Privacy Policy

Last updated: 10 September 2025

1. Who we are (data controller)

Bruna Surf Oy (“Bruna”, “we”, “us”). Business ID: 3554824-4.
Address: Viitankruununtie 34 A 4, 00970 Helsinki, Finland.
Contact: privacy@brunasurf.com.

2. What we collect

Health or dietary info is collected only if you choose to share it for your safety on a trip, and we use it only for that purpose.

3. Why we use your data (legal bases)

• Contract – manage enquiries, process bookings and payments, and run your trip.
• Consent – newsletters and any non-essential cookies (if we add them later).
• Legitimate interests – keep the site working and our service smooth.
• Legal obligation – meet tax/accounting and consumer-protection laws.

4. Cookies

Right now we use only essential cookies (for core site and forms). If we add analytics or marketing cookies later, we’ll ask for your consent first and update this page.

5. Who gets your data

Only what’s needed, only when needed:

• Hosting & forms: Webflow
• Payments: Stripe
• Trip partners: trusted local hosts/coaches receive only the minimum details required to run the trip (e.g., name, rooming, dietary info you shared, emergency contact)

We don’t sell your data. Ever.

6. International transfers

Some providers may process data outside the EEA. When that happens, we use EU-approved safeguards such as Standard Contractual Clauses.

7. Security

We use encryption in transit, access controls, and reputable vendors. No system is perfect, but we work to keep your data safe.

8. How long we keep it

• Booking & transaction records: kept as part of our accounting—generally up to 6 years for receipts/vouchers and up to 10 years for ledgers/financial statements, as required by Finnish law.
• Newsletter data: until you unsubscribe or ask us to delete it.
• Cookie data: essential cookies expire per their function; we don’t use non-essential cookies right now.

9. Your rights

You can request access, correction, deletion, restriction, or portability of your data, and you can object to certain uses. You can withdraw consent at any time (for example, marketing emails).

10. How to use those rights

Email privacy@brunasurf.com. We aim to reply within 30 days.
If you’re in the EU/EEA and not satisfied with our response, you can complain to your local authority. In Finland: the Office of the Data Protection Ombudsman.

11. Children

Our services aren’t directed to under-18s and we don’t knowingly collect their data.

12. Changes

We’ll update this page if anything important changes and, if it affects your rights, we’ll let you know.