Privacy Policy

WAVE ATLAS TRAVEL S.L., hereinafter referred to as WAVE ATLAS TRAVEL, is a travel agency that provides services for the organisation and marketing of surfing trips for small groups to various international destinations, including accommodation, activities and the comprehensive logistical coordination of the trip.

In compliance with our duty to provide information, we have drawn up the following privacy policy designed to provide you with all the information you need to understand the scope and purpose of the data processing we carry out at the travel agency.

This is to ensure that your acceptance of the data processing we carry out is based on fully informed consent, as required by Organic Law 3/2018 of 5 December on Data Protection and the Guarantee of Digital Rights, and by Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

1) Obligation to provide data

The data requested in the forms on the Website are, as a general rule, mandatory (unless otherwise specified in the relevant field) in order to fulfil the purposes for which they are being collected.

Therefore, if the User does not provide this information or does not provide it correctly, it will not be possible to process the User’s requests, although the User will still be free to view the content of the Website.

2) User responsibility

The User warrants that they are over fourteen (14) years of age and that the data they provide to WAVE ATLAS TRAVEL is true, accurate, complete and up to date. For these purposes, the User is responsible for the accuracy of all data they provide and shall keep the information provided suitably up to date, so that it reflects their actual circumstances.

Similarly, the User warrants that they have informed any third parties whose data they provide – where applicable – of the matters set out in this document. Furthermore, the User warrants that they have obtained their authorisation to provide their data to WAVE ATLAS TRAVEL for the purposes set out herein.

3) What are the sources and categories of data?

The personal data we process is derived from the information you provide when establishing any kind of relationship with us, whether provided directly by the User via the various forms on the Website, or obtained from your browsing activity on the Website through cookies or data storage and retrieval devices, as well as from information obtained from the User’s mobile device, subject to the consents which, where applicable, they give to WAVE ATLAS TRAVEL.

In cases where a person other than the User provides personal data relating to third parties (for example, to manage bookings, add travelling companions, or make purchases on behalf of others), that person guarantees that they have the necessary authorisation to provide such information and that they have previously informed the data subjects of the purpose of disclosing their data to WAVE ATLAS TRAVEL. In such cases, liability for the truthfulness, accuracy and lawfulness of the data rests exclusively with the person providing it.

The categories of data we process are of a general nature, such as your identifying details; full name, email address/postal address and telephone number, national identity card/passport or any other document proving the traveller’s identity, provided this is necessary to provide the contracted service; and financial details once the contract has been formalised.

All personal data is treated confidentially in accordance with the privacy and security policies in place at WAVE ATLAS TRAVEL.

4) Who is the data controller?

The data controller is WAVE ATLAS TRAVEL S.L., with tax identification number (N.I.F.) B27647635, whose registered office is at Calle General Zabala, 13, Planta 1, Puerta B 28002 Madrid, Spain. You can contact us by posting a letter to our postal address, as indicated in this paragraph, or by telephone on +34 665 744 737 or by email at info@thewaveatlas.com.

5) For what purpose do we process personal data?

WAVE ATLAS TRAVEL will process the personal data provided by users in a manner designed to achieve the following objectives:

  • For the development, execution and fulfilment of the contracted service, only the data strictly necessary will be collected.

  • The channel of communication between users and WAVE ATLAS TRAVEL may be any of those provided by users for this purpose, including email address, landline or mobile telephone number and instant messaging services; these are the authorised channels for communicating any relevant information regarding the contracted services, changes or notifications.

  • To manage the collection, use and publication of images (photographs and/or videos) in which customers and, where applicable, staff may appear, for promotional and corporate communication purposes, always on the basis of the prior, express and informed consent of the data subjects.

  • To manage enquiries made via any of the contact channels provided by the agency. In the event that the data subject has only contacted WAVE ATLAS TRAVEL to request information about the services provided, their data will be processed to respond to any enquiries or requests for information they make regarding the services offered. WAVE ATLAS TRAVEL will only process the personal data that is strictly necessary to manage or resolve the enquiry or request.

  • For commercial purposes, data subjects who are actual customers of WAVE ATLAS TRAVEL may receive updates on similar products also provided by WAVE ATLAS TRAVEL. However, customers are informed that they may object at any time by contacting WAVE ATLAS TRAVEL via the channels already indicated.

  • Managing website users’ data collected via cookies, which will be processed to ensure that the website’s content is tailored to their needs and those of their device, and to continuously improve the data subject’s experience.

  • WAVE ATLAS TRAVEL does not carry out profiling.

  • Inclusion in WAVE ATLAS TRAVEL’s own instant messaging groups: to manage contact with the User by adding them to instant messaging groups, such as WhatsApp, created for coordination, information or the management of activities relating to the contracted services.

