipment condition, due date and a photograph of the responsible renter’s driving licence;
• transaction data, such as amount, currency, payment status and payment reference;
• communications sent through email, telephone, WhatsApp, forms or complaint channels;
• optional photographs and video from a lesson or guiding session;
• consent records, including acceptance of terms and optional marketing or promotional-media choices;
• technical data, including IP address, browser, device, security logs, cookie choices and website activity where permitted.

SW Surf does not intend to collect complete card details. Those details are handled through the secure payment method available at checkout.

Customers should not submit detailed medical records through an open website form. If limited health information is genuinely necessary for safe participation, contact SW Surf directly so it can be handled appropriately.

4. Purposes and grounds for processing

SW Surf uses personal data to:

• respond to enquiries and take steps requested before a contract;
• review, confirm, administer and deliver bookings;
• assess whether a lesson or guiding service is suitable for the stated ability;
• arrange equipment, staffing, meeting points, transportation and delivery;
• take payment, issue confirmations, maintain accounting records and prevent fraud;
• identify renters and administer late, damage, loss or recovery issues;
• communicate operational changes, safety information and customer support;
• provide optional photographs and video;
• maintain website security and diagnose technical problems;
• comply with legal, tax, accounting, consumer and regulatory duties;
• send marketing only when consent or another lawful basis permits it;
• use identifiable customer images for promotion only with separate permission or another valid legal basis.

The legal grounds may include performance of a contract, steps requested before a contract, compliance with law, legitimate interests that do not override the person’s rights, protection of vital interests in an emergency, and consent where required.

5. Required and optional information

Fields marked as required are needed to review or perform the booking. If required information is not provided, SW Surf may be unable to confirm the service. Marketing consent and permission to use customer media for promotion are optional and do not affect service eligibility.

6. Recipients and service providers

Access is limited to SW Surf personnel and services that need the data for a defined purpose. Depending on how a customer uses the website, recipients may include:

• services used to operate, secure and maintain the website and booking process;
• the secure payment service available at checkout;
• email or messaging services used to answer enquiries and send booking information;
• WhatsApp when the customer chooses to communicate through WhatsApp;
• professional advisers, insurers, banks, authorities or courts when necessary and legally permitted.

Service providers must be selected and managed with appropriate confidentiality and security commitments.

7. Retention

SW Surf keeps personal data only for as long as needed for the stated purpose and applicable legal duties. The intended periods are:

• enquiries that do not become bookings: up to 24 months after the last meaningful contact;
• booking, contract, invoice, payment and material business correspondence: up to 10 years where needed for accounting, evidence or legal obligations;
• driving-licence photograph: deleted within 30 days after complete, undamaged and timely return, unless a late, damage, loss, fraud or legal issue requires retention until resolution and any applicable claim period;
• ordinary website security logs: normally up to 12 months unless an incident requires longer investigation;
• marketing records: until consent is withdrawn or after three years without meaningful interaction, unless law permits or requires another period;
• optional customer media awaiting delivery: normally up to 12 months after delivery;
• promotional media used with permission: until permission is withdrawn for future use or the material is no longer needed, subject to copies already lawfully published and reasonable removal time;
• cookie data: according to the durations stated in the Cookie Policy and consent tool.

Data may be anonymised instead of deleted when it can no longer identify a person.

8. Rights

Under Moroccan Law No. 09-08, individuals may have rights to receive information, access their data, request correction and object to processing on legitimate grounds. Other rights may apply depending on the person’s location and the processing, including erasure, restriction, portability and withdrawal of consent.

To exercise a right, email [email protected] with the subject Privacy Request or contact SW Surf at +212 653 783 218. Explain the request and provide information sufficient to verify identity without sending excessive identification. SW Surf will respond within the legally required period.

Consent can be withdrawn at any time for future processing. Withdrawal does not make earlier lawful processing unlawful and does not affect data that must be retained for a contract or legal duty.

9. Children and minors

A parent or responsible adult must make bookings for minors where required. Surf lessons have a minimum age of 10. Equipment may be rented for a minor only when an adult completes the agreement and provides identification. SW Surf does not knowingly use a minor’s data for marketing without appropriate permission.

10. Photographs and video

Buying personal photos or video is separate from permission for SW Surf to publish a customer’s image. SW Surf should obtain a separate, specific and optional permission before using identifiable customer media for advertising, its website or social media. Permission for a minor must come from an authorised parent or guardian.

11. Cookies

The website uses cookies and similar technologies as described in the Cookie Policy. Non-essential cookies are used only after consent where required. A user can change or withdraw cookie choices through the cookie-settings control.

12. Security

SW Surf uses reasonable organisational and technical safeguards, including access limitation, secure website connections, software updates, backups and provider controls. No online system can guarantee absolute security. Customers should contact SW Surf immediately if they believe their account, booking or personal data has been compromised.

13. Automated decisions

SW Surf does not intend to make decisions producing legal or similarly significant effects solely through automated processing. Booking forms may calculate price or prevent an unsuitable selection, but final availability and safety decisions are reviewed by a person.

14. Policy changes

Material changes will be published with a new revision date. When required, SW Surf will provide additional notice or request renewed consent.