Short version: we use what you send us to answer you and to coach you, we set no cookies, and your footage is never published without your written permission.
The controller of the personal data described here is Between Weeks, Lda, tax number (NIPC) 517811650, registered at Rua da Torre Alta, lote 88, 8600-550 Lagos, Portugal, trading as Concrete Surfers.
For anything about your data, write to info@concrete-surfers.com. There is no separate Data Protection Officer; that address reaches the person responsible.
Your name, email, and optionally your phone or WhatsApp number, your country or time zone, what you are interested in, where your surfing is, a link to your footage, whatever you write in the free-text fields, and your confirmation that you are 18 or over or that a parent or guardian is booking. We use it for one thing: to answer you and, if you go ahead, to deliver the coaching. Legal basis: performance of a contract, or steps taken at your request before entering one (Article 6(1)(b) GDPR).
Your email is added to an occasional mailing list. Legal basis: your consent (Article 6(1)(a) GDPR). Every email carries a one-click unsubscribe, and withdrawing consent is as easy as giving it. Unticking the box changes nothing else about your enquiry.
Footage of you surfing is personal data, and it is usually the most identifiable thing you will give us. By default we use it to carry out the analysis you asked for and for nothing else.
The form carries a separate checkbox: you may use my clip as an example. What it means depends on what you asked for.
For the Snapshot, it is a condition. The Snapshot costs nothing because the clip and what we found in it may be shared, on social media, on this site or in a newsletter. We say this on the Snapshot card and at the checkbox before you send anything. If you would rather your footage stayed private, the Diagnostic is the paid equivalent and nothing from it is ever shared.
For everything else, it is optional and unticked by default. Leaving it unticked changes nothing about the coaching you get.
Either way you choose how you are credited — first name, first name and Instagram handle, or anonymously — and you can withdraw permission at any time by emailing us. We then stop using the clip from that point on; we cannot recall a post other people have already shared.
When you give either consent we keep a record of it: the exact wording you saw, what you chose and when. If you withdraw, the withdrawal is added to that record with its date. We keep the record so we can show what you agreed to.
A Snapshot or Diagnostic report is published on a private web page at a long, random link that only you receive. The page is not listed anywhere or indexed by search engines, and we can switch the link off at any time. It contains only what the coach wrote for you.
Most payments are made by bank transfer, in which case your bank sees the transfer and we see the reference and the amount. Where a payment is taken by card through Stripe, Stripe processes the card details directly and we never see or store them.
Our host records technical information such as IP address, browser and the pages requested, in order to serve the site and defend it from abuse. Legal basis: legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
This site sets no cookies. It runs no analytics, no advertising pixels, no session storage and no third-party tracking of any kind. Every font, stylesheet, script and image is served from this domain, so opening a page sends no request to any other company. That is also why you are not being asked to accept anything.
If that ever changes, if analytics or an embedded video are added, a consent banner will appear first, non-essential cookies will stay off until you actively accept, and this section will be rewritten to list each one.
We do not sell or trade personal data. It is shared only with the service providers needed to run the business, each acting on our instructions:
Netlify, Supabase, Resend, Google and Stripe are United States companies. Our database is stored in the EU, but the provider running it is American. Where data reaches them it is transferred under the safeguards allowed by Chapter V of the GDPR — the EU–US Data Privacy Framework where the provider is certified, and the European Commission's Standard Contractual Clauses otherwise.
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, send it to you or to someone else in a portable format, or object to our processing it. Where we rely on consent, you can withdraw it at any time without affecting what was lawful before.
Write to info@concrete-surfers.com and we will answer within one month. If you are not satisfied, you can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live.
We do coach people under 18. Where we do, the booking is made by a parent or legal guardian, and it is they who give consent for us to hold and use the young person's data, including any footage, under Article 8 of the GDPR. We collect no more than the coaching needs, we do not add anyone under 18 to a mailing list, and a parent or guardian can exercise every right in section 7 on their behalf.
If this policy changes materially, the date below changes with it and, where the change affects something you have already given us, we tell you directly.
Last updated 30 September 2026