Privacy Policy
Last updated: 8 October 2026
This policy explains what personal data ONDA Club collects on its website and app, why, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
1. Who is responsible for your data
COMPANY LEGAL NAME, tax ID (NIF/CIF) NIF/CIF, REGISTERED ADDRESS.
For anything about your data, write to PRIVACY CONTACT EMAIL.
2. What data we collect
Account: name, email address and password (or your Google sign-in), and the date you accepted the terms.
Profile, all optional: profile photo, year of birth, phone number, surf level, height, weight and an emergency contact (name and phone). If you add an emergency contact, please make sure that person agrees.
Activity: passes, bookings, board pickups and returns, damage reports with their photos, reviews and board purchases.
Payments: handled by Stripe. We receive a customer reference and payment status, never your full card number.
App: a notification token if you allow push notifications, and technical error reports.
Website: analytics data only if you accept analytics cookies. See our Cookie Policy.
3. Why we use it and on what legal basis
To run your membership: account, passes, bookings, pickups and returns (performance of the contract).
To help partners give you a suitable board and to contact someone in an emergency, using your optional profile details (performance of the contract, and your choice to provide them).
To handle damage, prevent fraud and keep the service secure (our legitimate interest).
To keep invoices and payment records (legal obligation).
To send the newsletter, offers by push notification and to run analytics (your consent, which you can withdraw at any time).
4. Who can see your data
The partner surf shop where you pick up a board sees your name, your booking and the profile details needed for the rental. A partner whose referral code you used sees that you signed up.
Service providers that work for us: Supabase (database, login and file storage), Stripe (payments), Vercel (website hosting), Resend (emails), Google Analytics (only with consent), Sentry (app error reports) and Expo (app notifications).
Some of these providers may process data outside the EU. When they do, they use the safeguards required by the GDPR, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
We never sell your data.
5. How long we keep it
We keep your data while your account is active. When you delete your account, we remove your name and contact details and block the account.
Payment and invoice records are kept for the period required by Spanish tax and commercial law. RETENTION PERIODS TO CONFIRM
6. Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy of it. You can withdraw your consent at any time.
You can edit your profile and delete your account yourself in the website or app. For anything else, write to PRIVACY CONTACT EMAIL.
If you think we have not handled your data correctly, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Security
Your data is stored with access rules so that each member can only see their own information. Profile photos are stored in a folder that only you can change.
8. Changes
If we change this policy in an important way, we will tell you on the website or in the app.