Privacy policy

Privacy Policy

Last updated: 20 July 2026

1. Who we are (data controller)

Bruna Surf Oy (“Bruna”, “we”, “us”). Business ID: 3554824-4.
Address: Viitankruununtie 34 A 4, 00970 Helsinki, Finland.
Contact: privacy@brunasurf.com.

2. What we collect

When you… We collect…
Enquire or book Name, email, phone, billing details, emergency contact, passport info if needed for travel
Join our mailing list Name, email, phone number (only if/when you sign up)
Visit our site Essential cookies needed to run the site and forms

Health or dietary info is collected only if you choose to share it for your safety on a trip, and we use it only for that purpose.

3. Why we use your data (legal bases)

  • Contract – manage enquiries, process bookings and payments, and run your trip.
  • Consent – newsletters, and non-essential cookies (analytics and advertising).
  • Legitimate interests – keep the site working and our service smooth.
  • Legal obligation – meet tax/accounting and consumer-protection laws.

4. Cookies

We use essential cookies to run the site and forms. We also use Meta Pixel and Google Analytics to understand site visits and measure our ads. These aren't essential — you'll see a cookie banner where you can accept or decline them, and declining won't affect your booking.

5. Who gets your data

Only what’s needed, only when needed:

  • Hosting & forms: Webflow
  • Payments: Stripe
  • Email marketing: MailerLite
  • Advertising & analytics: Meta, Google Analytics
  • Trip partners: trusted local hosts/coaches receive only the minimum details required to run the trip (e.g., name, rooming, dietary info you shared, emergency contact)

We don’t sell your data.

6. International transfers

Some providers may process data outside the EEA. When that happens, we use EU-approved safeguards such as Standard Contractual Clauses.

7. Security

We use encryption in transit, access controls, and reputable vendors. No system is perfect, but we work to keep your data safe.

8. How long we keep it

  • Booking & transaction records: kept as part of our accounting—generally up to 6 years for receipts/vouchers and up to 10 years for ledgers/financial statements, as required by Finnish law.
  • Newsletter data: until you unsubscribe or ask us to delete it.
  • Cookie data: essential cookies expire per their function. Analytics and advertising cookies (Meta Pixel, Google Analytics) are set according to each provider's own retention periods.

9. Your rights

You can request access, correction, deletion, restriction, or portability of your data, and you can object to certain uses. You can withdraw consent at any time (for example, marketing emails).

10. How to use those rights

Email hello@brunasurf.com. We aim to reply within 30 days.
If you’re in the EU/EEA and not satisfied with our response, you can complain to your local authority. In Finland: the Office of the Data Protection Ombudsman.

11. Children

Our services aren’t directed to under-18s and we don’t knowingly collect their data.

12. Changes

We’ll update this page if anything important changes and, if it affects your rights, we’ll let you know.