Privacy Policy

Version 1.2 · 3 November 2026

Language notice. This English version is a translation provided for information only. Only the Spanish version («Política de Privacidad») is legally binding. In the event of any discrepancy or doubt as to interpretation, the Spanish version shall prevail.

1. Data controller

Company name (Razón social)	Cruise and Surf S.L.
Trading name (Nombre comercial)	Cruise and Surf
Tax ID (CIF)	B56744402
Registered office	Calle Senador Rafael Stinga González Nº 2, Oficina 5B, 35500 Arrecife, Lanzarote, Spain
Email	contact@cruiseandsurf.com
Telephone	+34 689 480 381
Commercial Registry	Registro Mercantil de Lanzarote, Sheet (Hoja) IL-00014244, electronic folio IRUS 1000197205455
Tourism Identification Code (CIT)	I-0005249.1
Tourism registration	2025-T23068, of 12 November 2025
Registered activity	Intermediación Turística (tourism intermediation)
Supervisory authority	Dirección General de Ordenación y Promoción Turística, Government of the Canary Islands

2. Applicable law

The processing of personal data is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and by Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

3. What data we process

3.1 Website connection data

This website has no contact forms and no other mechanism for collecting data. The only means of contact offered is an email link.

When you access the website, the hosting provider automatically records technical connection data in server log files:

the IP address of the device used to access the website,
the date and time of access,
the page or resource requested,
the browser and operating system identifier (user agent),
the referring page, where applicable (referrer).

3.2 Email communication data

If you write to us at the address given, we process the data contained in your message: your name, email address, any other contact details you provide, and the content of your message.

3.3 Cookies

This website does not set any first-party or third-party cookies, nor does it use any equivalent tracking technologies. No resources are loaded from third-party servers outside the hosting provider's infrastructure. Consequently, the information and consent requirement under Article 22.2 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE) does not apply.

4. Purposes and legal bases

Processing	Purpose	Legal basis
Server log files	Technical provision of the website, security of systems, prevention and detection of misuse and attacks	Legitimate interests — Art. 6(1)(f) GDPR. The legitimate interest consists in ensuring the secure and stable operation of the infrastructure
Email communications	Handling and answering the enquiry received, and managing the business relationship	Pre-contractual measures or performance of a contract — Art. 6(1)(b) GDPR; otherwise, legitimate interests — Art. 6(1)(f) GDPR

No profiling takes place and no automated decisions producing legal effects for the data subject are made.

5. Data processors

Processor	Service	Location
Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA 94103, USA	Website hosting and publication	United States
Alfahosting GmbH, Edmund-von-Lippmann-Straße 13-15, 06112 Halle (Saale), Germany	Email service and domain registration	Germany

A data processing agreement in accordance with Article 28 GDPR is in place with Webflow, Inc.

Webflow, Inc.'s sub-processors are published at webflow.com/legal/subprocessors. Alfahosting GmbH's sub-processors are available in the provider's customer area.

No data is disclosed to any third parties other than those listed, unless required by law.

6. International transfers

Hosting the website involves a transfer of data to the United States. Webflow, Inc. is certified under the EU–U.S. Data Privacy Framework. In addition, the data processing agreement concluded with Webflow, Inc. incorporates the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.

The email service is provided entirely within the European Economic Area.

7. Retention periods

Server log files: retained only for as long as strictly necessary for the security purposes stated, and deleted thereafter.
Email communications: retained for as long as the purpose of the contact persists and, thereafter, for the applicable statutory limitation periods, in particular those laid down in commercial and tax law.

8. Rights of data subjects

You may exercise the following rights:

Access — to know which of your data we process.
Rectification — to request the correction of inaccurate data.
Erasure — to request the deletion of your data.
Restriction of processing — to request that we restrict the use of your data.
Data portability — to receive your data in a structured, commonly used format.
Objection — to object, on grounds relating to your particular situation, to processing based on legitimate interests.

To exercise these rights, please write to contact@cruiseandsurf.com or to the postal address given in section 1, providing proof of your identity. We will reply within one month; this period may be extended in accordance with Article 12(3) GDPR.

Exercising these rights is free of charge.

9. Complaints to the supervisory authority

If you consider that the processing of your data does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es.

10. Security measures

We apply appropriate technical and organisational measures in accordance with Article 32 GDPR. Data is transmitted between your browser and the server using TLS encryption.

11. Changes

This Privacy Policy may be updated to reflect changes in the law or in technology. The version in force is the one published on this website.

Last updated: 3 November 2026