Information on the processing of personal data
pursuant to art. 13 of Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD)
Last updated: May 15, 2026
1. Data controller
The data controller of the personal data collected through this website is:
Maria Camilla Montironi
Legal form: High in the census of entrepreneurs, professionals and tenants.
Description of the activity: Schools and improvement services
NIF/CIF: Y7132054K
Address: Calle la Lantrera, 3, 35560 CAP, Lajares, Fuerteventura, Las Palmas
Email: kamiexperience.info@gmail.com
Phone/WhatsApp: +34 643 825 387
Website: www.kamiexperience.com
A Data Protection Officer (DPO) has not been appointed, as the nature, scope, and purposes of the processing activities performed do not fall within the circumstances that make their designation mandatory pursuant to Article 37 of the GDPR.
2. Scope of application
This privacy notice applies to the website kamiexperience.com and to the versions en.kamiexperience.com and es.kamiexperience.com, both hosted on the Wix platform with a custom domain. It describes the processing of personal data of users who visit the website, complete contact or booking forms, take part in the courses and sporting activities organised by Kami Experience.
Kami Experience is a kitesurfing and wingfoiling school with operational bases in Corralejo and El Cotillo, Fuerteventura, Canary Islands, Spain. The services offered include kitesurfing and wingfoiling courses for all levels, private lessons, camps, tow-in sessions, wingfoil equipment rental, and boat transport where necessary for the provision of lessons.
3. Categories of data collected and methods of collection
3.1 Contact form (website — native Wix form)
Data collected: first name, last name, email address, phone number, free message. Method: voluntary completion of the form by the user.
3.2 Booking via TidyCal
Data collected: first name, last name, email address, time zone, selected date and time, any notes entered by the user. Method: The user is redirected to the external TidyCal platform (tidycal.com) to complete the booking. The data is collected and managed directly by TidyCal/Sumo Group Inc. on behalf of the owner.
3.3 Release and Disclaimer Form
Data collected: name, surname, date of birth, ID (type and number), nationality, gender; signed declarations regarding: liability waiver for accidents, liability waiver for personal items, consent to the use of images and videos, awareness of weather and sea conditions, consent to the processing of personal data, acceptance of the cancellation policy.
Kami Experience may collect, with the data subject's explicit consent, information relating to health conditions relevant to the safety of sports activities (e.g., heart conditions, epilepsy, physical conditions incompatible with water activities). This information constitutes special category data pursuant to Art. 9 of the GDPR and is processed exclusively to ensure participant safety during lessons. It is not disclosed to third parties except in the event of a health emergency.
Collection method: digital (link sent at the time of booking, stored on Wix and copied to a local file) or paper (form delivered before the lesson, physically stored at the operational headquarters).
3.4 Data relating to minors
For participants under 18 (service available for ages 8 and up), the minor's personal data is collected along with the data of the parent or legal guardian who signs the release and consent to data processing. Consent to the use of the minor's images and videos must be given by the parent or legal guardian.
3.5 Communications via WhatsApp
Data collected: phone number, content of exchanged messages, communication metadata. Method: direct communication channel activated at the user's initiative. The service is managed by WhatsApp (Meta Platforms Inc.).
3.6 Site navigation and cookies
Data collected: IP address (anonymized), pages visited, session duration, browser and device type, site interaction data. For detailed information on the use of cookies and tracking technologies, please refer to the Cookie Policy available on the site.
3.7 Reviews and testimonials
Reviews posted independently by users on Google and subsequently displayed via embedded widgets on the site are not collected, modified, or manually entered by the owner. The owner does not directly process the personal data contained in the reviews: the processing is carried out by Google LLC according to its terms of service.
The owner does not carry out automated profiling activities nor does it adopt decisions based solely on automated data processing.
