Your data
What we collect when you enquire or book, why we hold it, and how to get it removed.
When you enquire or book we collect your name, email address, phone number, passport details needed for the vessel manifest and Indonesian port clearance, your flight details so we can meet you in Padang, and anything you tell us about dietary needs, your surfing level or your board quiver.
When you visit this website we collect usage statistics through Google Analytics, and only if you have agreed to it. We do not use advertising cookies and we do not sell data to anyone.
This site uses one set of cookies, and only after you have said yes to them. They belong to Google Analytics and they tell us how many people visit, which pages are read and which countries they are read from. Nothing in them identifies you by name.
Until you accept, no analytics cookie is written. If you refuse, none is ever written. You can change your answer at any time through the Cookies link at the bottom of any page.
We use no advertising cookies, no remarketing and no social media trackers.
To answer your enquiry, to run your trip, to meet Indonesian maritime and immigration requirements, and to send you information about the trip you have booked. We rely on your consent for enquiries, on the performance of our contract with you for bookings, and on legal obligation for the manifest.
Our crew and ground team in Padang, the Indonesian port authorities where required by law, and the service providers that run our email and website. Nobody else.
Enquiry emails are kept while the conversation is live and for a reasonable period afterwards. Booking records are kept as long as required for accounting and maritime records. Passport details are deleted once the trip is complete and clearance is closed.
You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to sumatrasurftrip@gmail.com and we will respond within thirty days. If you are in the European Union you also have the right to complain to your national data protection authority.
We photograph and film trips, and we use those images on this website and on social media. If you would rather not appear, tell your guide at the start of the trip and we will respect it.
This is a working draft. Before it goes live it needs a named data controller and a contact address on a domain the business owns, rather than a gmail address, and a review against the GDPR if the business markets to European guests, which it does.
Questions about any of this? Ask before you book, not after. We answer on WhatsApp the same day.
Ask a question