Last updated: 18 August 2026.
1. Data controller
- Owner: Ignacio Floris Canal
- Trade name: Sunrise Paddle Board Sitges
- Tax ID (NIF): 47725048W
- Address: C/ Rocafort 244, 08029 Barcelona
- Email: supsunrisebarcelona@gmail.com
- Phone: +34 670 621 590
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).
2. Data we process
- Identification and contact data: name, email, phone (including the phone number you write to us from on WhatsApp).
- Booking data: activity, date and time, number of people, and the information you send us via WhatsApp when booking.
- Health data you declare: the information you share with us about physical fitness or conditions relevant to safety (processed solely for the purpose of delivering the activity safely, based on your explicit consent and vital interest).
- Payment data: if you pay online through a secure payment link, payment is processed by our payment service provider; we do not store full card details, only the confirmation and reference of the transaction.
- Images: photos and videos taken during the activity.
- Browsing data: data arising from your use of the website (see the Cookies section).
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Managing and confirming your booking (via WhatsApp) and delivering the activity | Performance of the contract |
| Charging the amount (via secure payment link or at the base) | Performance of the contract |
| Ensuring safety (fitness/health data) | Explicit consent / vital interest |
| Sending you the confirmation, reminders and photos | Performance of the contract |
| Complying with legal and tax obligations | Legal obligation |
| Marketing communications (news, offers and activities) | Consent or, if you are already a customer, legitimate interest for similar activities (art. 21.2 LSSI and art. 6.1.f GDPR). One-click unsubscribe in every email. |
| Promotional use of images | Consent |
| Responding to your enquiries | Legitimate interest |
4. Retention
We keep your data for as long as the relationship lasts and, afterwards, for the legal limitation periods (in particular, tax and liability periods). Data processed with your consent is kept until you withdraw it.
5. Recipients and data processors
We do not sell your data. To provide the service we rely on suppliers acting as data processors or independent controllers:
- WhatsApp (Meta Platforms Ireland Ltd.), the messaging channel through which bookings are made; Meta also processes your data as an independent controller under its own privacy policy.
- Payment service provider, processing of online payments through secure payment links.
- Google (Google Cloud), hosting of booking data, database and notifications.
- IONOS (1&1 IONOS), website hosting.
- Zoho Mail (Zoho Corporation), email management and delivery.
We may also disclose data to public authorities where there is a legal obligation to do so.
6. International transfers
Some suppliers (e.g. Google, Meta, Zoho) may process data outside the European Economic Area. In such cases, those transfers are covered by adequacy decisions or by Standard Contractual Clauses approved by the European Commission, or other appropriate safeguards.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and to withdraw consent, by writing to supsunrisebarcelona@gmail.com and identifying yourself. You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).
8. Security
We apply reasonable technical and organisational measures to protect your data. Online payments are transmitted through encrypted connections.
9. Images
Photos and videos are part of the service. Their promotional use requires your consent (section 11 of the Terms and Conditions) and you may object to it or withdraw it at any time by writing to supsunrisebarcelona@gmail.com.
10. Cookies and analytics
By default, this website does not set any analytics or advertising cookies. When you visit, you will see a cookie notice: only if you click "Accept" are these tools activated:
- Google Analytics 4 (Google Ireland Ltd.) — usage statistics (which pages are visited, where visits come from) to help us improve the site. Its cookies last a maximum of around 14 months.
- Meta Pixel (Meta Platforms Ireland Ltd.) — measurement of our advertising campaigns on Facebook and Instagram. If you do not accept, the pixel is not loaded at all.
Legal basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time without affecting your use of the website.
Recipients: Google and Meta receive this data and may transfer it to the United States; both companies are certified under the EU-US Data Privacy Framework, which ensures an adequate level of protection.
Changing your mind: your choice is stored in your browser. To change it, delete this site's data in your browser settings (cookies and site data) and the notice will appear again on your next visit.
11. Changes
We may update this policy. We will publish the current version on the website with its update date.
12. Automated assistant on Instagram (messages and comments)
When you send a direct message or post a comment to our Instagram account (@supsunrisebarcelona), your enquiry may be handled by an automated assistant based on artificial intelligence, supervised by our team. Here we explain how we process your data on that channel.
Data controller. Ignacio Floris Canal (Sunrise Paddle Board Sitges), NIF 47725048W, Calle Rocafort 244, 08029 Barcelona — supsunrisebarcelona@gmail.com.
What data we process. Only the data the platform provides to us when you write to us:
- your Instagram username (and the public name of your profile);
- the content of the messages or comments you send to our account, including any personal data you choose to include in them;
- technical identifiers of the conversation provided by Meta's platform, which are necessary in order to reply to you.
We do not access your list of followers, your private posts or any other data from your account, and we do not combine this data with advertising profiles.
What we use it for (purpose). Exclusively to answer your enquiries about our activities (schedules, prices, bookings, conditions) and to provide customer service. We do not use this data for advertising, we do not build profiles with it and we do not sell it or share it with third parties for commercial purposes.
Legal basis (GDPR). The processing is based on:
- art. 6.1.b GDPR — taking pre-contractual steps at your request, where your enquiry relates to booking our activities; and
- art. 6.1.f GDPR — our legitimate interest in dealing with the communications that you yourself initiate by writing to us on Instagram. You may object at any time (see rights below).
Please do not send us health data or other special categories of data through this channel; if they are relevant to a booking, we will ask you for them through the appropriate channel with the corresponding safeguards.
Who is involved in the processing (processors and platforms).
- Meta Platforms Ireland Ltd. — as the provider of Instagram and of the messaging API through which we receive and send the messages. Meta also processes your data as an independent controller in its capacity as a social network, in accordance with its own privacy policy.
- Anthropic — as a data processor providing the artificial intelligence service (the Claude model) used to generate the assistant's replies. Anthropic processes the content of the messages solely under our instructions in order to generate the reply, under a data processing agreement (DPA), and does not use this data to train its models.
- Google (Google Cloud) — as a processor, for the technical hosting of the service.
Some of these providers may process data outside the European Economic Area (USA); in that case the transfers are covered by adequacy decisions (such as the EU-US Data Privacy Framework) or by Standard Contractual Clauses approved by the European Commission.
How long we keep it. We keep the conversations for as long as strictly necessary to deal with your enquiry and its follow-up and, at most, for 12 months from the last message, unless the conversation leads to a booking (in which case the booking data is subject to the general periods of this policy) or we need to keep it for the defence against claims. After that, it is deleted or anonymised.
Human oversight. The assistant is automated, but our team may review the conversations to ensure the quality of the replies and to handle any cases the assistant cannot resolve. The assistant does not make decisions with legal effects concerning you (art. 22 GDPR): bookings, payments and cancellations are always completed through the usual channels.
Your rights. You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). To have the data from this channel deleted, follow the instructions in the next section.
13. How to request the deletion of your Instagram data
If you have interacted with our Instagram account (@supsunrisebarcelona) and want us to delete the data associated with those conversations (your username and the content of your messages or comments), you can request it in two ways:
- By email: write to supsunrisebarcelona@gmail.com with the subject "Delete my Instagram data", indicating your Instagram username so that we can locate your conversations.
- By direct message: send us a DM to @supsunrisebarcelona requesting the deletion of your data.
Timeframe: we will delete your data from our systems within a maximum of 30 days from receipt of the request and we will confirm it to you through the same channel. We will only keep what we are legally required to retain (for example, billing data if you went on to book an activity), duly blocked.
Please note that this deletion affects our copies of the conversations. Data held by Instagram/Meta (your own message inbox, your published comments) is managed from your Instagram account and in accordance with Meta's privacy policy.