4. Purpose of processing and legal bases
Purpose | Legal basis | Legal reference |
|---|---|---|
Respond to inquiries via form or WhatsApp | Pre-contractual measures at the request of the interested party | Art. 6(1)(b) GDPR |
Management of bookings and contractual relationships | Execution of the contract | Art. 6(1)(b) GDPR |
Providing safe sports education services | Contract performance + legal obligation | Art. 6(1)(b)(c) GDPR |
Collection and storage of the signed release | Legal obligation (mandatory documentation for sports activities) + legitimate interest (protection from civil liability) | Art. 6(1)(c)(f) GDPR |
Collection of health data relevant to safety [if applicable — PENDING] | Explicit consent | Art. 9(2)(a) GDPR |
Use of images and videos for websites, social networks and promotional materials | Consent of the interested party (or guardian for minors) | Art. 6(1)(a) GDPR |
Invoicing and tax compliance | Legal obligation | Art. 6(1)(c) GDPR |
Website security and abuse prevention | Legitimate interest | Art. 6(1)(f) GDPR |
Statistical analysis of site visits (GA4 with anonymized IP) | Consent (acquired via CMP Usercentrics) | Art. 6(1)(a) GDPR |
5. Data recipients
Users' personal data may be disclosed, to the extent strictly necessary for the purposes indicated, to the following categories of subjects:
Technical providers of the website and digital services (Data Processors pursuant to Art. 28 GDPR):
Wix.com Ltd. (Israel/USA) — website hosting and content management system. DPA accepted. Wix is certified under the EU-US Data Privacy Framework.
TidyCal / Sumo Group Inc. (USA) — online booking platform. Transfers outside the EEA are covered by Standard Contractual Clauses as stated by TidyCal in its DPA (see section 7).
Usercentrics GmbH (Germany) — Cookie Consent Management Platform (CMP).
Google LLC (USA) — Google Analytics 4 (with anonymized IP), Google Maps (widget embedded in the contact page), typographic fonts. Transfer outside the EEA covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
Meta Platforms Inc. / WhatsApp (USA) — communications via WhatsApp at the user's initiative. Transfers outside the EEA are covered by Standard Contractual Clauses (see section 7).
Stripe, Inc. and PayPal Holdings, Inc. (USA) — payment processors. Payments are not made through the website but through external channels managed directly by these providers, who act as independent data controllers for the financial transaction. The data controller only provides these providers with the data strictly necessary to complete the payment.
Entities legally obliged to receive data:
felix sosa estevez <fsecorralejo@hotmail.com>
Helvetia Responsabilidad Civil General. Helvetia Compañia Suiza, SA de Seguros y Reaseguros
Paseo de Cristóbol Colón, 26 - 41001 Sevilla.Certificado Seguro Accidentes Colectivos. No police 84290208 Order 7027 - Innominate Group Accidents
Public authorities (Tax Agency, law enforcement, health authorities) — exclusively upon formal request within the scope of their institutional powers.
SIEL, the operational partner for the use of the ground spaces in Corralejo, does not have access to students' personal data.
6. Data retention
Personal data shall be retained solely for the period strictly necessary to fulfil the purposes for which they were collected, in accordance with the mandatory legal retention periods applicable in Spain.
Data category | Retention period |
|---|---|
Contact information (information requests without a contract) | 12 months from the last contact, unless a contractual relationship is established |
Booking and contract data | Duration of the contractual relationship + 5 years (statute of limitations for civil actions, art. 1964 of the Spanish Civil Code) |
Signed releases (digital and paper) | 5 years from the date of the lesson (statutory limitation for non-contractual liability actions) |
Health data | Duration of participation in the activity + 5 years |
Tax data and accounting documents | 5 years (art. 30 Código de Comercio) / 4 years for tax obligations (art. 66 Ley General Tributaria) — the longer term applies |
Images and videos with consent | Until the interested party revokes consent |
Browsing and analytics data | 14 months (standard GA4 configuration with anonymized IP) |
Upon expiry of the retention periods indicated, the data shall be deleted or irreversibly anonymised.