6) What is the legal basis for processing your data?

The legal basis for the processing of your data is as follows:

  • The management of pre-contractual and, where applicable, contractual arrangements based on Article 6(1)(b) of the GDPR, as we collect and process your personal data primarily for the performance of contracts in accordance with the terms and conditions set out in those contracts. In cases where, either directly or through professionals involved in the provision of the services, additional personal data is provided to WAVE ATLAS TRAVEL with additional personal data necessary for the proper provision of the requested service and which, by their nature, may relate to the User’s health (such as information on allergies, food intolerances or other similar conditions), the legal basis for such processing shall be the User’s consent.

  • To manage enquiries submitted via the contact channels specified for communications with customers. This processing is based on Article 6(1)(f) of the GDPR, namely WAVE ATLAS TRAVEL’s legitimate interest in responding to any requests for information received.

  • The legal basis for the processing of images of customers and, where applicable, employees, as well as those provided voluntarily by customers, is the express, informed and voluntary consent of the data subjects, given prior to the use of their image for promotional and communication purposes corporate. Data subjects may withdraw their consent at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal.

  • Sending commercial communications to Users: the processing carried out for this purpose is based on the consent obtained, which the User may withdraw at any time.

  • Sending commercial communications to Users who are WAVE ATLAS TRAVEL: the processing carried out for this purpose is based on legitimate interest, in accordance with the exception set out in Article 21(2) of Law 34/2002 of 11 July on information society services and electronic commerce, and the provisions of Recital 47 of the GDPR. The legitimate interest is based on carrying out direct marketing in order to offer the customer products and services that may be of interest to them and thereby secure their loyalty. However, the User has the right to object to this processing at any time.

  • With regard to international data transfers, please be advised that the legal basis for these is provided by Article 49(1)(b) of Regulation (EU) 2016/679, as these are transfers necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the data subject’s request. Failure to consent to this processing will result in the inability to provide the service and fulfil the contract.

  • Collection and storage of User data based on their browsing preferences, using their behaviour on the Website via cookies or similar storage technologies: the legal basis for processing for this purpose is consent, which the User provides by ticking the relevant box and which may be withdrawn at any time.

  • Inclusion in WAVE ATLAS TRAVEL’s own instant messaging groups: the legal basis for the processing is the consent expressly granted by the User to be added to instant messaging groups managed by WAVE ATLAS TRAVEL. Should the User withdraw their consent, WAVE ATLAS TRAVEL will not be able to include them in the groups set up for the management of activities.

The consents obtained for the aforementioned purposes are separate, so the User may revoke only one of them without affecting the others.

7) How long do we keep your personal data?

WAVE ATLAS TRAVEL processes your personal data for as long as is necessary to fulfil the purposes set out in this Privacy Policy, as well as to retain your personal information in accordance with the provisions of the relevant laws and regulations. Specifically:

  1. Business relationship and bookings: Data will be retained for the duration of the business relationship and, once this has ended, for the statutory limitation period for any potential legal proceedings, normally five years.

  2. Registration and identification on the Website: Account details will be retained for as long as the account remains active and, thereafter, for the relevant statutory limitation period.

  3. Enquiries and requests: Information sent via the contact channels will be retained for as long as necessary to respond to your request, and thereafter for the limitation period for any potential legal proceedings.

  4. Marketing communications: Data used to send marketing information will be retained until the User withdraws their consent, and for customers, for a maximum of one year.

  5. Cookies and browsing preferences: Data collected via cookies or similar technologies will be retained until the User objects, up to a maximum of one year.

  6. Legal obligations: Data required to comply with the law will be retained in accordance with the statutory time limits.

  7. Reports, statistics and internal analyses: Where applicable, data will be used to improve services or detect misuse; it will be retained only for as long as necessary for those purposes and, thereafter, for the statutory limitation period.

  8. Messaging groups and channels: Data contained in messaging groups will be retained for as long as the User maintains their consent and, once consent is withdrawn, will be retained in a blocked state for the statutory limitation period.

8) ¿A qué destinatarios se comunicarán sus datos?

WAVE ATLAS TRAVEL will disclose the data collected to:

  • Public authorities, in the cases provided for by law, on the basis of compliance with a legal obligation.

  • Courts and tribunals, in the cases provided for by law, on the basis of compliance with a legal obligation.

  • Third-party suppliers associated with the Data Controller (accommodation providers, transfer providers, transport companies, administrative agencies, IT support providers, etc.), whose involvement is necessary to fulfil the purposes described herein, on the legal basis of the performance of a contract, and who will act as independent data controllers.

For the sake of service efficiency, depending on the destination country of the trip, these suppliers may be located in third countries, resulting in international data transfers in the course of such processing. Furthermore, some of the service providers may be located in territories outside the European Economic Area that do not provide a level of data protection comparable to that of the European Union. In such cases, we wish to inform you that we transfer your data with adequate safeguards and always whilst ensuring the security of your data.

