We respect your privacy. This page explains what personal data we collect, why, how long we keep it, and what rights you have under the GDPR and Slovenian ZVOP-2.
1. Data controller
Sport Group d.o.o., Osojnikova 4, 2000 Maribor, VAT ID SI72133449. Contact for privacy: info@surf-store.com.
2. What we collect
Booking data: name, email, phone, dates, package, experience level. Browsing data: IP, browser type, pages visited, timestamps. Card payments are handled exclusively by our payment provider — we store only the transaction receipt.
3. Purposes
Confirming reservations and communication; performing the service; issuing invoices; replying to enquiries; legal accounting retention; marketing only with your explicit consent.
4. Legal basis
Contract performance, legal obligation (tax), legitimate interest (fraud prevention), and consent (marketing).
5. Recipients
Data is not shared with third parties except where required by law or for service delivery (payment processor, accounting, Resend for email).
6. Retention
Booking data 3 years after service; accounting data 10 years; marketing until consent withdrawal.
7. Your rights
Access, rectification, erasure, restriction, portability and objection. Email info@surf-store.com — we respond in 30 days. You may also lodge a complaint with the Slovenian Information Commissioner (gp.ip@ip-rs.si).
8. Security
All transfers are TLS-encrypted; database access is restricted; backups are encrypted.
Sport Group d.o.o. · Osojnikova 4, 2000 Maribor, Slovenija · SI72133449