7. International data transfers
Some technical providers used by Kami Experience are based in the United States or process data outside the European Economic Area. For each transfer, the guarantees required by Article 46 of the GDPR are in place:
TidyCal / Sumo Group Inc. (USA) : The data entered into the booking platform may be processed in the USA. According to TidyCal's Data Processing Agreement, in the event of transfers outside the EEA, the parties rely on the Standard Contractual Clauses approved by the European Commission. The data controller has verified this statement in TidyCal's public documentation but cannot independently guarantee the provider's compliance with these measures. Users can consult TidyCal's privacy policy at tidycal.com/privacy.
Google LLC (USA) : Google Analytics and Google Maps services may involve transfers to the USA, covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
Meta Platforms Inc. / WhatsApp (USA) : Communications via WhatsApp involve the transfer of metadata to Meta servers in the USA, covered by Standard Contractual Clauses. Please note that WhatsApp is currently used in the personal, not business, version: any user who initiates a communication via this channel implicitly accepts Meta's terms of use.
Wix.com Ltd .: Wix is certified under the EU-US Data Privacy Framework and has entered into Standard Contractual Clauses for transfers outside the EEA.
8. Rights of data subjects
As a data subject, you have the right to:
Access (Article 15 GDPR): obtain confirmation as to whether or not personal data concerning you is being processed and, if so, obtain a copy of it.
Rectification (Article 16 GDPR): obtain the correction of inaccurate or incomplete data.
Erasure (Article 17 of the GDPR): Obtain the erasure of your data, unless processing is necessary for compliance with legal obligations or for the defense of legal claims.
Restriction of processing (Article 18 GDPR): obtain suspension of processing in the cases provided for by the law.
Objection (Article 21 GDPR): object to processing based on the data controller's legitimate interest.
Portability (Article 20 GDPR): receive your data in a structured, machine-readable format, where processing is based on consent or a contract.
Withdrawal of consent (art. 7(3) GDPR): withdraw the consent given at any time (e.g. for the use of images/videos), without prejudice to the lawfulness of the processing carried out before the withdrawal.
To exercise their rights, the interested party may send a written request to kamiexperience.info@gmail.com, specifying "Privacy request — [type of right]" in the subject line and attaching a copy of an identity document. The data controller will respond within 30 days of receiving the request. In particularly complex cases, this deadline may be extended by an additional 60 days, subject to prior notification to the interested party.
9. Right to lodge a complaint with a supervisory authority
The interested party has the right to lodge a complaint with the competent supervisory authority. In Spain, the competent authority is:
Spanish Data Protection Agency (AEPD)
Headquarters: C/ Jorge Juan, 6, 28001 Madrid, Spain
Website: www.aepd.es
10. Minors
Kami Experience services are available to children from the age of 8.
Minors under the age of 18 may not independently provide the consents required for participation in the activity, for the use of images and videos, or for any other processing activity requiring consent as its legal basis.
Such consents must be provided by the parent or legal guardian, who shall sign the release form on behalf of the minor.
The Data Controller adopts reasonable measures to verify that consents relating to minors are effectively provided by the holder of parental responsibility.
The data controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, pursuant to Art. 32 of the GDPR. These measures include, among other things: data access limited to authorized persons only, secure storage of paper forms at the operational headquarters, and the use of third-party platforms that adopt their own certified security measures (Wix, TidyCal, Usercentrics).
Please note that communications via WhatsApp, activated at the user's initiative, take place through a third-party platform and are subject to the security measures of Meta Platforms Inc.
11. Data security
12. Cookies and tracking technologies
The site uses technical cookies necessary for its operation and analytical/functional cookies requiring user consent. Consent is obtained through the Usercentrics platform, integrated into the site. For detailed information on the cookies used, their purposes, the third parties involved, and how to manage or withdraw consent, please refer to the Cookie Policy published on the site.
13. Updates to this information
La presente informativa può essere aggiornata in seguito a modifiche normative, all'adozione di nuovi strumenti tecnici o a variazioni nell'organizzazione dei servizi. La data dell'ultima versione è indicata in cima al documento. Per modifiche sostanziali che riguardino trattamenti basati sul consenso, gli utenti saranno informati tramite avviso sul sito o comunicazione diretta, ove possibile.