This is a translation for convenience. The Polish version is legally binding.
In brief
- The controller of your data is LASTOUT sp. z o.o. of Warsaw.
- You can browse the website without giving us any data. We do not use advertising cookies or tracking pixels.
- We use booking data to organise your camp, insure you and settle accounts with you.
- We send the newsletter only with your consent. You can unsubscribe with one click.
- We do not sell data. We do not make automated decisions about you.
1. Controller and contact
- The controller of personal data is LASTOUT spółka z ograniczoną odpowiedzialnością (formerly DONCOACHING sp. z o.o.) with its registered office in Warsaw, ul. Bruzdowa 107P, 02-991 Warszawa, Poland, KRS 0001208795, NIP 7792598205, REGON 543392985 ("we").
- For matters concerning personal data write to: hubert@lastoutsurf.com or by post to our registered office.
- We have not appointed a data protection officer - we are not required to do so (art. 37 RODO, i.e. the GDPR, Regulation (EU) 2016/679).
2. Why we process data and on what legal basis
| Situation | What data | Purpose | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| You browse the website | IP address, browser and device type, time and address of the request (technical logs) | delivering the website, security, protection against attacks | art. 6(1)(f) - our legitimate interest in the secure operation of the website | according to the hosting provider's settings |
| You sign up for the newsletter | e-mail address, date and method of sign-up, information on message opens and clicks | sending the newsletter | art. 6(1)(a) - your consent (and art. 398 of the Prawo komunikacji elektronicznej, the Polish Electronic Communications Law) | until you unsubscribe; after that we keep proof of consent and of unsubscription until claims become time-barred (art. 6(1)(f)) |
| You write to us or call us (e-mail, telephone, WhatsApp, Instagram) | the data you provide and the content of the message | replying, preparing an offer | art. 6(1)(f) (answering a question), and where you ask about a trip - art. 6(1)(b) (steps taken prior to entering into a contract) | until the matter is closed, and if you conclude a contract - as for booking data |
| You book a camp and take part in it | first name and surname, date of birth, address, telephone, e-mail, country, skill level, chosen camp and room, invoicing details; where the destination requires it - travel document details | concluding and performing the contract, arranging accommodation, training sessions and transfers, contact during the trip | art. 6(1)(b) - contract | for the duration of the contract, and then until claims become time-barred (as a rule 3 years for claims under the ustawa o imprezach turystycznych i powiązanych usługach turystycznych (Polish Package Travel Act), 6 years for other claims) |
| We insure you (KL and NNW, i.e. medical expenses and personal accident insurance) | first name and surname, date of birth, trip dates and country; if you buy the extension - information about a chronic illness | taking out the insurance we are required to provide (art. 42(7) of the Package Travel Act) | art. 6(1)(b) and (c); health data - art. 9(2)(a) (your explicit consent) | as for booking data |
| You give us information about your health (e.g. an injury, contraindications) | information you provide yourself | safety in the water and choice of activities | art. 9(2)(a) - explicit consent; in emergencies art. 9(2)(c) (protection of vital interests) | until the end of the camp, then we delete it, unless it is needed to handle claims |
| We settle accounts with you | invoice and payment data | accounting and taxes | art. 6(1)(c) - legal obligation | 5 years from the end of the tax year |
| We film training sessions for video analysis | video recordings and photos from training sessions, coaches' comments | video analysis forming part of the camp | art. 6(1)(b) - contract | according to the rules of the Booking system: a recording you do not log in to collect within 30 days is deleted; once you log in - until your account is deleted |
| We publish photos and videos from the camp | your image | promoting LASTOUT (website, Instagram, materials) | art. 6(1)(a) - consent (and art. 81 of the Polish Copyright Act) | until consent is withdrawn; we do not have to withdraw from circulation materials published earlier, unless the consent provided for this |
| We pursue or defend against claims | data needed in the matter | defence of rights | art. 6(1)(f) | until the matter is finally concluded and the limitation period expires |
Providing data for the newsletter and for contact is voluntary. Providing data in a booking is voluntary, but without it we cannot conclude or perform the contract.
3. Data of other participants
If you book a camp for other people, you give us their data. Pass this Policy, or a link to it, on to them. We use their data for the same purposes and on the same terms as yours.
4. To whom we disclose data
We disclose data only where this is necessary for the purposes in section 2.
Providers that process data on our behalf (art. 28 GDPR):
- Cloudflare, Inc. - website hosting, CDN, protection against attacks, file storage;
- UAB "MailerLite" (Lithuania) - sending the newsletter;
- the provider of the swell.surf Booking system and the providers used by the Booking system: OVH (servers and database), Brevo / Sendinblue SAS (sending e-mails), Google (Firebase Hosting, Google Analytics), Microsoft (Clarity) and Cloudflare (Turnstile - protecting forms against bots); the analytics tools in the Booking system run only with your consent;
- the e-mail provider;
- an accounting firm and a law firm, where necessary.
Recipients that are separate controllers:
- Compensa Towarzystwo Ubezpieczeń S.A. Vienna Insurance Group - KL and NNW insurance;
- accommodation providers, local coaches and local transport providers - to the extent needed to deliver the camp (first name and surname, dates, number of people, room type);
- the bank - for payments;
- public authorities (e.g. the tax office, the marshal of the region) where required by law; in the event of insolvency - the guarantor and the marshal of the region.
Services that run in your browser:
- The forecast on the LIVE page fetches weather data from our own server (Open-Meteo software and public weather model data). Your browser does not connect to Open-Meteo or any other external weather service for it.
- The Salted font may be loaded from Adobe Fonts (Adobe Systems Software Ireland Ltd.), which sees your IP address and does not set cookies.
- Links to Instagram, WhatsApp and Facebook lead to services that are themselves responsible for data. We send nothing to them until you click.
5. Transfers of data outside the European Economic Area
Some providers (Cloudflare, Google, Microsoft) may process data in the USA. The basis for the transfer is the European Commission's adequacy decision under the EU-US Data Privacy Framework (the providers are certified under it) and standard contractual clauses. You can obtain a copy of the safeguards by writing to us. If a camp takes place outside the EEA (e.g. Indonesia, Costa Rica), we transfer to local partners the data needed to perform the contract, on the basis of art. 49(1)(b) and (c) GDPR.
6. Your rights
You have the right to:
- access your data and receive a copy of it (art. 15 GDPR);
- rectification of your data (art. 16);
- erasure of your data (art. 17);
- restriction of processing (art. 18);
- portability of the data you have provided to us on the basis of a contract or consent (art. 20);
- object to processing based on our legitimate interest (art. 21); we always respect an objection to marketing;
- withdraw consent at any time, without affecting the lawfulness of processing before its withdrawal.
Write to us at the address in section 1. We will reply within one month. In complex cases we may extend this period by two months - we will then let you know.
You also have the right to lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (PUODO, the Polish data protection authority), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
7. Security
The website works only over an encrypted HTTPS connection. Only team members who need participants' data to organise the camp have access to it. We have data processing agreements with our providers.
8. Cookies
The rules on cookies and browser storage are described in the Cookie Policy.
9. Changes
When we change the way we process data (e.g. a new provider), we will update this Policy and the date at the top of the page. We will inform newsletter subscribers of material changes by e-mail.