WAVE ATLAS TRAVEL applies the guidelines of the European Data Protection Board, taking the necessary measures to ensure a level of protection for personal data in accordance with current legislation, including the implementation of appropriate technical and organisational security measures. In cases where third parties are involved, it is hereby stated that such providers act as independent data controllers, each being responsible for complying with their own data protection obligations. Without prejudice to the foregoing, where applicable in accordance with the relevant legislation, the corresponding data protection agreements shall be formalised in accordance with the provisions of Article 28 of Regulation (EU) 2016/679 (GDPR).

Apart from the cases described herein, no data shall be disclosed, unless required by law.

9) Cybersecurity

As part of the security measures we wish to implement, we hereby inform you through our policy that any request our users or customers may receive electronically, whether by email or via WhatsApp, purporting to originate from our agency regarding changes to payment methods, requests for personal details or contact details, bank details and/or credit card details and/or other official information, must not be acted upon without direct confirmation from our company via an alternative channel. This is to ensure that we utilise all means at our disposal to prevent, with your cooperation, potential risks of cyber-attacks in which our company might be exploited, as well as any other potential security risks of which you may be aware.

10) Social media

WAVE ATLAS TRAVEL maintains a presence on social media platforms and acts as the data controller solely in relation to data published by WAVE ATLAS TRAVEL.

The social media platforms are as follows:

Instagram: @waveatlas_

Users of these social media platforms may configure the privacy and security settings provided by each platform; WAVE ATLAS TRAVEL is not responsible for the processing of users’ data on these platforms.

11) What are your rights when you provide us with your personal data?

Anyone has the right to obtain confirmation as to whether WAVE ATLAS TRAVEL is processing personal data relating to them.

The data subject shall have the right to withdraw their consent at any time, provided that the processing is not necessary for the performance of the contract. The withdrawal of consent shall not affect the lawfulness of processing based on consent given prior toits withdrawal.

You may exercise your rights as a data subject – including the rights of access, rectification, erasure, restriction, portability and objection to the processing of personal data – at any time and free of charge by sending an email to info@thewaveatlas.com or by writing post to WAVE ATLAS TRAVEL at the address indicated in the ‘Data Controller’ section, stating ‘EXERCISE OF RIGHTS’ in the subject line of your communication and specifying the right you wish to exercise, together with your identifying details.

Requests to exercise rights will be responded to within one month of receipt of the request, which may be extended by a further two months if necessary, taking into account the complexity and number of requests.

Furthermore, if you consider that your rights have not been upheld, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) as the national authority for supervision and control in matters of data protection.

12) Use and publication of images

WAVE ATLAS TRAVEL may process and publish images (photographs and/or videos) in which both customers and staff may appear, for the purpose of promoting its services and activities, as well as for inclusion on the corporate website, social media (such as Instagram or other platforms), and promotional and corporate materials.

In the case of group trips, the organisation may take images during the course of the activities for promotional purposes. Such processing will only take place once the express, specific and informed consent of the individuals concerned has been obtained, by means of the relevant authorisation for the processing of their image and, where applicable, the transfer of image rights.

Furthermore, in cases where customers voluntarily send images via channels such as WhatsApp or other means, and the organisation wishes to use them for publication on the channels mentioned above, the express consent of the data subject for such use will be sought in advance, including the corresponding transfer of image rights.

The legal basis for the processing is the data subject’s consent, which may be withdrawn at any time, without this affecting the lawfulness of the processing carried out prior to its withdrawal.

In any event, the organisation will take the necessary measures to ensure that the images are used appropriately, respecting the rights and freedoms of individuals, and preventing any misuse or use contrary to current legislation.

13) Commercial and promotional communications

One of the purposes for which WAVE ATLAS TRAVEL processes the personal data provided by Users (whether they have given their consent or have not objected, in the case of customers) is to send them marketing communications containing information relating to products, services, promotions, offers, events or news (of its own) relevant to the Users.

Should a User wish to stop receiving commercial or promotional communications from WAVE ATLAS TRAVEL, they may unsubscribe from the service by sending an email to the following email address: info@thewaveatlas.com or by clicking on the link that will appear at the bottom of the commercial communications sent.

14) Changes to the privacy policy

We will review and update our data protection information at least once a year or whenever there are changes to the law or to any of the procedures for processing your personal data. WAVE ATLAS TRAVEL will, in any event, always update this information whenever there is a change to the relevant legislation or its specific application.

15) Acceptance and consent

The User declares that they have been informed of the terms and conditions regarding the protection of personal data and accept the contents of this Privacy Policy.

Last updated: June 2026